- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] comedi: Flush partial mappings in error case
by Chen Ridong 17 Feb '25

17 Feb '25

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.231 commit b9322408d83accc8b96322bc7356593206288c56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGS CVE: CVE-2024-53148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ce8f9fb651fac95dd41f69afe54d935420b945bd upstream. If some remap_pfn_range() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedi_buf_map_put(bm). The userspace mappings are only cleaned up later in the mmap error path. Fix it by explicitly flushing all mappings in our VMA on the error path. See commit 79a61cc3fc04 ("mm: avoid leaving partial pfn mappings around in error case"). Cc: stable(a)vger.kernel.org Fixes: ed9eccbe8970 ("Staging: add comedi core") Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20241017-comedi-tlb-v3-1-16b82f9372ce@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- drivers/staging/comedi/comedi_fops.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c index 9858fae816f7..8f896e6208a8 100644 --- a/drivers/staging/comedi/comedi_fops.c +++ b/drivers/staging/comedi/comedi_fops.c @@ -2402,6 +2402,18 @@ static int comedi_mmap(struct file *file, struct vm_area_struct *vma) start += PAGE_SIZE; } + +#ifdef CONFIG_MMU + /* + * Leaving behind a partial mapping of a buffer we're about to + * drop is unsafe, see remap_pfn_range_notrack(). + * We need to zap the range here ourselves instead of relying + * on the automatic zapping in remap_pfn_range() because we call + * remap_pfn_range() in a loop. + */ + if (retval) + zap_vma_ptes(vma, vma->vm_start, size); +#endif } if (retval == 0) { -- 2.34.1

2 1

[PATCH OLK-6.6] ALSA: seq: oss: Fix races at processing SysEx messages
by Gu Bowen 17 Feb '25

17 Feb '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.70 commit d2392b79d8af3714ea8878b71c66dc49d3110f44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2T CVE: CVE-2024-57893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0179488ca992d79908b8e26b9213f1554fc5bacc upstream. OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets. Reported-by: Kun Hu <huk23(a)m.fudan.edu.cn> Closes: https://lore.kernel.org/2B7E93E4-B13A-4AE4-8E87-306A8EE9BBB7@m.fudan.edu.cn Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20241230110543.32454-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- sound/core/seq/oss/seq_oss_synth.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c index e3394919daa0..51ee4c00a843 100644 --- a/sound/core/seq/oss/seq_oss_synth.c +++ b/sound/core/seq/oss/seq_oss_synth.c @@ -66,6 +66,7 @@ static struct seq_oss_synth midi_synth_dev = { }; static DEFINE_SPINLOCK(register_lock); +static DEFINE_MUTEX(sysex_mutex); /* * prototypes @@ -497,6 +498,7 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, if (!info) return -ENXIO; + guard(mutex)(&sysex_mutex); sysex = info->sysex; if (sysex == NULL) { sysex = kzalloc(sizeof(*sysex), GFP_KERNEL); -- 2.25.1

2 1

[PATCH OLK-5.10] iomap: avoid avoid truncating 64-bit offset to 32 bits
by Long Li 17 Feb '25

17 Feb '25

From: Marco Nelissen <marco.nelissen(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit c13094b894de289514d84b8db56d1f2931a0bade category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJXF0 CVE: CVE-2025-21667 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to an xfs filesystem. Signed-off-by: Marco Nelissen <marco.nelissen(a)gmail.com> Link: https://lore.kernel.org/r/20250109041253.2494374-1-marco.nelissen@gmail.com Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Conflicts: fs/xfs/xfs_iomap.c fs/iomap/buffered-io.c [Conflicts due to not merged 492f53758fad ("iomap: pass the iomap to the punch callback")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_iomap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index dc01689988ab..7395674066cf 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1191,11 +1191,11 @@ xfs_iomap_write_delalloc_scan( * the end of this data range, not the end of the folio. */ *punch_start_byte = min_t(loff_t, end_byte, - (page->index + 1) << PAGE_SHIFT); + page_offset(page) + PAGE_SIZE); } /* move offset to start of next folio in range */ - start_byte = (page->index + 1) << PAGE_SHIFT; + start_byte = page_offset(page) + PAGE_SIZE; unlock_page(page); put_page(page); } -- 2.39.2

2 1

[PATCH v2 OLK-5.10 00/10] Implementation of the uncore frequency modulation feature
by Xiangwei Li 17 Feb '25

17 Feb '25

Devfreq is a general DVFS framework for non-CPU devices in the kernel. It is generally used for bus devices. Implementation of uncore dynamic frequency modulation based on this framework. Jie Zhan (1): PM / devfreq: Add HiSilicon uncore frequency scaling driver Xiangwei Li (9): PM / devfreq: Adjust default HiSilicon uncore devfreq polling interval and workqueue PM / devfreq: event: Add devfreq_event_get_edev_by_dev interface PM / devfreq: event: Supplement the name content of the event in devfreq-event PM / devfreq: Add related-package parameter in HiSilicon uncore devfreq PM / devfreq: Add associated events configuration in HiSilicon uncore frequency PM / devfreq: event: Add L3C event for HiSilicon uncore devfreq PM / devfreq: Add until governor PM / devfreq: Add bandwidth verification mechanism PM / devfreq: event: Add DDRC event for HiSilicon uncore devfreq drivers/devfreq/Kconfig | 12 + drivers/devfreq/Makefile | 2 + drivers/devfreq/devfreq-event.c | 34 +- drivers/devfreq/event/Kconfig | 7 + drivers/devfreq/event/Makefile | 2 + drivers/devfreq/event/hisi-uncore-ddrc.c | 167 ++++++ drivers/devfreq/event/hisi-uncore-l3c.c | 166 ++++++ drivers/devfreq/event/hisi-uncore.c | 249 +++++++++ drivers/devfreq/event/hisi-uncore.h | 88 +++ drivers/devfreq/governor_util.c | 124 +++++ drivers/devfreq/hisi_uncore_freq.c | 681 +++++++++++++++++++++++ include/linux/devfreq-event.h | 8 + include/linux/devfreq.h | 15 + 13 files changed, 1554 insertions(+), 1 deletion(-) create mode 100644 drivers/devfreq/event/hisi-uncore-ddrc.c create mode 100644 drivers/devfreq/event/hisi-uncore-l3c.c create mode 100644 drivers/devfreq/event/hisi-uncore.c create mode 100644 drivers/devfreq/event/hisi-uncore.h create mode 100644 drivers/devfreq/governor_util.c create mode 100644 drivers/devfreq/hisi_uncore_freq.c -- 2.25.1

2 11

[PATCH OLK-5.10 00/10] Implementation of the uncore frequency modulation feature
by Xiangwei Li 17 Feb '25

17 Feb '25

Devfreq is a general DVFS framework for non-CPU devices in the kernel. It is generally used for bus devices. Implementation of uncore dynamic frequency modulation based on this framework. Jie Zhan (1): PM / devfreq: Add HiSilicon uncore frequency scaling driver Xiangwei Li (9): PM / devfreq: Adjust default HiSilicon uncore devfreq polling interval and workqueue PM / devfreq: event: Add devfreq_event_get_edev_by_dev interface PM / devfreq: event: Supplement the name content of the event in devfreq-event PM / devfreq: Add related-package parameter in HiSilicon uncore devfreq PM / devfreq: Add associated events configuration in HiSilicon uncore frequency PM / devfreq: event: Add L3C event for HiSilicon uncore devfreq PM / devfreq: Add until governor PM / devfreq: Add bandwidth verification mechanism PM / devfreq: event: Add DDRC event for HiSilicon uncore devfreq drivers/devfreq/Kconfig | 12 + drivers/devfreq/Makefile | 2 + drivers/devfreq/devfreq-event.c | 34 +- drivers/devfreq/event/Kconfig | 7 + drivers/devfreq/event/Makefile | 2 + drivers/devfreq/event/hisi-uncore-ddrc.c | 167 ++++++ drivers/devfreq/event/hisi-uncore-l3c.c | 166 ++++++ drivers/devfreq/event/hisi-uncore.c | 249 +++++++++ drivers/devfreq/event/hisi-uncore.h | 88 +++ drivers/devfreq/governor_util.c | 124 +++++ drivers/devfreq/hisi_uncore_freq.c | 681 +++++++++++++++++++++++ include/linux/devfreq-event.h | 8 + include/linux/devfreq.h | 15 + 13 files changed, 1554 insertions(+), 1 deletion(-) create mode 100644 drivers/devfreq/event/hisi-uncore-ddrc.c create mode 100644 drivers/devfreq/event/hisi-uncore-l3c.c create mode 100644 drivers/devfreq/event/hisi-uncore.c create mode 100644 drivers/devfreq/event/hisi-uncore.h create mode 100644 drivers/devfreq/governor_util.c create mode 100644 drivers/devfreq/hisi_uncore_freq.c -- 2.25.1

2 11

[openeuler:openEuler-1.0-LTS 1424/1424] mm/memory_hotplug.c:926:23: warning: unused variable 'start_pfn'
by kernel test robot 17 Feb '25

17 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bd6fde5ff5b73d04068bdad2dc7730479d4df355 commit: 2f5f99f3efc5d34c37f9918c50808a4cfe36c211 [1424/1424] mm: handle uninitialized numa nodes gracefully config: x86_64-buildonly-randconfig-004-20250217 (https://download.01.org/0day-ci/archive/20250217/202502171533.xL4t91Bt-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250217/202502171533.xL4t91Bt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502171533.xL4t91Bt-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/memory_hotplug.c: In function '__remove_section': mm/memory_hotplug.c:481:23: warning: variable 'start_pfn' set but not used [-Wunused-but-set-variable] 481 | unsigned long start_pfn; | ^~~~~~~~~ mm/memory_hotplug.c: In function 'hotadd_init_pgdat': >> mm/memory_hotplug.c:926:23: warning: unused variable 'start_pfn' [-Wunused-variable] 926 | unsigned long start_pfn = PFN_DOWN(start); | ^~~~~~~~~ mm/memory_hotplug.c: At top level: >> mm/memory_hotplug.c:971:13: warning: 'rollback_node_hotadd' defined but not used [-Wunused-function] 971 | static void rollback_node_hotadd(int nid) | ^~~~~~~~~~~~~~~~~~~~ In file included from include/linux/migrate.h:6, from mm/memory_hotplug.c:27: include/linux/mempolicy.h:329:13: warning: '__do_mbind' defined but not used [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ vim +/start_pfn +926 mm/memory_hotplug.c 0bd85420087389 Tang Chen 2014-11-13 921 e13193319d3a55 Hidetoshi Seto 2009-11-17 922 /* we are OK calling __meminit stuff here - we have CONFIG_MEMORY_HOTPLUG */ 2f5f99f3efc5d3 Michal Hocko 2023-11-08 923 static pg_data_t __ref *hotadd_init_pgdat(int nid, u64 start) 9af3c2dea3a3ae Yasunori Goto 2006-06-27 924 { 9af3c2dea3a3ae Yasunori Goto 2006-06-27 925 struct pglist_data *pgdat; c8e861a531b019 Fabian Frederick 2014-06-04 @926 unsigned long start_pfn = PFN_DOWN(start); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 927 a1e565aa3cfc7c Tang Chen 2013-02-22 928 pgdat = NODE_DATA(nid); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 929 2f5f99f3efc5d3 Michal Hocko 2023-11-08 930 /* 2f5f99f3efc5d3 Michal Hocko 2023-11-08 931 * NODE_DATA is preallocated (free_area_init) but its internal 2f5f99f3efc5d3 Michal Hocko 2023-11-08 932 * state is not allocated completely. Add missing pieces. 2f5f99f3efc5d3 Michal Hocko 2023-11-08 933 * Completely offline nodes stay around and they just need 2f5f99f3efc5d3 Michal Hocko 2023-11-08 934 * reintialization. 2f5f99f3efc5d3 Michal Hocko 2023-11-08 935 */ 2f5f99f3efc5d3 Michal Hocko 2023-11-08 936 if (pgdat->per_cpu_nodestats == &boot_nodestats) { b0dc3a342af36f Gu Zheng 2015-03-25 937 } else { e716f2eb24defb Mel Gorman 2017-05-03 938 /* e716f2eb24defb Mel Gorman 2017-05-03 939 * Reset the nr_zones, order and classzone_idx before reuse. e716f2eb24defb Mel Gorman 2017-05-03 940 * Note that kswapd will init kswapd_classzone_idx properly e716f2eb24defb Mel Gorman 2017-05-03 941 * when it starts in the near future. e716f2eb24defb Mel Gorman 2017-05-03 942 */ b0dc3a342af36f Gu Zheng 2015-03-25 943 pgdat->nr_zones = 0; 38087d9b036098 Mel Gorman 2016-07-28 944 pgdat->kswapd_order = 0; 38087d9b036098 Mel Gorman 2016-07-28 945 pgdat->kswapd_classzone_idx = 0; a1e565aa3cfc7c Tang Chen 2013-02-22 946 } 9af3c2dea3a3ae Yasunori Goto 2006-06-27 947 2f5f99f3efc5d3 Michal Hocko 2023-11-08 948 pgdat->node_start_pfn = 0; 03e85f9d5f1f8c Oscar Salvador 2018-08-21 949 9af3c2dea3a3ae Yasunori Goto 2006-06-27 950 /* init node's zones as empty zones, we don't have any present pages.*/ 03e85f9d5f1f8c Oscar Salvador 2018-08-21 951 free_area_init_core_hotplug(nid); 5830169f47269f Reza Arbab 2016-08-11 952 pgdat->per_cpu_nodestats = alloc_percpu(struct per_cpu_nodestat); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 953 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 954 /* 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 955 * The node we allocated has no zone fallback lists. For avoiding 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 956 * to access not-initialized zonelist, build here. 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 957 */ 72675e131eb418 Michal Hocko 2017-09-06 958 build_all_zonelists(pgdat); 959ecc48fc7506 KAMEZAWA Hiroyuki 2011-06-15 959 0bd85420087389 Tang Chen 2014-11-13 960 /* 0bd85420087389 Tang Chen 2014-11-13 961 * When memory is hot-added, all the memory is in offline state. So 0bd85420087389 Tang Chen 2014-11-13 962 * clear all zones' present_pages because they will be updated in 0bd85420087389 Tang Chen 2014-11-13 963 * online_pages() and offline_pages(). 0bd85420087389 Tang Chen 2014-11-13 964 */ 03e85f9d5f1f8c Oscar Salvador 2018-08-21 965 reset_node_managed_pages(pgdat); 0bd85420087389 Tang Chen 2014-11-13 966 reset_node_present_pages(pgdat); 0bd85420087389 Tang Chen 2014-11-13 967 9af3c2dea3a3ae Yasunori Goto 2006-06-27 968 return pgdat; 9af3c2dea3a3ae Yasunori Goto 2006-06-27 969 } 9af3c2dea3a3ae Yasunori Goto 2006-06-27 970 b9ff036082cd17 Oscar Salvador 2018-08-17 @971 static void rollback_node_hotadd(int nid) 9af3c2dea3a3ae Yasunori Goto 2006-06-27 972 { b9ff036082cd17 Oscar Salvador 2018-08-17 973 pg_data_t *pgdat = NODE_DATA(nid); b9ff036082cd17 Oscar Salvador 2018-08-17 974 9af3c2dea3a3ae Yasunori Goto 2006-06-27 975 arch_refresh_nodedata(nid, NULL); 5830169f47269f Reza Arbab 2016-08-11 976 free_percpu(pgdat->per_cpu_nodestats); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 977 arch_free_nodedata(pgdat); 9af3c2dea3a3ae Yasunori Goto 2006-06-27 978 return; 9af3c2dea3a3ae Yasunori Goto 2006-06-27 979 } 9af3c2dea3a3ae Yasunori Goto 2006-06-27 980 :::::: The code at line 926 was first introduced by commit :::::: c8e861a531b0199dc6ef9e402e29c474dfa507ce mm/memory_hotplug.c: use PFN_DOWN() :::::: TO: Fabian Frederick <fabf(a)skynet.be> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1424/1424] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type
by kernel test robot 17 Feb '25

17 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bd6fde5ff5b73d04068bdad2dc7730479d4df355 commit: eb761d6521c32c006a4987260394a61c6684fb35 [1424/1424] mm: parallelize deferred struct page initialization within each node config: x86_64-buildonly-randconfig-003-20250217 (https://download.01.org/0day-ci/archive/20250217/202502171430.Coc968oj-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250217/202502171430.Coc968oj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502171430.Coc968oj-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/page_alloc.c:21: include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/page_alloc.c:58: include/linux/mm_inline.h:32:43: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_node_page_state(pgdat, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/page_alloc.c:1412:6: warning: no previous prototype for function 'set_zone_contiguous' [-Wmissing-prototypes] 1412 | void set_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1412:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1412 | void set_zone_contiguous(struct zone *zone) | ^ | static mm/page_alloc.c:1433:6: warning: no previous prototype for function 'clear_zone_contiguous' [-Wmissing-prototypes] 1433 | void clear_zone_contiguous(struct zone *zone) | ^ mm/page_alloc.c:1433:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1433 | void clear_zone_contiguous(struct zone *zone) | ^ | static >> mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-strict] 1645 | DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1646 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1661:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-strict] 1661 | DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1662 | KTASK_PTE_MINCHUNK); | ~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:139:3: note: expanded from macro 'DEFINE_KTASK_CTL' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: note: expanded from macro 'KTASK_CTL_INITIALIZER' 123 | .kc_thread_func = (ktask_thread_func)(thread_func), \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:3050:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3050 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:126:34: note: expanded from macro '__count_zid_vm_events' 126 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3098:2: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3098 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:126:34: note: expanded from macro '__count_zid_vm_events' 126 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ 9 warnings generated. vim +1645 mm/page_alloc.c 1587 1588 /* Initialise remaining memory on a node */ 1589 static int __init deferred_init_memmap(void *data) 1590 { 1591 pg_data_t *pgdat = data; 1592 int nid = pgdat->node_id; 1593 unsigned long start = jiffies; 1594 unsigned long nr_init = 0, nr_free = 0; 1595 unsigned long spfn, epfn, first_init_pfn, flags; 1596 phys_addr_t spa, epa; 1597 int zid; 1598 struct zone *zone; 1599 const struct cpumask *cpumask = cpumask_of_node(pgdat->node_id); 1600 u64 i; 1601 unsigned long nr_node_cpus; 1602 struct ktask_node kn; 1603 1604 /* Bind memory initialisation thread to a local node if possible */ 1605 if (!cpumask_empty(cpumask)) 1606 set_cpus_allowed_ptr(current, cpumask); 1607 1608 pgdat_resize_lock(pgdat, &flags); 1609 first_init_pfn = pgdat->first_deferred_pfn; 1610 if (first_init_pfn == ULONG_MAX) { 1611 pgdat_resize_unlock(pgdat, &flags); 1612 pgdat_init_report_one_done(); 1613 return 0; 1614 } 1615 1616 /* 1617 * We'd like to know the memory bandwidth of the chip to calculate the 1618 * most efficient number of threads to start, but we can't. In 1619 * testing, a good value for a variety of systems was a quarter of the 1620 * CPUs on the node. 1621 */ 1622 nr_node_cpus = DIV_ROUND_UP(cpumask_weight(cpumask), 4); 1623 1624 /* Sanity check boundaries */ 1625 BUG_ON(pgdat->first_deferred_pfn < pgdat->node_start_pfn); 1626 BUG_ON(pgdat->first_deferred_pfn > pgdat_end_pfn(pgdat)); 1627 pgdat->first_deferred_pfn = ULONG_MAX; 1628 1629 /* Only the highest zone is deferred so find it */ 1630 for (zid = 0; zid < MAX_NR_ZONES; zid++) { 1631 zone = pgdat->node_zones + zid; 1632 if (first_init_pfn < zone_end_pfn(zone)) 1633 break; 1634 } 1635 first_init_pfn = max(zone->zone_start_pfn, first_init_pfn); 1636 1637 /* 1638 * Initialize and free pages. We do it in two loops: first we initialize 1639 * struct page, than free to buddy allocator, because while we are 1640 * freeing pages we can access pages that are ahead (computing buddy 1641 * page in __free_one_page()). 1642 */ 1643 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1644 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; > 1645 DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, 1646 KTASK_PTE_MINCHUNK); 1647 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1648 1649 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1650 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1651 1652 kn.kn_start = (void *)spfn; 1653 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1654 kn.kn_nid = nid; 1655 (void) ktask_run_numa(&kn, 1, &ctl); 1656 1657 nr_init += atomic64_read(&args.nr_pages); 1658 } 1659 for_each_free_mem_range(i, nid, MEMBLOCK_NONE, &spa, &epa, NULL) { 1660 struct deferred_args args = { nid, zid, ATOMIC64_INIT(0) }; 1661 DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, 1662 KTASK_PTE_MINCHUNK); 1663 ktask_ctl_set_max_threads(&ctl, nr_node_cpus); 1664 1665 spfn = max_t(unsigned long, first_init_pfn, PFN_UP(spa)); 1666 epfn = min_t(unsigned long, zone_end_pfn(zone), PFN_DOWN(epa)); 1667 1668 kn.kn_start = (void *)spfn; 1669 kn.kn_task_size = (spfn < epfn) ? epfn - spfn : 0; 1670 kn.kn_nid = nid; 1671 (void) ktask_run_numa(&kn, 1, &ctl); 1672 1673 nr_free += atomic64_read(&args.nr_pages); 1674 } 1675 pgdat_resize_unlock(pgdat, &flags); 1676 1677 /* Sanity check that the next zone really is unpopulated */ 1678 WARN_ON(++zid < MAX_NR_ZONES && populated_zone(++zone)); 1679 VM_BUG_ON(nr_init != nr_free); 1680 1681 zone->managed_pages += nr_free; 1682 1683 pr_info("node %d initialised, %lu pages in %ums\n", nid, nr_free, 1684 jiffies_to_msecs(jiffies - start)); 1685 1686 pgdat_init_report_one_done(); 1687 return 0; 1688 } 1689 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH v2 OLK-5.10 0/3] fix CVE-2024-53056 for olk-5.10
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-53056 for olk-5.10. changelog since v1: - drop commit("mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling") which is not releated to this cve and will lead to kabi changes. Lorenzo Stoakes (3): mm: avoid unsafe VMA hook invocation when error arises on mmap hook mm: unconditionally close VMAs on error mm: resolve faulty mmap_region() error path behaviour mm/internal.h | 19 ++++++++++ mm/mmap.c | 97 ++++++++++++++++++++++++++++++--------------------- mm/nommu.c | 7 ++-- mm/util.c | 33 ++++++++++++++++++ 4 files changed, 113 insertions(+), 43 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/2] mm, madvise: fix potential workingset node list_lru leaks
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Ma Wupeng <mawupeng1(a)huawei.com> fix potential workingset node list_lru leaks. Christoph Hellwig (1): [Backport] mm: move mapping_set_update out of <linux/swap.h> Kairui Song (1): [Backport] mm, madvise: fix potential workingset node list_lru leaks include/linux/swap.h | 10 ---------- mm/internal.h | 10 ++++++++++ mm/khugepaged.c | 3 +++ mm/workingset.c | 1 + 4 files changed, 14 insertions(+), 10 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] KVM: arm64: Get rid of userspace_irqchip_in_use
by Zhao Yipeng 17 Feb '25

17 Feb '25

From: Raghavendra Rao Ananta <rananta(a)google.com> stable inclusion from stable-v6.6.64 commit dd2f9861f27571d47998d71e7516bf7216db0b52 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEADT CVE: CVE-2024-53195 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- KVM: arm64: Get rid of userspace_irqchip_in_use commit 38d7aacca09230fdb98a34194fec2af597e8e20d upstream. Improper use of userspace_irqchip_in_use led to syzbot hitting the following WARN_ON() in kvm_timer_update_irq(): WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/arch_timer.c:459 kvm_timer_update_irq+0x21c/0x394 Call trace: kvm_timer_update_irq+0x21c/0x394 arch/arm64/kvm/arch_timer.c:459 kvm_timer_vcpu_reset+0x158/0x684 arch/arm64/kvm/arch_timer.c:968 kvm_reset_vcpu+0x3b4/0x560 arch/arm64/kvm/reset.c:264 kvm_vcpu_set_target arch/arm64/kvm/arm.c:1553 [inline] kvm_arch_vcpu_ioctl_vcpu_init arch/arm64/kvm/arm.c:1573 [inline] kvm_arch_vcpu_ioctl+0x112c/0x1b3c arch/arm64/kvm/arm.c:1695 kvm_vcpu_ioctl+0x4ec/0xf74 virt/kvm/kvm_main.c:4658 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The following sequence led to the scenario: - Userspace creates a VM and a vCPU. - The vCPU is initialized with KVM_ARM_VCPU_PMU_V3 during KVM_ARM_VCPU_INIT. - Without any other setup, such as vGIC or vPMU, userspace issues KVM_RUN on the vCPU. Since the vPMU is requested, but not setup, kvm_arm_pmu_v3_enable() fails in kvm_arch_vcpu_run_pid_change(). As a result, KVM_RUN returns after enabling the timer, but before incrementing 'userspace_irqchip_in_use': kvm_arch_vcpu_run_pid_change() ret = kvm_arm_pmu_v3_enable() if (!vcpu->arch.pmu.created) return -EINVAL; if (ret) return ret; [...] if (!irqchip_in_kernel(kvm)) static_branch_inc(&userspace_irqchip_in_use); - Userspace ignores the error and issues KVM_ARM_VCPU_INIT again. Since the timer is already enabled, control moves through the following flow, ultimately hitting the WARN_ON(): kvm_timer_vcpu_reset() if (timer->enabled) kvm_timer_update_irq() if (!userspace_irqchip()) ret = kvm_vgic_inject_irq() ret = vgic_lazy_init() if (unlikely(!vgic_initialized(kvm))) if (kvm->arch.vgic.vgic_model != KVM_DEV_TYPE_ARM_VGIC_V2) return -EBUSY; WARN_ON(ret); Theoretically, since userspace_irqchip_in_use's functionality can be simply replaced by '!irqchip_in_kernel()', get rid of the static key to avoid the mismanagement, which also helps with the syzbot issue. Cc: <stable(a)vger.kernel.org> Reported-by: syzbot <syzkaller(a)googlegroups.com> Suggested-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Raghavendra Rao Ananta <rananta(a)google.com> Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/kvm/arm.c [The conflicts in the arm.c file are contextual conflicts.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- arch/arm64/include/asm/kvm_host.h | 2 -- arch/arm64/kvm/arch_timer.c | 3 +-- arch/arm64/kvm/arm.c | 21 +++------------------ 3 files changed, 4 insertions(+), 22 deletions(-) diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h index 4db5ee87988a..ac4e59256f8e 100644 --- a/arch/arm64/include/asm/kvm_host.h +++ b/arch/arm64/include/asm/kvm_host.h @@ -77,8 +77,6 @@ enum kvm_mode kvm_get_mode(void); static inline enum kvm_mode kvm_get_mode(void) { return KVM_MODE_NONE; }; #endif -DECLARE_STATIC_KEY_FALSE(userspace_irqchip_in_use); - extern unsigned int __ro_after_init kvm_sve_max_vl; int __init kvm_arm_init_sve(void); diff --git a/arch/arm64/kvm/arch_timer.c b/arch/arm64/kvm/arch_timer.c index 3f1129d3df6a..34d5ff836188 100644 --- a/arch/arm64/kvm/arch_timer.c +++ b/arch/arm64/kvm/arch_timer.c @@ -291,8 +291,7 @@ void get_timer_map(struct kvm_vcpu *vcpu, struct timer_map *map) static inline bool userspace_irqchip(struct kvm *kvm) { - return static_branch_unlikely(&userspace_irqchip_in_use) && - unlikely(!irqchip_in_kernel(kvm)); + return unlikely(!irqchip_in_kernel(kvm)); } static void soft_timer_start(struct hrtimer *hrt, u64 ns) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index f4194603eae5..c0126a9203ae 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -68,7 +68,6 @@ bool kvm_ncsnp_support; bool kvm_dvmbm_support; static DEFINE_PER_CPU(unsigned char, kvm_hyp_initialized); -DEFINE_STATIC_KEY_FALSE(userspace_irqchip_in_use); bool is_kvm_arm_initialised(void) { @@ -521,9 +520,6 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu) void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) { - if (vcpu_has_run_once(vcpu) && unlikely(!irqchip_in_kernel(vcpu->kvm))) - static_branch_dec(&userspace_irqchip_in_use); - kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache); kvm_timer_vcpu_terminate(vcpu); kvm_pmu_vcpu_destroy(vcpu); @@ -805,17 +801,6 @@ int kvm_arch_vcpu_run_pid_change(struct kvm_vcpu *vcpu) return ret; } - if (!irqchip_in_kernel(kvm)) { - /* - * Tell the rest of the code that there are userspace irqchip - * VMs in the wild. - */ -#ifdef CONFIG_HISI_VIRTCCA_HOST - if (!kvm_is_virtcca_cvm(kvm)) -#endif - static_branch_inc(&userspace_irqchip_in_use); - } - /* * Initialize traps for protected VMs. * NOTE: Move to run in EL2 directly, rather than via a hypercall, once @@ -1055,7 +1040,7 @@ static bool kvm_vcpu_exit_request(struct kvm_vcpu *vcpu, int *ret) * state gets updated in kvm_timer_update_run and * kvm_pmu_update_run below). */ - if (static_branch_unlikely(&userspace_irqchip_in_use)) { + if (unlikely(!irqchip_in_kernel(vcpu->kvm))) { if (kvm_timer_should_notify_user(vcpu) || kvm_pmu_should_notify_user(vcpu)) { *ret = -EINTR; @@ -1193,7 +1178,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) vcpu->mode = OUTSIDE_GUEST_MODE; isb(); /* Ensure work in x_flush_hwstate is committed */ kvm_pmu_sync_hwstate(vcpu); - if (static_branch_unlikely(&userspace_irqchip_in_use)) + if (unlikely(!irqchip_in_kernel(vcpu->kvm))) kvm_timer_sync_user(vcpu); kvm_vgic_sync_hwstate(vcpu); local_irq_enable(); @@ -1246,7 +1231,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu) * we don't want vtimer interrupts to race with syncing the * timer virtual interrupt state. */ - if (static_branch_unlikely(&userspace_irqchip_in_use)) + if (unlikely(!irqchip_in_kernel(vcpu->kvm))) kvm_timer_sync_user(vcpu); kvm_arch_vcpu_ctxsync_fp(vcpu); -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] fix CVE-2024-53056 for olk-5.10
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-53056 for olk-5.10. Lorenzo Stoakes (4): mm: avoid unsafe VMA hook invocation when error arises on mmap hook mm: unconditionally close VMAs on error mm: refactor arch_calc_vm_flag_bits() and arm64 MTE handling mm: resolve faulty mmap_region() error path behaviour arch/arm64/include/asm/mman.h | 10 +++- include/linux/mman.h | 7 ++- mm/internal.h | 19 +++++++ mm/mmap.c | 101 ++++++++++++++++++++-------------- mm/nommu.c | 9 ++- mm/shmem.c | 3 - mm/util.c | 33 +++++++++++ 7 files changed, 127 insertions(+), 55 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] mm: resolve faulty mmap_region() error path behaviour
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> stable inclusion from stable-v6.6.63 commit bdc136e2b05fabcd780fe5f165d154eb779dfcb0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB7051 CVE: CVE-2024-53096 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5de195060b2e251a835f622759550e6202167641 ] The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur. A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state. Taking advantage of previous patches in this series we move a number of checks earlier in the code, simplifying things by moving the core of the logic into a static internal function __mmap_region(). Doing this allows us to perform a number of checks up front before we do any real work, and allows us to unwind the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE validation unconditionally also. We move a number of things here: 1. We preallocate memory for the iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform complicated and error-prone close/free logic. We carefully free iterator state on both success and error paths. 2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a matching mapping_unmap_writable() on success and error paths. We now do this unconditionally if this is a file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however doing so does not invalidate the seal check we just performed, and we in any case always decrement the counter in the wrapper. We perform a debug assert to ensure a driver does not attempt to do the opposite. 3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64 and sparc64, and the check is only meaningful for SPARC with ADI enabled. We explicitly add a warning for this arch if a driver invalidates this check, though the code ought eventually to be fixed to eliminate the need for this. With all of these measures in place, we no longer need to explicitly close the VMA on error paths, as we place all checks which might fail prior to a call to any driver mmap hook. This eliminates an entire class of errors, makes the code easier to reason about and more robust. Link: https://lkml.kernel.org/r/6e0becb36d2f5472053ac5d544c0edfe9b899e25.17302246… Fixes: deb0f6562884 ("mm/mmap: undo ->mmap() when arch_validate_flags() fails") Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Reported-by: Jann Horn <jannh(a)google.com> Reviewed-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Reviewed-by: Vlastimil Babka <vbabka(a)suse.cz> Tested-by: Mark Brown <broonie(a)kernel.org> Cc: Andreas Larsson <andreas(a)gaisler.com> Cc: Catalin Marinas <catalin.marinas(a)arm.com> Cc: David S. Miller <davem(a)davemloft.net> Cc: Helge Deller <deller(a)gmx.de> Cc: James E.J. Bottomley <James.Bottomley(a)HansenPartnership.com> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: Peter Xu <peterx(a)redhat.com> Cc: Will Deacon <will(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/mmap.c [Ma Wupeng: conflict with ascend's modify on mmap] Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- mm/mmap.c | 128 +++++++++++++++++++++++++++++++----------------------- 1 file changed, 73 insertions(+), 55 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 266025c0f6183..4a36526d8caf8 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1254,7 +1254,7 @@ static inline bool file_mmap_ok(struct file *file, struct inode *inode, return true; } -static unsigned long __mmap_region(struct mm_struct *mm, +static unsigned long __mmap_region_ext(struct mm_struct *mm, struct file *file, unsigned long addr, unsigned long len, vm_flags_t vm_flags, unsigned long pgoff, struct list_head *uf); @@ -1431,7 +1431,7 @@ unsigned long __do_mmap_mm(struct mm_struct *mm, struct file *file, unsigned lon vm_flags |= VM_NORESERVE; } - addr = __mmap_region(mm, file, addr, len, vm_flags, pgoff, uf); + addr = __mmap_region_ext(mm, file, addr, len, vm_flags, pgoff, uf); if (!IS_ERR_VALUE(addr) && ((vm_flags & VM_LOCKED) || (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE)) @@ -2739,14 +2739,14 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, return do_vmi_munmap(&vmi, mm, start, len, uf, false); } -static unsigned long __mmap_region(struct mm_struct *mm, - struct file *file, unsigned long addr, - unsigned long len, vm_flags_t vm_flags, - unsigned long pgoff, struct list_head *uf) +static unsigned long __mmap_region(struct mm_struct *mm, struct file *file, + unsigned long addr, unsigned long len, + vm_flags_t vm_flags, unsigned long pgoff, + struct list_head *uf) { struct vm_area_struct *vma = NULL; struct vm_area_struct *next, *prev, *merge; - pgoff_t pglen = len >> PAGE_SHIFT; + pgoff_t pglen = PHYS_PFN(len); unsigned long charged = 0; unsigned long end = addr + len; unsigned long merge_start = addr, merge_end = end; @@ -2843,25 +2843,26 @@ static unsigned long __mmap_region(struct mm_struct *mm, vma->vm_page_prot = vm_get_page_prot(vm_flags); vma->vm_pgoff = pgoff; - if (file) { - if (vm_flags & VM_SHARED) { - error = mapping_map_writable(file->f_mapping); - if (error) - goto free_vma; - } + if (vma_iter_prealloc(&vmi, vma)) { + error = -ENOMEM; + goto free_vma; + } + if (file) { vma->vm_file = get_file(file); error = call_mmap(file, vma); if (error) - goto unmap_and_free_vma; + goto unmap_and_free_file_vma; + /* Drivers cannot alter the address of the VMA. */ + WARN_ON_ONCE(addr != vma->vm_start); /* - * Expansion is handled above, merging is handled below. - * Drivers should not alter the address of the VMA. + * Drivers should not permit writability when previously it was + * disallowed. */ - error = -EINVAL; - if (WARN_ON((addr != vma->vm_start))) - goto close_and_free_vma; + VM_WARN_ON_ONCE(vm_flags != vma->vm_flags && + !(vm_flags & VM_MAYWRITE) && + (vma->vm_flags & VM_MAYWRITE)); vma_iter_config(&vmi, addr, end); /* @@ -2873,6 +2874,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, vma->vm_end, vma->vm_flags, NULL, vma->vm_file, vma->vm_pgoff, NULL, NULL_VM_UFFD_CTX, NULL); + if (merge) { /* * ->mmap() can change vma->vm_file and fput @@ -2886,7 +2888,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, vma = merge; /* Update vm_flags to pick up the change. */ vm_flags = vma->vm_flags; - goto unmap_writable; + goto file_expanded; } } @@ -2894,24 +2896,15 @@ static unsigned long __mmap_region(struct mm_struct *mm, } else if (vm_flags & VM_SHARED) { error = shmem_zero_setup(vma); if (error) - goto free_vma; + goto free_iter_vma; } else { vma_set_anonymous(vma); } - if (map_deny_write_exec(vma->vm_flags, vma->vm_flags)) { - error = -EACCES; - goto close_and_free_vma; - } - - /* Allow architectures to sanity-check the vm_flags */ - error = -EINVAL; - if (!arch_validate_flags(vma->vm_flags)) - goto close_and_free_vma; - - error = -ENOMEM; - if (vma_iter_prealloc(&vmi, vma)) - goto close_and_free_vma; +#ifdef CONFIG_SPARC64 + /* TODO: Fix SPARC ADI! */ + WARN_ON_ONCE(!arch_validate_flags(vm_flags)); +#endif /* Lock the VMA since it is modified after insertion into VMA tree */ vma_start_write(vma); @@ -2925,10 +2918,7 @@ static unsigned long __mmap_region(struct mm_struct *mm, */ khugepaged_enter_vma(vma, vma->vm_flags); - /* Once vma denies write, undo our temporary denial count */ -unmap_writable: - if (file && vm_flags & VM_SHARED) - mapping_unmap_writable(file->f_mapping); +file_expanded: file = vma->vm_file; ksm_add_vma(vma); expanded: @@ -2958,38 +2948,66 @@ static unsigned long __mmap_region(struct mm_struct *mm, vma_set_page_prot(vma); - validate_mm(mm); return addr; -close_and_free_vma: - vma_close(vma); - - if (file || vma->vm_file) { -unmap_and_free_vma: - fput(vma->vm_file); - vma->vm_file = NULL; +unmap_and_free_file_vma: + fput(vma->vm_file); + vma->vm_file = NULL; - vma_iter_set(&vmi, vma->vm_end); - /* Undo any partial mapping done by a device driver. */ - unmap_region(mm, &vmi.mas, vma, prev, next, vma->vm_start, - vma->vm_end, vma->vm_end, true); - } - if (file && (vm_flags & VM_SHARED)) - mapping_unmap_writable(file->f_mapping); + vma_iter_set(&vmi, vma->vm_end); + /* Undo any partial mapping done by a device driver. */ + unmap_region(mm, &vmi.mas, vma, prev, next, vma->vm_start, + vma->vm_end, vma->vm_end, true); +free_iter_vma: + vma_iter_free(&vmi); free_vma: vm_area_free(vma); unacct_error: if (charged) vm_unacct_memory(charged); - validate_mm(mm); return error; } +static unsigned long __mmap_region_ext(struct mm_struct *mm, struct file *file, + unsigned long addr, unsigned long len, + vm_flags_t vm_flags, unsigned long pgoff, + struct list_head *uf) +{ + unsigned long ret; + bool writable_file_mapping = false; + + /* Check to see if MDWE is applicable. */ + if (map_deny_write_exec(vm_flags, vm_flags)) + return -EACCES; + + /* Allow architectures to sanity-check the vm_flags. */ + if (!arch_validate_flags(vm_flags)) + return -EINVAL; + + /* Map writable and ensure this isn't a sealed memfd. */ + if (file && (vm_flags & VM_SHARED)) { + int error = mapping_map_writable(file->f_mapping); + + if (error) + return error; + writable_file_mapping = true; + } + + ret = __mmap_region(mm, file, addr, len, vm_flags, pgoff, uf); + + /* Clear our write mapping regardless of error. */ + if (writable_file_mapping) + mapping_unmap_writable(file->f_mapping); + + validate_mm(current->mm); + return ret; +} + unsigned long mmap_region(struct file *file, unsigned long addr, unsigned long len, vm_flags_t vm_flags, unsigned long pgoff, struct list_head *uf) { - return __mmap_region(current->mm, file, addr, len, vm_flags, pgoff, uf); + return __mmap_region_ext(current->mm, file, addr, len, vm_flags, pgoff, uf); } static int __vm_munmap(unsigned long start, size_t len, bool unlock) -- 2.43.0

2 1

[PATCH OLK-6.6] iio: adc: at91: call input_free_device() on allocated iio_dev
by Wupeng Ma 17 Feb '25

17 Feb '25

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v6.6.72 commit 09e067e3c83e0695d338e8a26916e3c2bc44be02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQWA CVE: CVE-2024-57904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit de6a73bad1743e9e81ea5a24c178c67429ff510b upstream. Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached before the allocated iio_dev is stored to st->ts_input. Thus call input_free_device() on input instead of st->ts_input. Fixes: 84882b060301 ("iio: adc: at91_adc: Add support for touchscreens without TSMR") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Link: https://patch.msgid.link/20241207043045.1255409-1-joe@pf.is.s.u-tokyo.ac.jp Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/iio/adc/at91_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c index de6650f9c4b1c..55f0c1afe505e 100644 --- a/drivers/iio/adc/at91_adc.c +++ b/drivers/iio/adc/at91_adc.c @@ -984,7 +984,7 @@ static int at91_ts_register(struct iio_dev *idev, return ret; err: - input_free_device(st->ts_input); + input_free_device(input); return ret; } -- 2.43.0

2 1

[openeuler:OLK-5.10] BUILD REGRESSION e804018e3930644594e31fd711068f5d48ae05af
by kernel test robot 16 Feb '25

16 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: e804018e3930644594e31fd711068f5d48ae05af !15081 usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502161355.thfOP2mL-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202502161959.kat8z9E7-lkp@intel.com fs/afs/vl_alias.o: warning: objtool: afs_compare_volume_slists()+0x21c: unreachable instruction mm/page_alloc.c:3036:6: warning: no previous prototype for '__drain_all_pages' [-Wmissing-prototypes] mm/page_alloc.c:3036:6: warning: no previous prototype for function '__drain_all_pages' [-Wmissing-prototypes] mm/page_alloc.c:6634:6: warning: no previous prototype for '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] mm/page_alloc.c:6634:6: warning: no previous prototype for function '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-DRM_PANEL_BRIDGE-when-selected-by-DRM_TOSHIBA_TC358762 | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PCI_IOV-when-selected-by-CRYPTO_DEV_HISI_MIGRATION | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SERIAL_EARLYCON-when-selected-by-SERIAL_IMX_EARLYCON | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SND_SOC_DMIC-when-selected-by-SND_SOC_INTEL_DA7219_MAX98357A_GENERIC | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SND_SOC_DMIC-when-selected-by-SND_SOC_STM32_DFSDM | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-defconfig | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-001-20250216 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-003-20250216 | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-004-20250216 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- include-linux-blk_types.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-cred.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device-class.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-ioport.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-mm.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-swap.h:linux-kabi.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-BPF_NET_GLOBAL_PROG-when-selected-by-SCHED_TASK_RELATIONSHIP | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-DRM_PANEL_BRIDGE-when-selected-by-DRM_TOSHIBA_TC358762 | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SERIAL_EARLYCON-when-selected-by-SERIAL_IMX_EARLYCON | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SND_SOC_DMIC-when-selected-by-SND_SOC_AMD_RENOIR_MACH | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SND_SOC_DMIC-when-selected-by-SND_SOC_INTEL_DA7219_MAX98357A_GENERIC | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-SND_SOC_DMIC-when-selected-by-SND_SOC_STM32_DFSDM | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-TASK_PLACEMENT_BY_CPU_RANGE-when-selected-by-BPF_SCHED | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_data-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_datalen-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-data-not-described-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-datalen-not-described-in-pgp_parse_packets | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-damon-core-test.h:warning:comparison-of-distinct-pointer-types-(-typeof-(__left)-(aka-unsigned-int-)-and-typeof-(__right)-(aka-int-)) | |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | `-- mm-mem_reliable.c:warning:arithmetic-between-different-enumeration-types-(-enum-node_stat_item-and-enum-lru_list-) |-- x86_64-buildonly-randconfig-001-20250216 | |-- fs-afs-vl_alias.o:warning:objtool:afs_compare_volume_slists:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250216 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-003-20250216 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-004-20250216 | |-- drivers-platform-x86-toshiba_acpi.c:warning:fan_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:keys_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:lcd_proc_ops-defined-but-not-used | |-- drivers-platform-x86-toshiba_acpi.c:warning:video_proc_ops-defined-but-not-used | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-005-20250216 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-006-20250216 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-defconfig | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-randconfig-101-20250216 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-randconfig-102-20250216 | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-103-20250216 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-randconfig-104-20250216 | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page `-- x86_64-randconfig-161-20250216 |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- mm-hugetlb.c:warning:variable-gfp-set-but-not-used |-- mm-khugepaged.c:warning:Function-parameter-or-member-reliable-not-described-in-collapse_file |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch elapsed time: 726m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250216 gcc-14.2.0 arm64 randconfig-002-20250216 clang-21 arm64 randconfig-003-20250216 gcc-14.2.0 arm64 randconfig-004-20250216 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250216 clang-19 x86_64 buildonly-randconfig-002-20250216 gcc-12 x86_64 buildonly-randconfig-003-20250216 gcc-12 x86_64 buildonly-randconfig-004-20250216 gcc-12 x86_64 buildonly-randconfig-005-20250216 gcc-12 x86_64 buildonly-randconfig-006-20250216 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2740/2740] fs/afs/vl_alias.o: warning: objtool: afs_compare_volume_slists()+0x21c: unreachable instruction
by kernel test robot 16 Feb '25

16 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e804018e3930644594e31fd711068f5d48ae05af commit: a8cd7bb0c2528d3afe29db0be10841671df41b5d [2740/2740] afs: Fix afs_server_list to be cleaned up with RCU config: x86_64-buildonly-randconfig-001-20250216 (https://download.01.org/0day-ci/archive/20250216/202502161959.kat8z9E7-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502161959.kat8z9E7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502161959.kat8z9E7-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/afs/vl_alias.o: warning: objtool: afs_compare_volume_slists()+0x21c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2740/2740] mm/page_alloc.c:3036:6: warning: no previous prototype for '__drain_all_pages'
by kernel test robot 16 Feb '25

16 Feb '25

Hi Vlastimil, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e804018e3930644594e31fd711068f5d48ae05af commit: e037ee4a8deaff7c579618c0aba1f066d6d14b11 [2740/2740] mm, page_alloc: disable pcplists during memory offline config: x86_64-buildonly-randconfig-002-20250216 (https://download.01.org/0day-ci/archive/20250216/202502161355.thfOP2mL-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502161355.thfOP2mL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502161355.thfOP2mL-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/page_alloc.c:3036:6: warning: no previous prototype for '__drain_all_pages' [-Wmissing-prototypes] 3036 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^~~~~~~~~~~~~~~~~ mm/page_alloc.c:3586:15: warning: no previous prototype for 'should_fail_alloc_page' [-Wmissing-prototypes] 3586 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:6497:20: warning: no previous prototype for 'memmap_init' [-Wmissing-prototypes] 6497 | void __init __weak memmap_init(void) | ^~~~~~~~~~~ mm/page_alloc.c:6535:23: warning: no previous prototype for 'arch_memmap_init' [-Wmissing-prototypes] 6535 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^~~~~~~~~~~~~~~~ >> mm/page_alloc.c:6634:6: warning: no previous prototype for '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] 6634 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7915:9: note: in expansion of macro 'adj_init_size' 7915 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7915:9: note: in expansion of macro 'adj_init_size' 7915 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7915:9: note: in expansion of macro 'adj_init_size' 7915 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7915:9: note: in expansion of macro 'adj_init_size' 7915 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7917:9: note: in expansion of macro 'adj_init_size' 7917 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7917:9: note: in expansion of macro 'adj_init_size' 7917 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7917:9: note: in expansion of macro 'adj_init_size' 7917 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7917:9: note: in expansion of macro 'adj_init_size' 7917 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7918:9: note: in expansion of macro 'adj_init_size' 7918 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7918:9: note: in expansion of macro 'adj_init_size' 7918 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7918:9: note: in expansion of macro 'adj_init_size' 7918 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7918:9: note: in expansion of macro 'adj_init_size' 7918 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7919:9: note: in expansion of macro 'adj_init_size' 7919 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: note: use '&_stext[0] <= &__start_rodata[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7919:9: note: in expansion of macro 'adj_init_size' 7919 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7919:9: note: in expansion of macro 'adj_init_size' 7919 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: note: use '&__start_rodata[0] < &_etext[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7919:9: note: in expansion of macro 'adj_init_size' 7919 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] vim +/__drain_all_pages +3036 mm/page_alloc.c 3025 3026 /* 3027 * The implementation of drain_all_pages(), exposing an extra parameter to 3028 * drain on all cpus. 3029 * 3030 * drain_all_pages() is optimized to only execute on cpus where pcplists are 3031 * not empty. The check for non-emptiness can however race with a free to 3032 * pcplist that has not yet increased the pcp->count from 0 to 1. Callers 3033 * that need the guarantee that every CPU has drained can disable the 3034 * optimizing racy check. 3035 */ > 3036 void __drain_all_pages(struct zone *zone, bool force_all_cpus) 3037 { 3038 int cpu; 3039 3040 /* 3041 * Allocate in the BSS so we wont require allocation in 3042 * direct reclaim path for CONFIG_CPUMASK_OFFSTACK=y 3043 */ 3044 static cpumask_t cpus_with_pcps; 3045 3046 /* 3047 * Make sure nobody triggers this path before mm_percpu_wq is fully 3048 * initialized. 3049 */ 3050 if (WARN_ON_ONCE(!mm_percpu_wq)) 3051 return; 3052 3053 /* 3054 * Do not drain if one is already in progress unless it's specific to 3055 * a zone. Such callers are primarily CMA and memory hotplug and need 3056 * the drain to be complete when the call returns. 3057 */ 3058 if (unlikely(!mutex_trylock(&pcpu_drain_mutex))) { 3059 if (!zone) 3060 return; 3061 mutex_lock(&pcpu_drain_mutex); 3062 } 3063 3064 /* 3065 * We don't care about racing with CPU hotplug event 3066 * as offline notification will cause the notified 3067 * cpu to drain that CPU pcps and on_each_cpu_mask 3068 * disables preemption as part of its processing 3069 */ 3070 for_each_online_cpu(cpu) { 3071 struct per_cpu_pageset *pcp; 3072 struct zone *z; 3073 bool has_pcps = false; 3074 3075 if (force_all_cpus) { 3076 /* 3077 * The pcp.count check is racy, some callers need a 3078 * guarantee that no cpu is missed. 3079 */ 3080 has_pcps = true; 3081 } else if (zone) { 3082 pcp = per_cpu_ptr(zone->pageset, cpu); 3083 if (pcp->pcp.count) 3084 has_pcps = true; 3085 } else { 3086 for_each_populated_zone(z) { 3087 pcp = per_cpu_ptr(z->pageset, cpu); 3088 if (pcp->pcp.count) { 3089 has_pcps = true; 3090 break; 3091 } 3092 } 3093 } 3094 3095 if (has_pcps) 3096 cpumask_set_cpu(cpu, &cpus_with_pcps); 3097 else 3098 cpumask_clear_cpu(cpu, &cpus_with_pcps); 3099 } 3100 3101 for_each_cpu(cpu, &cpus_with_pcps) { 3102 struct pcpu_drain *drain = per_cpu_ptr(&pcpu_drain, cpu); 3103 3104 drain->zone = zone; 3105 INIT_WORK(&drain->work, drain_local_pages_wq); 3106 queue_work_on(cpu, mm_percpu_wq, &drain->work); 3107 } 3108 for_each_cpu(cpu, &cpus_with_pcps) 3109 flush_work(&per_cpu_ptr(&pcpu_drain, cpu)->work); 3110 3111 mutex_unlock(&pcpu_drain_mutex); 3112 } 3113 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1928/1928] kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup'
by kernel test robot 16 Feb '25

16 Feb '25

Hi Xiongfeng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 01e57e5fa297f937102f9b58ee7905f638b8450f commit: 5f20541757730418065c3ae77dfdbcde3f523394 [1928/1928] blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU config: loongarch-randconfig-r064-20250216 (https://download.01.org/0day-ci/archive/20250216/202502160734.p26JLJ7W-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502160734.p26JLJ7W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502160734.p26JLJ7W-lkp@intel.com/ All errors (new ones prefixed by >>): | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:54:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 54 | EXPORT_SYMBOL_GPL(housekeeping_any_cpu); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:39:5: note: previous definition of 'housekeeping_any_cpu' with type 'int(enum hk_type)' 39 | int housekeeping_any_cpu(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:63:19: error: non-static declaration of 'housekeeping_cpumask' follows static declaration 63 | EXPORT_SYMBOL_GPL(housekeeping_cpumask); | ^~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:63:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 63 | EXPORT_SYMBOL_GPL(housekeeping_cpumask); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:56:23: note: previous definition of 'housekeeping_cpumask' with type 'const struct cpumask *(enum hk_type)' 56 | const struct cpumask *housekeeping_cpumask(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:71:19: error: non-static declaration of 'housekeeping_affine' follows static declaration 71 | EXPORT_SYMBOL_GPL(housekeeping_affine); | ^~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:71:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 71 | EXPORT_SYMBOL_GPL(housekeeping_affine); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:65:6: note: previous definition of 'housekeeping_affine' with type 'void(struct task_struct *, enum hk_type)' 65 | void housekeeping_affine(struct task_struct *t, enum hk_type type) | ^~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:80:19: error: non-static declaration of 'housekeeping_test_cpu' follows static declaration 80 | EXPORT_SYMBOL_GPL(housekeeping_test_cpu); | ^~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:80:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 80 | EXPORT_SYMBOL_GPL(housekeeping_test_cpu); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:73:6: note: previous definition of 'housekeeping_test_cpu' with type 'bool(int, enum hk_type)' {aka '_Bool(int, enum hk_type)'} 73 | bool housekeeping_test_cpu(int cpu, enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:100:20: error: invalid storage class for function 'housekeeping_setup_type' 100 | static void __init housekeeping_setup_type(enum hk_type type, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:109:19: error: invalid storage class for function 'housekeeping_setup' 109 | static int __init housekeeping_setup(char *str, unsigned long flags) | ^~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:180:19: error: invalid storage class for function 'housekeeping_nohz_full_setup' 180 | static int __init housekeeping_nohz_full_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:189:23: error: initializer element is not constant 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:189:1: note: in expansion of macro '__setup' 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~ kernel/sched/isolation.c:189:23: note: (near initialization for '__setup_housekeeping_nohz_full_setup.setup_func') 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:189:1: note: in expansion of macro '__setup' 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~ kernel/sched/isolation.c:191:19: error: invalid storage class for function 'housekeeping_isolcpus_setup' 191 | static int __init housekeeping_isolcpus_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:241:22: error: initializer element is not constant 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup' 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~ kernel/sched/isolation.c:241:22: note: (near initialization for '__setup_housekeeping_isolcpus_setup.setup_func') 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup' 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~ >> kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup' 244 | static int __init enhanced_isolcpus_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:249:30: error: initializer element is not constant 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:249:1: note: in expansion of macro '__setup' 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~ kernel/sched/isolation.c:249:30: note: (near initialization for '__setup_enhanced_isolcpus_setup.setup_func') 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:249:1: note: in expansion of macro '__setup' 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~ In file included from kernel/sched/build_utility.c:109: kernel/sched/autogroup.c:7:28: error: section attribute cannot be specified for local variables 7 | unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:15:35: error: initializer element is not constant 15 | .data = &sysctl_sched_autogroup_enabled, | ^ kernel/sched/autogroup.c:15:35: note: (near initialization for 'sched_autogroup_sysctls[0].data') kernel/sched/autogroup.c:25:20: error: invalid storage class for function 'sched_autogroup_sysctl_init' 25 | static void __init sched_autogroup_sysctl_init(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:47:20: error: invalid storage class for function 'autogroup_destroy' 47 | static inline void autogroup_destroy(struct kref *kref) | ^~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:60:20: error: invalid storage class for function 'autogroup_kref_put' 60 | static inline void autogroup_kref_put(struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:65:33: error: invalid storage class for function 'autogroup_kref_get' 65 | static inline struct autogroup *autogroup_kref_get(struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:71:33: error: invalid storage class for function 'autogroup_task_get' 71 | static inline struct autogroup *autogroup_task_get(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:85:33: error: invalid storage class for function 'autogroup_create' 85 | static inline struct autogroup *autogroup_create(void) | ^~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:158:1: error: invalid storage class for function 'autogroup_move_group' 158 | autogroup_move_group(struct task_struct *p, struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:202:15: error: non-static declaration of 'sched_autogroup_create_attach' follows static declaration 202 | EXPORT_SYMBOL(sched_autogroup_create_attach); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL' 86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "") | ^~~~~~~~~~~~~~ kernel/sched/autogroup.c:202:1: note: in expansion of macro 'EXPORT_SYMBOL' 202 | EXPORT_SYMBOL(sched_autogroup_create_attach); | ^~~~~~~~~~~~~ kernel/sched/autogroup.c:193:6: note: previous definition of 'sched_autogroup_create_attach' with type 'void(struct task_struct *)' 193 | void sched_autogroup_create_attach(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:209:15: error: non-static declaration of 'sched_autogroup_detach' follows static declaration 209 | EXPORT_SYMBOL(sched_autogroup_detach); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL' 86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "") | ^~~~~~~~~~~~~~ kernel/sched/autogroup.c:209:1: note: in expansion of macro 'EXPORT_SYMBOL' 209 | EXPORT_SYMBOL(sched_autogroup_detach); | ^~~~~~~~~~~~~ kernel/sched/autogroup.c:205:6: note: previous definition of 'sched_autogroup_detach' with type 'void(struct task_struct *)' 205 | void sched_autogroup_detach(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:221:19: error: invalid storage class for function 'setup_autogroup' 221 | static int __init setup_autogroup(char *str) | ^~~~~~~~~~~~~~~ kernel/sched/autogroup.c:227:24: error: initializer element is not constant 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup' 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~ kernel/sched/autogroup.c:227:24: note: (near initialization for '__setup_setup_autogroup.setup_func') 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup' 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~ vim +/enhanced_isolcpus_setup +244 kernel/sched/isolation.c 242 243 bool enhanced_isolcpus; > 244 static int __init enhanced_isolcpus_setup(char *str) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 01e57e5fa297f937102f9b58ee7905f638b8450f
by kernel test robot 16 Feb '25

16 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 01e57e5fa297f937102f9b58ee7905f638b8450f !15083 mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allmodconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ARM64_ERRATUM_845719-when-selected-by-ARCH_MXC | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_KEY_PARSER-when-selected-by-PGP_PRELOAD | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-RESCTRL_FS-when-selected-by-ARM64_MPAM | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250215 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-r121-20250216 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allmodconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_KEY_PARSER-when-selected-by-PGP_PRELOAD | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-r062-20250216 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-r064-20250216 | |-- include-linux-compiler-gcc.h:warning:alias-attribute-ignored | |-- include-linux-syscalls.h:error:implicit-declaration-of-function-__do_sys_membarrier | |-- include-linux-syscalls.h:error:invalid-storage-class-for-function-__do_sys_membarrier | |-- include-linux-syscalls.h:error:static-declaration-of-__se_sys_membarrier-follows-non-static-declaration | |-- include-linux-syscalls.h:warning:__se_sys_membarrier-defined-but-not-used | |-- kernel-sched-autogroup.c:error:initializer-element-is-not-constant | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_create | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_destroy | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_kref_get | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_kref_put | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_move_group | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_task_get | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-sched_autogroup_sysctl_init | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-setup_autogroup | |-- kernel-sched-autogroup.c:error:non-static-declaration-of-sched_autogroup_create_attach-follows-static-declaration | |-- kernel-sched-autogroup.c:error:non-static-declaration-of-sched_autogroup_detach-follows-static-declaration | |-- kernel-sched-autogroup.c:error:section-attribute-cannot-be-specified-for-local-variables | |-- kernel-sched-autogroup.c:warning:autogroup_free-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:autogroup_init-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:autogroup_path-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:proc_sched_autogroup_set_nice-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:proc_sched_autogroup_show_task-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_exit-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_exit_task-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_fork-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:task_wants_autogroup-defined-but-not-used | |-- kernel-sched-isolation.c:error:extern-declaration-of-housekeeping_overridden-follows-declaration-with-no-linkage | |-- kernel-sched-isolation.c:error:initializer-element-is-not-constant | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_isolcpus_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_nohz_full_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_setup_type | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_affine-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_any_cpu-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_cpumask-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_enabled-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_test_cpu-follows-static-declaration | |-- kernel-sched-isolation.c:warning:housekeeping_init-defined-but-not-used | |-- kernel-sched-psi.c:error:initializer-element-is-not-constant | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-get_stat_names | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_cpu_open | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_cpu_show | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_cpu_write | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_fop_poll | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_fop_release | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_io_open | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_io_show | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_io_write | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_memory_open | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_memory_show | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_memory_write | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_proc_init | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_stat_open | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_write | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-system_psi_stat_show | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_KEY_PARSER-when-selected-by-PGP_PRELOAD | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250215 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-defconfig |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 921m configs tested: 21 configs skipped: 115 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250215 clang-21 arm64 randconfig-002-20250215 gcc-14.2.0 arm64 randconfig-003-20250215 clang-17 arm64 randconfig-004-20250215 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250215 gcc-14.2.0 loongarch randconfig-002-20250215 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250215 gcc-12 x86_64 buildonly-randconfig-002-20250215 clang-19 x86_64 buildonly-randconfig-003-20250215 gcc-12 x86_64 buildonly-randconfig-004-20250215 clang-19 x86_64 buildonly-randconfig-005-20250215 clang-19 x86_64 buildonly-randconfig-006-20250215 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1928/1928] kernel/sched/psi.c:1763:12: error: invalid storage class for function 'psi_io_show'
by kernel test robot 16 Feb '25

16 Feb '25

Hi Lu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 01e57e5fa297f937102f9b58ee7905f638b8450f commit: 654944510822988390470cbc5b6f914c19dd9b88 [1928/1928] sched/psi: add cpu fine grained stall tracking in pressure.stat config: loongarch-randconfig-r064-20250216 (https://download.01.org/0day-ci/archive/20250216/202502160550.E90uGy3T-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502160550.E90uGy3T-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502160550.E90uGy3T-lkp@intel.com/ All error/warnings (new ones prefixed by >>): kernel/sched/psi.c:447:13: error: invalid storage class for function 'psi_stat_flags_change' 447 | static void psi_stat_flags_change(struct task_struct *task, int *stat_set, | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:469:13: error: invalid storage class for function 'get_recent_stat_times' 469 | static void get_recent_stat_times(struct psi_group *group, int cpu, | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:516:20: error: invalid storage class for function 'update_throttle_type' 516 | static inline void update_throttle_type(struct task_struct *task, int cpu, | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:520:13: error: invalid storage class for function 'collect_percpu_times' 520 | static void collect_percpu_times(struct psi_group *group, | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:588:13: error: invalid storage class for function 'window_reset' 588 | static void window_reset(struct psi_window *win, u64 now, u64 value, | ^~~~~~~~~~~~ kernel/sched/psi.c:607:12: error: invalid storage class for function 'window_update' 607 | static u64 window_update(struct psi_window *win, u64 now, u64 value) | ^~~~~~~~~~~~~ kernel/sched/psi.c:633:12: error: invalid storage class for function 'update_triggers' 633 | static u64 update_triggers(struct psi_group *group, u64 now, bool *update_total, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:706:12: error: invalid storage class for function 'update_averages' 706 | static u64 update_averages(struct psi_group *group, u64 now) | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:771:13: error: invalid storage class for function 'psi_avgs_work' 771 | static void psi_avgs_work(struct work_struct *work) | ^~~~~~~~~~~~~ kernel/sched/psi.c:807:13: error: invalid storage class for function 'init_rtpoll_triggers' 807 | static void init_rtpoll_triggers(struct psi_group *group, u64 now) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:820:13: error: invalid storage class for function 'psi_schedule_rtpoll_work' 820 | static void psi_schedule_rtpoll_work(struct psi_group *group, unsigned long delay, | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:847:13: error: invalid storage class for function 'psi_rtpoll_work' 847 | static void psi_rtpoll_work(struct psi_group *group) | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:931:12: error: invalid storage class for function 'psi_rtpoll_worker' 931 | static int psi_rtpoll_worker(void *data) | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:949:13: error: invalid storage class for function 'poll_timer_fn' 949 | static void poll_timer_fn(struct timer_list *t) | ^~~~~~~~~~~~~ kernel/sched/psi.c:957:13: error: invalid storage class for function 'record_times' 957 | static void record_times(struct psi_group_cpu *groupc, u64 now) | ^~~~~~~~~~~~ kernel/sched/psi.c:990:13: error: invalid storage class for function 'psi_group_change' 990 | static void psi_group_change(struct psi_group *group, int cpu, | ^~~~~~~~~~~~~~~~ kernel/sched/psi.c:1106:13: error: invalid storage class for function 'task_is_in_psi_v1' 1106 | static bool task_is_in_psi_v1(void) | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1112:33: error: invalid storage class for function 'task_psi_group' 1112 | static inline struct psi_group *task_psi_group(struct task_struct *task) | ^~~~~~~~~~~~~~ kernel/sched/psi.c: In function 'task_psi_group': kernel/sched/psi.c:1120:52: error: 'cpuacct_cgrp_id' undeclared (first use in this function); did you mean 'cpuset_cgrp_id'? 1120 | cgroup = task_cgroup(task, cpuacct_cgrp_id); | ^~~~~~~~~~~~~~~ | cpuset_cgrp_id kernel/sched/psi.c:1120:52: note: each undeclared identifier is reported only once for each function it appears in kernel/sched/psi.c: In function 'record_stat_times': kernel/sched/psi.c:1130:13: error: invalid storage class for function 'psi_flags_change' 1130 | static void psi_flags_change(struct task_struct *task, int clear, int set) | ^~~~~~~~~~~~~~~~ In file included from include/linux/linkage.h:7, from include/linux/kernel.h:17, from include/linux/cpumask.h:10, from include/linux/smp.h:13, from include/linux/sched/clock.h:5, from kernel/sched/build_utility.c:12: kernel/sched/psi.c:1338:19: error: non-static declaration of 'psi_memstall_enter' follows static declaration 1338 | EXPORT_SYMBOL_GPL(psi_memstall_enter); | ^~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/psi.c:1338:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 1338 | EXPORT_SYMBOL_GPL(psi_memstall_enter); | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1306:6: note: previous definition of 'psi_memstall_enter' with type 'void(long unsigned int *)' 1306 | void psi_memstall_enter(unsigned long *flags) | ^~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1370:19: error: non-static declaration of 'psi_memstall_leave' follows static declaration 1370 | EXPORT_SYMBOL_GPL(psi_memstall_leave); | ^~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/psi.c:1370:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 1370 | EXPORT_SYMBOL_GPL(psi_memstall_leave); | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1346:6: note: previous definition of 'psi_memstall_leave' with type 'void(long unsigned int *)' 1346 | void psi_memstall_leave(unsigned long *flags) | ^~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1763:12: error: invalid storage class for function 'psi_io_show' 1763 | static int psi_io_show(struct seq_file *m, void *v) | ^~~~~~~~~~~ >> kernel/sched/psi.c:1768:12: error: invalid storage class for function 'psi_memory_show' 1768 | static int psi_memory_show(struct seq_file *m, void *v) | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1773:12: error: invalid storage class for function 'psi_cpu_show' 1773 | static int psi_cpu_show(struct seq_file *m, void *v) | ^~~~~~~~~~~~ >> kernel/sched/psi.c:1778:12: error: invalid storage class for function 'psi_io_open' 1778 | static int psi_io_open(struct inode *inode, struct file *file) | ^~~~~~~~~~~ >> kernel/sched/psi.c:1783:12: error: invalid storage class for function 'psi_memory_open' 1783 | static int psi_memory_open(struct inode *inode, struct file *file) | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1788:12: error: invalid storage class for function 'psi_cpu_open' 1788 | static int psi_cpu_open(struct inode *inode, struct file *file) | ^~~~~~~~~~~~ >> kernel/sched/psi.c:1793:16: error: invalid storage class for function 'psi_write' 1793 | static ssize_t psi_write(struct file *file, const char __user *user_buf, | ^~~~~~~~~ >> kernel/sched/psi.c:1836:16: error: invalid storage class for function 'psi_io_write' 1836 | static ssize_t psi_io_write(struct file *file, const char __user *user_buf, | ^~~~~~~~~~~~ >> kernel/sched/psi.c:1842:16: error: invalid storage class for function 'psi_memory_write' 1842 | static ssize_t psi_memory_write(struct file *file, const char __user *user_buf, | ^~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1848:16: error: invalid storage class for function 'psi_cpu_write' 1848 | static ssize_t psi_cpu_write(struct file *file, const char __user *user_buf, | ^~~~~~~~~~~~~ >> kernel/sched/psi.c:1854:17: error: invalid storage class for function 'psi_fop_poll' 1854 | static __poll_t psi_fop_poll(struct file *file, poll_table *wait) | ^~~~~~~~~~~~ >> kernel/sched/psi.c:1861:12: error: invalid storage class for function 'psi_fop_release' 1861 | static int psi_fop_release(struct inode *inode, struct file *file) | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1870:27: error: initializer element is not constant 1870 | .proc_open = psi_io_open, | ^~~~~~~~~~~ kernel/sched/psi.c:1870:27: note: (near initialization for 'psi_io_proc_ops.proc_open') kernel/sched/psi.c:1873:27: error: initializer element is not constant 1873 | .proc_write = psi_io_write, | ^~~~~~~~~~~~ kernel/sched/psi.c:1873:27: note: (near initialization for 'psi_io_proc_ops.proc_write') kernel/sched/psi.c:1874:27: error: initializer element is not constant 1874 | .proc_poll = psi_fop_poll, | ^~~~~~~~~~~~ kernel/sched/psi.c:1874:27: note: (near initialization for 'psi_io_proc_ops.proc_poll') kernel/sched/psi.c:1875:27: error: initializer element is not constant 1875 | .proc_release = psi_fop_release, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1875:27: note: (near initialization for 'psi_io_proc_ops.proc_release') kernel/sched/psi.c:1879:27: error: initializer element is not constant 1879 | .proc_open = psi_memory_open, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1879:27: note: (near initialization for 'psi_memory_proc_ops.proc_open') kernel/sched/psi.c:1882:27: error: initializer element is not constant 1882 | .proc_write = psi_memory_write, | ^~~~~~~~~~~~~~~~ kernel/sched/psi.c:1882:27: note: (near initialization for 'psi_memory_proc_ops.proc_write') kernel/sched/psi.c:1883:27: error: initializer element is not constant 1883 | .proc_poll = psi_fop_poll, | ^~~~~~~~~~~~ kernel/sched/psi.c:1883:27: note: (near initialization for 'psi_memory_proc_ops.proc_poll') kernel/sched/psi.c:1884:27: error: initializer element is not constant 1884 | .proc_release = psi_fop_release, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1884:27: note: (near initialization for 'psi_memory_proc_ops.proc_release') kernel/sched/psi.c:1888:27: error: initializer element is not constant 1888 | .proc_open = psi_cpu_open, | ^~~~~~~~~~~~ kernel/sched/psi.c:1888:27: note: (near initialization for 'psi_cpu_proc_ops.proc_open') kernel/sched/psi.c:1891:27: error: initializer element is not constant 1891 | .proc_write = psi_cpu_write, | ^~~~~~~~~~~~~ kernel/sched/psi.c:1891:27: note: (near initialization for 'psi_cpu_proc_ops.proc_write') kernel/sched/psi.c:1892:27: error: initializer element is not constant 1892 | .proc_poll = psi_fop_poll, | ^~~~~~~~~~~~ kernel/sched/psi.c:1892:27: note: (near initialization for 'psi_cpu_proc_ops.proc_poll') kernel/sched/psi.c:1893:27: error: initializer element is not constant 1893 | .proc_release = psi_fop_release, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1893:27: note: (near initialization for 'psi_cpu_proc_ops.proc_release') >> kernel/sched/psi.c:1907:13: error: invalid storage class for function 'get_stat_names' 1907 | static void get_stat_names(struct seq_file *m, int i, bool is_full) | ^~~~~~~~~~~~~~ >> kernel/sched/psi.c:1953:12: error: invalid storage class for function 'system_psi_stat_show' 1953 | static int system_psi_stat_show(struct seq_file *m, void *v) | ^~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1958:12: error: invalid storage class for function 'psi_stat_open' 1958 | static int psi_stat_open(struct inode *inode, struct file *file) | ^~~~~~~~~~~~~ kernel/sched/psi.c:1964:27: error: initializer element is not constant 1964 | .proc_open = psi_stat_open, | ^~~~~~~~~~~~~ kernel/sched/psi.c:1964:27: note: (near initialization for 'psi_stat_proc_ops.proc_open') kernel/sched/psi.c:1967:27: error: initializer element is not constant 1967 | .proc_release = psi_fop_release, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1967:27: note: (near initialization for 'psi_stat_proc_ops.proc_release') >> kernel/sched/psi.c:1998:19: error: invalid storage class for function 'psi_proc_init' 1998 | static int __init psi_proc_init(void) | ^~~~~~~~~~~~~ In file included from include/linux/printk.h:6, from include/linux/kernel.h:30: kernel/sched/psi.c:2014:13: error: initializer element is not constant 2014 | module_init(psi_proc_init); | ^~~~~~~~~~~~~ include/linux/init.h:270:55: note: in definition of macro '____define_initcall' 270 | __attribute__((__section__(__sec))) = fn; | ^~ include/linux/init.h:280:9: note: in expansion of macro '__unique_initcall' 280 | __unique_initcall(fn, id, __sec, __initcall_id(fn)) | ^~~~~~~~~~~~~~~~~ include/linux/init.h:282:35: note: in expansion of macro '___define_initcall' 282 | #define __define_initcall(fn, id) ___define_initcall(fn, id, .initcall##id) | ^~~~~~~~~~~~~~~~~~ include/linux/init.h:311:41: note: in expansion of macro '__define_initcall' 311 | #define device_initcall(fn) __define_initcall(fn, 6) | ^~~~~~~~~~~~~~~~~ include/linux/init.h:316:24: note: in expansion of macro 'device_initcall' 316 | #define __initcall(fn) device_initcall(fn) | ^~~~~~~~~~~~~~~ include/linux/module.h:88:25: note: in expansion of macro '__initcall' 88 | #define module_init(x) __initcall(x); | ^~~~~~~~~~ kernel/sched/psi.c:2014:1: note: in expansion of macro 'module_init' 2014 | module_init(psi_proc_init); | ^~~~~~~~~~~ In file included from kernel/sched/build_utility.c:101: kernel/sched/membarrier.c:165:13: error: invalid storage class for function 'ipi_mb' 165 | static void ipi_mb(void *info) | ^~~~~~ kernel/sched/membarrier.c:170:13: error: invalid storage class for function 'ipi_sync_core' 170 | static void ipi_sync_core(void *info) | ^~~~~~~~~~~~~ kernel/sched/membarrier.c:187:13: error: invalid storage class for function 'ipi_rseq' 187 | static void ipi_rseq(void *info) | ^~~~~~~~ kernel/sched/membarrier.c:200:13: error: invalid storage class for function 'ipi_sync_rq_state' 200 | static void ipi_sync_rq_state(void *info) | ^~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:245:12: error: invalid storage class for function 'membarrier_global_expedited' 245 | static int membarrier_global_expedited(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:310:12: error: invalid storage class for function 'membarrier_private_expedited' 310 | static int membarrier_private_expedited(int flags, int cpu_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:426:12: error: invalid storage class for function 'sync_runqueues_membarrier_state' 426 | static int sync_runqueues_membarrier_state(struct mm_struct *mm) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:483:12: error: invalid storage class for function 'membarrier_register_global_expedited' 483 | static int membarrier_register_global_expedited(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:502:12: error: invalid storage class for function 'membarrier_register_private_expedited' 502 | static int membarrier_register_private_expedited(int flags) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:544:12: error: invalid storage class for function 'membarrier_get_registrations' 544 | static int membarrier_get_registrations(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler_types.h:153, from <command-line>: >> include/linux/compiler-gcc.h:132:33: warning: 'alias' attribute ignored [-Wattributes] 132 | #define __diag(s) _Pragma(__diag_str(GCC diagnostic s)) | ^~~~~~~ include/linux/compiler-gcc.h:135:33: note: in expansion of macro '__diag' 135 | #define __diag_GCC_8(s) __diag(s) | ^~~~~~ include/linux/compiler-gcc.h:123:9: note: in expansion of macro '__diag_GCC_8' 123 | __diag_GCC_ ## version(__diag_GCC_ ## severity s) | ^~~~~~~~~~~ include/linux/compiler_types.h:444:9: note: in expansion of macro '__diag_GCC' 444 | __diag_ ## compiler(version, ignore, option) | ^~~~~~~ include/linux/syscalls.h:242:9: note: in expansion of macro '__diag_ignore' 242 | __diag_ignore(GCC, 8, "-Wattribute-alias", \ | ^~~~~~~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ In file included from include/linux/syscalls_api.h:1, from kernel/sched/sched.h:61, from kernel/sched/build_utility.c:53: >> include/linux/syscalls.h:247:28: error: invalid storage class for function '__do_sys_membarrier' 247 | static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\ | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ >> include/linux/syscalls.h:249:25: error: static declaration of '__se_sys_membarrier' follows non-static declaration 249 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ include/linux/syscalls.h:248:25: note: previous declaration of '__se_sys_membarrier' with type 'long int(long int, long int, long int)' 248 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c: In function '__se_sys_membarrier': include/linux/syscalls.h:251:28: error: implicit declaration of function '__do_sys_membarrier'; did you mean '__se_sys_membarrier'? [-Wimplicit-function-declaration] 251 | long ret = __do_sys##name(__MAP(x,__SC_CAST,__VA_ARGS__));\ | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c: In function 'record_stat_times': include/linux/syscalls.h:257:28: error: invalid storage class for function '__do_sys_membarrier' 257 | static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ kernel/sched/isolation.c:24:19: error: extern declaration of 'housekeeping_overridden' follows declaration with no linkage 24 | EXPORT_SYMBOL_GPL(housekeeping_overridden); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:24:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 24 | EXPORT_SYMBOL_GPL(housekeeping_overridden); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/once.h:6, from include/linux/prandom.h:12, from include/linux/random.h:153, from include/linux/nodemask.h:97, from include/linux/sched.h:23, from include/linux/sched/signal.h:7, from include/linux/sched/cputime.h:5, from kernel/sched/build_utility.c:13: kernel/sched/isolation.c:23:25: note: previous definition of 'housekeeping_overridden' with type 'struct static_key_false' 23 | DEFINE_STATIC_KEY_FALSE(housekeeping_overridden); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/jump_label.h:390:33: note: in definition of macro 'DEFINE_STATIC_KEY_FALSE' 390 | struct static_key_false name = STATIC_KEY_FALSE_INIT | ^~~~ kernel/sched/isolation.c:37:19: error: non-static declaration of 'housekeeping_enabled' follows static declaration 37 | EXPORT_SYMBOL_GPL(housekeeping_enabled); | ^~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:37:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 37 | EXPORT_SYMBOL_GPL(housekeeping_enabled); | ^~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:105: kernel/sched/isolation.c:33:6: note: previous definition of 'housekeeping_enabled' with type 'bool(enum hk_type)' {aka '_Bool(enum hk_type)'} 33 | bool housekeeping_enabled(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:54:19: error: non-static declaration of 'housekeeping_any_cpu' follows static declaration 54 | EXPORT_SYMBOL_GPL(housekeeping_any_cpu); | ^~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ vim +/psi_io_show +1763 kernel/sched/psi.c 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1761 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1762 #ifdef CONFIG_PROC_FS 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1763 static int psi_io_show(struct seq_file *m, void *v) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1764 { 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1765 return psi_show(m, &psi_system, PSI_IO); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1766 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1767 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1768 static int psi_memory_show(struct seq_file *m, void *v) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1769 { 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1770 return psi_show(m, &psi_system, PSI_MEM); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1771 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1772 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1773 static int psi_cpu_show(struct seq_file *m, void *v) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1774 { 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1775 return psi_show(m, &psi_system, PSI_CPU); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1776 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1777 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1778 static int psi_io_open(struct inode *inode, struct file *file) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1779 { d82caa273565b4 Domenico Cerasuolo 2023-03-30 1780 return single_open(file, psi_io_show, NULL); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1781 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1782 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1783 static int psi_memory_open(struct inode *inode, struct file *file) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1784 { d82caa273565b4 Domenico Cerasuolo 2023-03-30 1785 return single_open(file, psi_memory_show, NULL); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1786 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1787 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1788 static int psi_cpu_open(struct inode *inode, struct file *file) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1789 { d82caa273565b4 Domenico Cerasuolo 2023-03-30 1790 return single_open(file, psi_cpu_show, NULL); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1791 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1792 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1793 static ssize_t psi_write(struct file *file, const char __user *user_buf, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1794 size_t nbytes, enum psi_res res) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1795 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1796 char buf[32]; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1797 size_t buf_size; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1798 struct seq_file *seq; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1799 struct psi_trigger *new; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1800 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1801 if (static_branch_likely(&psi_disabled)) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1802 return -EOPNOTSUPP; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1803 6fcca0fa48118e Suren Baghdasaryan 2020-02-03 1804 if (!nbytes) 6fcca0fa48118e Suren Baghdasaryan 2020-02-03 1805 return -EINVAL; 6fcca0fa48118e Suren Baghdasaryan 2020-02-03 1806 4adcdcea717cb2 Miles Chen 2019-09-12 1807 buf_size = min(nbytes, sizeof(buf)); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1808 if (copy_from_user(buf, user_buf, buf_size)) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1809 return -EFAULT; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1810 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1811 buf[buf_size - 1] = '\0'; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1812 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1813 seq = file->private_data; a06247c6804f1a Suren Baghdasaryan 2022-01-11 1814 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1815 /* Take seq->lock to protect seq->private from concurrent writes */ 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1816 mutex_lock(&seq->lock); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1817 a06247c6804f1a Suren Baghdasaryan 2022-01-11 1818 /* Allow only one trigger per file descriptor */ a06247c6804f1a Suren Baghdasaryan 2022-01-11 1819 if (seq->private) { a06247c6804f1a Suren Baghdasaryan 2022-01-11 1820 mutex_unlock(&seq->lock); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1821 return -EBUSY; a06247c6804f1a Suren Baghdasaryan 2022-01-11 1822 } a06247c6804f1a Suren Baghdasaryan 2022-01-11 1823 aff037078ecaec Suren Baghdasaryan 2023-06-29 1824 new = psi_trigger_create(&psi_system, buf, res, file, NULL); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1825 if (IS_ERR(new)) { a06247c6804f1a Suren Baghdasaryan 2022-01-11 1826 mutex_unlock(&seq->lock); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1827 return PTR_ERR(new); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1828 } a06247c6804f1a Suren Baghdasaryan 2022-01-11 1829 a06247c6804f1a Suren Baghdasaryan 2022-01-11 1830 smp_store_release(&seq->private, new); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1831 mutex_unlock(&seq->lock); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1832 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1833 return nbytes; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1834 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1835 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1836 static ssize_t psi_io_write(struct file *file, const char __user *user_buf, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1837 size_t nbytes, loff_t *ppos) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1838 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1839 return psi_write(file, user_buf, nbytes, PSI_IO); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1840 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1841 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1842 static ssize_t psi_memory_write(struct file *file, const char __user *user_buf, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1843 size_t nbytes, loff_t *ppos) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1844 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1845 return psi_write(file, user_buf, nbytes, PSI_MEM); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1846 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1847 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1848 static ssize_t psi_cpu_write(struct file *file, const char __user *user_buf, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1849 size_t nbytes, loff_t *ppos) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1850 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1851 return psi_write(file, user_buf, nbytes, PSI_CPU); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1852 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1853 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1854 static __poll_t psi_fop_poll(struct file *file, poll_table *wait) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1855 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1856 struct seq_file *seq = file->private_data; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1857 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1858 return psi_trigger_poll(&seq->private, file, wait); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1859 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1860 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1861 static int psi_fop_release(struct inode *inode, struct file *file) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1862 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1863 struct seq_file *seq = file->private_data; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1864 a06247c6804f1a Suren Baghdasaryan 2022-01-11 1865 psi_trigger_destroy(seq->private); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1866 return single_release(inode, file); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1867 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1868 97a32539b9568b Alexey Dobriyan 2020-02-03 1869 static const struct proc_ops psi_io_proc_ops = { 97a32539b9568b Alexey Dobriyan 2020-02-03 @1870 .proc_open = psi_io_open, 97a32539b9568b Alexey Dobriyan 2020-02-03 1871 .proc_read = seq_read, 97a32539b9568b Alexey Dobriyan 2020-02-03 1872 .proc_lseek = seq_lseek, 97a32539b9568b Alexey Dobriyan 2020-02-03 1873 .proc_write = psi_io_write, 97a32539b9568b Alexey Dobriyan 2020-02-03 1874 .proc_poll = psi_fop_poll, 97a32539b9568b Alexey Dobriyan 2020-02-03 1875 .proc_release = psi_fop_release, eb414681d5a07d Johannes Weiner 2018-10-26 1876 }; eb414681d5a07d Johannes Weiner 2018-10-26 1877 97a32539b9568b Alexey Dobriyan 2020-02-03 1878 static const struct proc_ops psi_memory_proc_ops = { 97a32539b9568b Alexey Dobriyan 2020-02-03 1879 .proc_open = psi_memory_open, 97a32539b9568b Alexey Dobriyan 2020-02-03 1880 .proc_read = seq_read, 97a32539b9568b Alexey Dobriyan 2020-02-03 1881 .proc_lseek = seq_lseek, 97a32539b9568b Alexey Dobriyan 2020-02-03 1882 .proc_write = psi_memory_write, 97a32539b9568b Alexey Dobriyan 2020-02-03 1883 .proc_poll = psi_fop_poll, 97a32539b9568b Alexey Dobriyan 2020-02-03 1884 .proc_release = psi_fop_release, eb414681d5a07d Johannes Weiner 2018-10-26 1885 }; eb414681d5a07d Johannes Weiner 2018-10-26 1886 97a32539b9568b Alexey Dobriyan 2020-02-03 1887 static const struct proc_ops psi_cpu_proc_ops = { 97a32539b9568b Alexey Dobriyan 2020-02-03 1888 .proc_open = psi_cpu_open, 97a32539b9568b Alexey Dobriyan 2020-02-03 1889 .proc_read = seq_read, 97a32539b9568b Alexey Dobriyan 2020-02-03 1890 .proc_lseek = seq_lseek, 97a32539b9568b Alexey Dobriyan 2020-02-03 1891 .proc_write = psi_cpu_write, 97a32539b9568b Alexey Dobriyan 2020-02-03 1892 .proc_poll = psi_fop_poll, 97a32539b9568b Alexey Dobriyan 2020-02-03 1893 .proc_release = psi_fop_release, eb414681d5a07d Johannes Weiner 2018-10-26 1894 }; eb414681d5a07d Johannes Weiner 2018-10-26 1895 4a69b56540f405 Lu Jialin 2024-01-04 1896 #ifdef CONFIG_PSI_FINE_GRAINED 4a69b56540f405 Lu Jialin 2024-01-04 1897 static const char *const psi_stat_names[] = { 4a69b56540f405 Lu Jialin 2024-01-04 1898 "cgroup_memory_reclaim", 25d00f6853c3c6 Lu Jialin 2024-01-04 1899 "global_memory_reclaim", 25d00f6853c3c6 Lu Jialin 2024-01-04 1900 "compact", 25d00f6853c3c6 Lu Jialin 2024-01-04 1901 "cgroup_async_memory_reclaim", 25d00f6853c3c6 Lu Jialin 2024-01-04 1902 "swap", 65494451082298 Lu Jialin 2024-01-04 1903 "cpu_cfs_bandwidth", 65494451082298 Lu Jialin 2024-01-04 1904 "cpu_qos", 4a69b56540f405 Lu Jialin 2024-01-04 1905 }; 4a69b56540f405 Lu Jialin 2024-01-04 1906 65494451082298 Lu Jialin 2024-01-04 @1907 static void get_stat_names(struct seq_file *m, int i, bool is_full) 65494451082298 Lu Jialin 2024-01-04 1908 { 65494451082298 Lu Jialin 2024-01-04 1909 if (i <= PSI_SWAP_FULL && !is_full) 65494451082298 Lu Jialin 2024-01-04 1910 return seq_printf(m, "%s\n", psi_stat_names[i / 2]); 65494451082298 Lu Jialin 2024-01-04 1911 else if (i == PSI_CPU_CFS_BANDWIDTH_FULL) 65494451082298 Lu Jialin 2024-01-04 1912 return seq_printf(m, "%s\n", "cpu_cfs_bandwidth"); 65494451082298 Lu Jialin 2024-01-04 1913 #ifdef CONFIG_QOS_SCHED 65494451082298 Lu Jialin 2024-01-04 1914 else if (i == PSI_CPU_QOS_FULL) 65494451082298 Lu Jialin 2024-01-04 1915 return seq_printf(m, "%s\n", "cpu_qos"); 65494451082298 Lu Jialin 2024-01-04 1916 #endif 65494451082298 Lu Jialin 2024-01-04 1917 } 65494451082298 Lu Jialin 2024-01-04 1918 4a69b56540f405 Lu Jialin 2024-01-04 1919 int psi_stat_show(struct seq_file *m, struct psi_group *group) 4a69b56540f405 Lu Jialin 2024-01-04 1920 { 4a69b56540f405 Lu Jialin 2024-01-04 1921 int i; 4a69b56540f405 Lu Jialin 2024-01-04 1922 u64 now; 4a69b56540f405 Lu Jialin 2024-01-04 1923 4a69b56540f405 Lu Jialin 2024-01-04 1924 if (static_branch_likely(&psi_disabled)) 4a69b56540f405 Lu Jialin 2024-01-04 1925 return -EOPNOTSUPP; 4a69b56540f405 Lu Jialin 2024-01-04 1926 4a69b56540f405 Lu Jialin 2024-01-04 1927 mutex_lock(&group->avgs_lock); 4a69b56540f405 Lu Jialin 2024-01-04 1928 now = sched_clock(); 4a69b56540f405 Lu Jialin 2024-01-04 1929 collect_percpu_times(group, PSI_AVGS, NULL); 4a69b56540f405 Lu Jialin 2024-01-04 1930 if (now >= group->avg_next_update) 4a69b56540f405 Lu Jialin 2024-01-04 1931 group->avg_next_update = update_averages(group, now); 4a69b56540f405 Lu Jialin 2024-01-04 1932 mutex_unlock(&group->avgs_lock); 4a69b56540f405 Lu Jialin 2024-01-04 1933 4a69b56540f405 Lu Jialin 2024-01-04 1934 for (i = 0; i < NR_PSI_STAT_STATES; i++) { 4a69b56540f405 Lu Jialin 2024-01-04 1935 unsigned long avg[3] = {0, }; 4a69b56540f405 Lu Jialin 2024-01-04 1936 int w; 4a69b56540f405 Lu Jialin 2024-01-04 1937 u64 total; 65494451082298 Lu Jialin 2024-01-04 1938 bool is_full = i % 2 || i > PSI_SWAP_FULL; 4a69b56540f405 Lu Jialin 2024-01-04 1939 4a69b56540f405 Lu Jialin 2024-01-04 1940 for (w = 0; w < 3; w++) 4a69b56540f405 Lu Jialin 2024-01-04 1941 avg[w] = group->fine_grained_avg[i][w]; 4a69b56540f405 Lu Jialin 2024-01-04 1942 total = div_u64(group->fine_grained_total[PSI_AVGS][i], NSEC_PER_USEC); 65494451082298 Lu Jialin 2024-01-04 1943 get_stat_names(m, i, is_full); 4a69b56540f405 Lu Jialin 2024-01-04 1944 seq_printf(m, "%s avg10=%lu.%02lu avg60=%lu.%02lu avg300=%lu.%02lu total=%llu\n", 4a69b56540f405 Lu Jialin 2024-01-04 1945 is_full ? "full" : "some", 4a69b56540f405 Lu Jialin 2024-01-04 1946 LOAD_INT(avg[0]), LOAD_FRAC(avg[0]), 4a69b56540f405 Lu Jialin 2024-01-04 1947 LOAD_INT(avg[1]), LOAD_FRAC(avg[1]), 4a69b56540f405 Lu Jialin 2024-01-04 1948 LOAD_INT(avg[2]), LOAD_FRAC(avg[2]), 4a69b56540f405 Lu Jialin 2024-01-04 1949 total); 4a69b56540f405 Lu Jialin 2024-01-04 1950 } 4a69b56540f405 Lu Jialin 2024-01-04 1951 return 0; 4a69b56540f405 Lu Jialin 2024-01-04 1952 } 4a69b56540f405 Lu Jialin 2024-01-04 @1953 static int system_psi_stat_show(struct seq_file *m, void *v) 4a69b56540f405 Lu Jialin 2024-01-04 1954 { 4a69b56540f405 Lu Jialin 2024-01-04 1955 return psi_stat_show(m, &psi_system); 4a69b56540f405 Lu Jialin 2024-01-04 1956 } 4a69b56540f405 Lu Jialin 2024-01-04 1957 4a69b56540f405 Lu Jialin 2024-01-04 @1958 static int psi_stat_open(struct inode *inode, struct file *file) 4a69b56540f405 Lu Jialin 2024-01-04 1959 { 4a69b56540f405 Lu Jialin 2024-01-04 1960 return single_open(file, system_psi_stat_show, NULL); 4a69b56540f405 Lu Jialin 2024-01-04 1961 } 4a69b56540f405 Lu Jialin 2024-01-04 1962 :::::: The code at line 1763 was first introduced by commit :::::: 5102bb1c9f82857a3164af9d7ab7ad628cb783ed psi: Fix "defined but not used" warnings when CONFIG_PROC_FS=n :::::: TO: Suren Baghdasaryan <surenb(a)google.com> :::::: CC: Peter Zijlstra <peterz(a)infradead.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1422/1422] kernel/time/.tmp_hrtimer.o: warning: objtool: hrtimer_start_range_ns()+0x535: unreachable instruction
by kernel test robot 16 Feb '25

16 Feb '25

Hi Phil, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6a6cc2b6b95dc80ae01221670e21a8059229a023 commit: 40ecfb28732cefd0c5658f7c10543bbc4cd41cb8 [1422/1422] hrtimer: Prevent queuing of hrtimer without a function callback config: x86_64-buildonly-randconfig-001-20250210 (https://download.01.org/0day-ci/archive/20250216/202502160431.1F2NAJJ5-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502160431.1F2NAJJ5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502160431.1F2NAJJ5-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/time/hrtimer.c:130:21: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 130 | [CLOCK_REALTIME] = HRTIMER_BASE_REALTIME, | ^~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:131:22: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 131 | [CLOCK_MONOTONIC] = HRTIMER_BASE_MONOTONIC, | ^~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:132:21: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 132 | [CLOCK_BOOTTIME] = HRTIMER_BASE_BOOTTIME, | ^~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:133:17: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 133 | [CLOCK_TAI] = HRTIMER_BASE_TAI, | ^~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. >> kernel/time/.tmp_hrtimer.o: warning: objtool: hrtimer_start_range_ns()+0x535: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1422/1422] kernel/time/.tmp_posix-cpu-timers.o: warning: objtool: set_process_cpu_timer()+0x119: unreachable instruction
by kernel test robot 16 Feb '25

16 Feb '25

Hi Thomas, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6a6cc2b6b95dc80ae01221670e21a8059229a023 commit: 36ff49c95a04513935898fdcd4bc37646b2dc459 [1422/1422] posix-cpu-timers: Sanitize bogus WARNONS config: x86_64-buildonly-randconfig-001-20250210 (https://download.01.org/0day-ci/archive/20250216/202502160200.QYr3efrJ-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502160200.QYr3efrJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502160200.QYr3efrJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/time/.tmp_posix-cpu-timers.o: warning: objtool: set_process_cpu_timer()+0x119: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v3 0/2] net: Fix CVE-2024-56658
by Dong Chenchen 15 Feb '25

15 Feb '25

Fix CVE-2024-56658 Dong Chenchen (1): net: Fix kabi breakage in struct net Eric Dumazet (1): net: defer final 'struct net' free in netns dismantle include/net/net_namespace.h | 2 +- net/core/net_namespace.c | 20 +++++++++++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] netfilter: conntrack: clamp maximum hashtable size to INT_MAX
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.13-rc7 commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQN CVE: CVE-2025-21648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns. Fixes: 9cc1c73ad666 ("netfilter: conntrack: avoid integer overflow when resizing") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_core.c [commit b9e0102a57d7 use kvcalloc, which not merged lead to conflict] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 755e1cee32cb..ebc365e6ac8f 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -2314,12 +2314,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) struct hlist_nulls_head *hash; unsigned int nr_slots, i; - if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) + if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head))) return NULL; BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); + if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head))) + return NULL; + hash = kvmalloc_array(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL | __GFP_ZERO); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: x_tables: fix LED ID check in led_tg_check()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> mainline inclusion from mainline-v6.13-rc2 commit 04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO6 CVE: CVE-2024-56650 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 print_report+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_report+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? netlink_deliver_tap+0x2e/0x1b0 netlink_unicast+0x7f8/0x990 ? __pfx_netlink_unicast+0x10/0x10 ? __virt_addr_valid+0x183/0x530 ? __check_object_size+0x48e/0x900 netlink_sendmsg+0x8e4/0xcb0 ? __pfx_netlink_sendmsg+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? __pfx_____sys_sendmsg+0x10/0x10 __sys_sendmsg+0x292/0x380 ? __pfx___sys_sendmsg+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? exc_page_fault+0x590/0x8c0 ? do_syscall_64+0xb6/0x230 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> Since an invalid (without '\0' byte at all) byte sequence may be passed from userspace, add an extra check to ensure that such a sequence is rejected as possible ID and so never passed to 'kstrdup()' and further. Reported-by: syzbot+6c8215822f35fdb35667(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c8215822f35fdb35667 Fixes: 268cb38e1802 ("netfilter: x_tables: add LED trigger target") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_LED.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c index 19846445504d..043d657f4447 100644 --- a/net/netfilter/xt_LED.c +++ b/net/netfilter/xt_LED.c @@ -111,7 +111,9 @@ static int led_tg_check(const struct xt_tgchk_param *par) struct xt_led_info_internal *ledinternal; int err; - if (ledinfo->id[0] == '\0') + /* Bail out if empty string or not a string at all. */ + if (ledinfo->id[0] == '\0' || + !memchr(ledinfo->id, '\0', sizeof(ledinfo->id))) return -EINVAL; mutex_lock(&xt_led_mutex); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v3 0/2] net: Fix CVE-2024-56658
by Dong Chenchen 15 Feb '25

15 Feb '25

Fix CVE-2024-56658 Dong Chenchen (1): net: Fix kabi breakage in struct net Eric Dumazet (1): net: defer final 'struct net' free in netns dismantle include/net/net_namespace.h | 3 +++ net/core/net_namespace.c | 20 +++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] sched: sch_cake: add bounds checks to host bulk flow fairness counts
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v6.6.72 commit 27202e2e8721c3b23831563c36ed5ac7818641ba category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQOT CVE: CVE-2025-21647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 737d4d91d35b5f7fa5bb442651472277318b0bfd ] Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error). As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour. Fixes: 546ea84d07e3 ("sched: sch_cake: fix bulk flow accounting logic for host fairness") Reported-by: syzbot+f63600d288bfb7057424(a)syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Acked-by: Dave Taht <dave.taht(a)gmail.com> Link: https://patch.msgid.link/20250107120105.70685-1-toke@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_cake.c | 140 +++++++++++++++++++++++-------------------- 1 file changed, 75 insertions(+), 65 deletions(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index 30955dd45779..453dcc9c13f0 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -644,6 +644,63 @@ static bool cake_ddst(int flow_mode) return (flow_mode & CAKE_FLOW_DUAL_DST) == CAKE_FLOW_DUAL_DST; } +static void cake_dec_srchost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_dsrc(flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count)) + q->hosts[flow->srchost].srchost_bulk_flow_count--; +} + +static void cake_inc_srchost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_dsrc(flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count < CAKE_QUEUES)) + q->hosts[flow->srchost].srchost_bulk_flow_count++; +} + +static void cake_dec_dsthost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_ddst(flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count--; +} + +static void cake_inc_dsthost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_ddst(flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count < CAKE_QUEUES)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count++; +} + +static u16 cake_get_flow_quantum(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + u16 host_load = 1; + + if (cake_dsrc(flow_mode)) + host_load = max(host_load, + q->hosts[flow->srchost].srchost_bulk_flow_count); + + if (cake_ddst(flow_mode)) + host_load = max(host_load, + q->hosts[flow->dsthost].dsthost_bulk_flow_count); + + /* The get_random_u16() is a way to apply dithering to avoid + * accumulating roundoff errors + */ + return (q->flow_quantum * quantum_div[host_load] + + get_random_u16()) >> 16; +} + static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, int flow_mode, u16 flow_override, u16 host_override) { @@ -790,10 +847,8 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, allocate_dst = cake_ddst(flow_mode); if (q->flows[outer_hash + k].set == CAKE_SET_BULK) { - if (allocate_src) - q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; - if (allocate_dst) - q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; + cake_dec_srchost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); + cake_dec_dsthost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); } found: /* reserve queue for future packets in same flow */ @@ -818,9 +873,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].srchost_tag = srchost_hash; found_src: srchost_idx = outer_hash + k; - if (q->flows[reduced_hash].set == CAKE_SET_BULK) - q->hosts[srchost_idx].srchost_bulk_flow_count++; q->flows[reduced_hash].srchost = srchost_idx; + + if (q->flows[reduced_hash].set == CAKE_SET_BULK) + cake_inc_srchost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); } if (allocate_dst) { @@ -841,9 +897,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].dsthost_tag = dsthost_hash; found_dst: dsthost_idx = outer_hash + k; - if (q->flows[reduced_hash].set == CAKE_SET_BULK) - q->hosts[dsthost_idx].dsthost_bulk_flow_count++; q->flows[reduced_hash].dsthost = dsthost_idx; + + if (q->flows[reduced_hash].set == CAKE_SET_BULK) + cake_inc_dsthost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); } } @@ -1856,10 +1913,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* flowchain */ if (!flow->set || flow->set == CAKE_SET_DECAYING) { - struct cake_host *srchost = &b->hosts[flow->srchost]; - struct cake_host *dsthost = &b->hosts[flow->dsthost]; - u16 host_load = 1; - if (!flow->set) { list_add_tail(&flow->flowchain, &b->new_flows); } else { @@ -1869,18 +1922,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, flow->set = CAKE_SET_SPARSE; b->sparse_flow_count++; - if (cake_dsrc(q->flow_mode)) - host_load = max(host_load, srchost->srchost_bulk_flow_count); - - if (cake_ddst(q->flow_mode)) - host_load = max(host_load, dsthost->dsthost_bulk_flow_count); - - flow->deficit = (b->flow_quantum * - quantum_div[host_load]) >> 16; + flow->deficit = cake_get_flow_quantum(b, flow, q->flow_mode); } else if (flow->set == CAKE_SET_SPARSE_WAIT) { - struct cake_host *srchost = &b->hosts[flow->srchost]; - struct cake_host *dsthost = &b->hosts[flow->dsthost]; - /* this flow was empty, accounted as a sparse flow, but actually * in the bulk rotation. */ @@ -1888,12 +1931,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, b->sparse_flow_count--; b->bulk_flow_count++; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count++; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; - + cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); } if (q->buffer_used > q->buffer_max_used) @@ -1950,13 +1989,11 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) { struct cake_sched_data *q = qdisc_priv(sch); struct cake_tin_data *b = &q->tins[q->cur_tin]; - struct cake_host *srchost, *dsthost; ktime_t now = ktime_get(); struct cake_flow *flow; struct list_head *head; bool first_flow = true; struct sk_buff *skb; - u16 host_load; u64 delay; u32 len; @@ -2056,11 +2093,6 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) q->cur_flow = flow - b->flows; first_flow = false; - /* triple isolation (modified DRR++) */ - srchost = &b->hosts[flow->srchost]; - dsthost = &b->hosts[flow->dsthost]; - host_load = 1; - /* flow isolation (DRR++) */ if (flow->deficit <= 0) { /* Keep all flows with deficits out of the sparse and decaying @@ -2072,11 +2104,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) b->sparse_flow_count--; b->bulk_flow_count++; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count++; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; + cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); flow->set = CAKE_SET_BULK; } else { @@ -2088,19 +2117,7 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) } } - if (cake_dsrc(q->flow_mode)) - host_load = max(host_load, srchost->srchost_bulk_flow_count); - - if (cake_ddst(q->flow_mode)) - host_load = max(host_load, dsthost->dsthost_bulk_flow_count); - - WARN_ON(host_load > CAKE_QUEUES); - - /* The get_random_u16() is a way to apply dithering to avoid - * accumulating roundoff errors - */ - flow->deficit += (b->flow_quantum * quantum_div[host_load] + - get_random_u16()) >> 16; + flow->deficit += cake_get_flow_quantum(b, flow, q->flow_mode); list_move_tail(&flow->flowchain, &b->old_flows); goto retry; @@ -2124,11 +2141,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) if (flow->set == CAKE_SET_BULK) { b->bulk_flow_count--; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count--; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; + cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); b->decaying_flow_count++; } else if (flow->set == CAKE_SET_SPARSE || @@ -2146,12 +2160,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) else if (flow->set == CAKE_SET_BULK) { b->bulk_flow_count--; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count--; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; - + cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); } else b->decaying_flow_count--; -- 2.25.1

2 1

[PATCH OLK-6.6] net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.72 commit e54beb9aed2a90dddf4c5d68fcfc9a01f3e40a61 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQJ CVE: CVE-2025-21653 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a039e54397c6a75b713b9ce7894a62e06956aa92 ] syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1771 [inline] tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867 sfb_classify net/sched/sch_sfb.c:260 [inline] sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793 __dev_xmit_skb net/core/dev.c:3889 [inline] __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173 geneve_xmit_skb drivers/net/geneve.c:916 [inline] geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434 Fixes: e5dfb815181f ("[NET_SCHED]: Add flow classifier") Reported-by: syzbot+1dbb57d994e54aaa04d2(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6777bf49.050a0220.178762.0040.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250103104546.3714168-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/cls_flow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c index 6ab317b48d6c..815216b564f3 100644 --- a/net/sched/cls_flow.c +++ b/net/sched/cls_flow.c @@ -356,7 +356,8 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = { [TCA_FLOW_KEYS] = { .type = NLA_U32 }, [TCA_FLOW_MODE] = { .type = NLA_U32 }, [TCA_FLOW_BASECLASS] = { .type = NLA_U32 }, - [TCA_FLOW_RSHIFT] = { .type = NLA_U32 }, + [TCA_FLOW_RSHIFT] = NLA_POLICY_MAX(NLA_U32, + 31 /* BITS_PER_U32 - 1 */), [TCA_FLOW_ADDEND] = { .type = NLA_U32 }, [TCA_FLOW_MASK] = { .type = NLA_U32 }, [TCA_FLOW_XOR] = { .type = NLA_U32 }, -- 2.25.1

2 1

[PATCH OLK-6.6] net: wwan: t7xx: Fix FSM command timeout issue
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jinjian Song <jinjian.song(a)fibocom.com> stable inclusion from stable-v6.6.70 commit 0cd3bde081cd3452c875fa1e5c55834c670d6e05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID39 CVE: CVE-2024-39282 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f619d518db9cd1a933c3a095a5f95d0c1584ae8 ] When driver processes the internal state change command, it use an asynchronous thread to process the command operation. If the main thread detects that the task has timed out, the asynchronous thread will panic when executing the completion notification because the main thread completion object has been released. BUG: unable to handle page fault for address: fffffffffffffff8 PGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:complete_all+0x3e/0xa0 [...] Call Trace: <TASK> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? complete_all+0x3e/0xa0 fsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0xd8/0x110 ? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)] ? __pfx_kthread+0x10/0x10 ret_from_fork+0x38/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> [...] CR2: fffffffffffffff8 ---[ end trace 0000000000000000 ]--- Use the reference counter to ensure safe release as Sergey suggests: https://lore.kernel.org/all/da90f64c-260a-4329-87bf-1f9ff20a5951@gmail.com/ Fixes: 13e920d93e37 ("net: wwan: t7xx: Add core components") Signed-off-by: Jinjian Song <jinjian.song(a)fibocom.com> Acked-by: Sergey Ryazanov <ryazanov.s.a(a)gmail.com> Link: https://patch.msgid.link/20241224041552.8711-1-jinjian.song@fibocom.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wwan/t7xx/t7xx_state_monitor.c | 26 ++++++++++++++-------- drivers/net/wwan/t7xx/t7xx_state_monitor.h | 5 +++-- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/drivers/net/wwan/t7xx/t7xx_state_monitor.c b/drivers/net/wwan/t7xx/t7xx_state_monitor.c index 80edb8e75a6a..64868df3640d 100644 --- a/drivers/net/wwan/t7xx/t7xx_state_monitor.c +++ b/drivers/net/wwan/t7xx/t7xx_state_monitor.c @@ -97,14 +97,21 @@ void t7xx_fsm_broadcast_state(struct t7xx_fsm_ctl *ctl, enum md_state state) fsm_state_notify(ctl->md, state); } +static void fsm_release_command(struct kref *ref) +{ + struct t7xx_fsm_command *cmd = container_of(ref, typeof(*cmd), refcnt); + + kfree(cmd); +} + static void fsm_finish_command(struct t7xx_fsm_ctl *ctl, struct t7xx_fsm_command *cmd, int result) { if (cmd->flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { - *cmd->ret = result; - complete_all(cmd->done); + cmd->result = result; + complete_all(&cmd->done); } - kfree(cmd); + kref_put(&cmd->refcnt, fsm_release_command); } static void fsm_del_kf_event(struct t7xx_fsm_event *event) @@ -396,7 +403,6 @@ static int fsm_main_thread(void *data) int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id, unsigned int flag) { - DECLARE_COMPLETION_ONSTACK(done); struct t7xx_fsm_command *cmd; unsigned long flags; int ret; @@ -408,11 +414,13 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id INIT_LIST_HEAD(&cmd->entry); cmd->cmd_id = cmd_id; cmd->flag = flag; + kref_init(&cmd->refcnt); if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { - cmd->done = &done; - cmd->ret = &ret; + init_completion(&cmd->done); + kref_get(&cmd->refcnt); } + kref_get(&cmd->refcnt); spin_lock_irqsave(&ctl->command_lock, flags); list_add_tail(&cmd->entry, &ctl->command_queue); spin_unlock_irqrestore(&ctl->command_lock, flags); @@ -422,11 +430,11 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { unsigned long wait_ret; - wait_ret = wait_for_completion_timeout(&done, + wait_ret = wait_for_completion_timeout(&cmd->done, msecs_to_jiffies(FSM_CMD_TIMEOUT_MS)); - if (!wait_ret) - return -ETIMEDOUT; + ret = wait_ret ? cmd->result : -ETIMEDOUT; + kref_put(&cmd->refcnt, fsm_release_command); return ret; } diff --git a/drivers/net/wwan/t7xx/t7xx_state_monitor.h b/drivers/net/wwan/t7xx/t7xx_state_monitor.h index b6e76f3903c8..74f96fd2605e 100644 --- a/drivers/net/wwan/t7xx/t7xx_state_monitor.h +++ b/drivers/net/wwan/t7xx/t7xx_state_monitor.h @@ -109,8 +109,9 @@ struct t7xx_fsm_command { struct list_head entry; enum t7xx_fsm_cmd_state cmd_id; unsigned int flag; - struct completion *done; - int *ret; + struct completion done; + int result; + struct kref refcnt; }; struct t7xx_fsm_notifier { -- 2.25.1

2 1

[PATCH OLK-6.6] net/mlx5e: Skip restore TC rules for vport rep without loaded flag
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jianbo Liu <jianbol(a)nvidia.com> stable inclusion from stable-v6.6.70 commit 3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2C CVE: CVE-2024-57801 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be ] During driver unload, unregister_netdev is called after unloading vport rep. So, the mlx5e_rep_priv is already freed while trying to get rpriv->netdev, or walk rpriv->tc_ht, which results in use-after-free. So add the checking to make sure access the data of vport rep which is still loaded. Fixes: d1569537a837 ("net/mlx5e: Modify and restore TC rules for IPSec TX rules") Signed-off-by: Jianbo Liu <jianbol(a)nvidia.com> Reviewed-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20241220081505.1286093-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 6 +++--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +++ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 --- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c index 13b5916b64e2..eed8fcde2613 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c @@ -150,11 +150,11 @@ void mlx5_esw_ipsec_restore_dest_uplink(struct mlx5_core_dev *mdev) unsigned long i; int err; - xa_for_each(&esw->offloads.vport_reps, i, rep) { - rpriv = rep->rep_data[REP_ETH].priv; - if (!rpriv || !rpriv->netdev) + mlx5_esw_for_each_rep(esw, i, rep) { + if (atomic_read(&rep->rep_data[REP_ETH].state) != REP_LOADED) continue; + rpriv = rep->rep_data[REP_ETH].priv; rhashtable_walk_enter(&rpriv->tc_ht, &iter); rhashtable_walk_start(&iter); while ((flow = rhashtable_walk_next(&iter)) != NULL) { diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h index 9b771b572593..3e58e731b569 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h @@ -713,6 +713,9 @@ void mlx5e_tc_clean_fdb_peer_flows(struct mlx5_eswitch *esw); MLX5_CAP_GEN_2((esw->dev), ec_vf_vport_base) +\ (last) - 1) +#define mlx5_esw_for_each_rep(esw, i, rep) \ + xa_for_each(&((esw)->offloads.vport_reps), i, rep) + struct mlx5_eswitch *__must_check mlx5_devlink_eswitch_get(struct devlink *devlink); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c index 58529d1a98b3..7eba3a5bb97c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c @@ -52,9 +52,6 @@ #include "lag/lag.h" #include "en/tc/post_meter.h" -#define mlx5_esw_for_each_rep(esw, i, rep) \ - xa_for_each(&((esw)->offloads.vport_reps), i, rep) - /* There are two match-all miss flows, one for unicast dst mac and * one for multicast. */ -- 2.25.1

2 1

[PATCH OLK-6.6] net: Fix icmp host relookup triggering ip_rt_bug
by Dong Chenchen 15 Feb '25

15 Feb '25

mainline inclusion from mainline-v6.13-rc2 commit c44daa7e3c73229f7ac74985acb8c7fb909c4e0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANM CVE: CVE-2024-56647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- arp link failure may trigger ip_rt_bug while xfrm enabled, call trace is: WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:ip_rt_bug+0x14/0x20 Call Trace: <IRQ> ip_send_skb+0x14/0x40 __icmp_send+0x42d/0x6a0 ipv4_link_failure+0xe2/0x1d0 arp_error_report+0x3c/0x50 neigh_invalidate+0x8d/0x100 neigh_timer_handler+0x2e1/0x330 call_timer_fn+0x21/0x120 __run_timer_base.part.0+0x1c9/0x270 run_timer_softirq+0x4c/0x80 handle_softirqs+0xac/0x280 irq_exit_rcu+0x62/0x80 sysvec_apic_timer_interrupt+0x77/0x90 The script below reproduces this scenario: ip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \ dir out priority 0 ptype main flag localok icmp ip l a veth1 type veth ip a a 192.168.141.111/24 dev veth0 ip l s veth0 up ping 192.168.141.155 -c 1 icmp_route_lookup() create input routes for locally generated packets while xfrm relookup ICMP traffic.Then it will set input route (dst->out = ip_rt_bug) to skb for DESTUNREACH. For ICMP err triggered by locally generated packets, dst->dev of output route is loopback. Generally, xfrm relookup verification is not required on loopback interfaces (net.ipv4.conf.lo.disable_xfrm = 1). Skip icmp relookup for locally generated packets to fix it. Fixes: 8b7817f3a959 ("[IPSEC]: Add ICMP host relookup support") Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241127040850.1513135-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/icmp.c [commit 913c83a610bb convert icmp_route_lookup() to dscp_t, which not merged lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/icmp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 9dffdd876fef..b40c1fc39125 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -521,6 +521,9 @@ static struct rtable *icmp_route_lookup(struct net *net, if (!IS_ERR(rt)) { if (rt != rt2) return rt; + if (inet_addr_type_dev_table(net, route_lookup_dev, + fl4->daddr) == RTN_LOCAL) + return rt; } else if (PTR_ERR(rt) == -EPERM) { rt = NULL; } else -- 2.25.1

2 1

[PATCH OLK-6.6] net/sched: netem: account for backlog updates from child qdisc
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Martin Ottens <martin.ottens(a)fau.de> stable inclusion from stable-v6.6.67 commit 3824c5fad18eeb7abe0c4fc966f29959552dca3e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCV9 CVE: CVE-2024-56770 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8d4bc455047cf3903cd6f85f49978987dbb3027 ] In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only accounts for the packets in its internal tfifo. When netem is used with a child qdisc, the child qdisc can use 'qdisc_tree_reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function updates 'qlen' and the backlog statistics of netem, but netem does not account for changes made by a child qdisc. 'qlen' then indicates the wrong number of packets in the tfifo. If a child qdisc creates new SKBs during enqueue and informs its parent about this, netem's 'qlen' value is increased. When netem dequeues the newly created SKBs from the child, the 'qlen' in netem is not updated. If 'qlen' reaches the configured sch->limit, the enqueue function stops working, even though the tfifo is not full. Reproduce the bug: Ensure that the sender machine has GSO enabled. Configure netem as root qdisc and tbf as its child on the outgoing interface of the machine as follows: $ tc qdisc add dev <oif> root handle 1: netem delay 100ms limit 100 $ tc qdisc add dev <oif> parent 1:0 tbf rate 50Mbit burst 1542 latency 50ms Send bulk TCP traffic out via this interface, e.g., by running an iPerf3 client on the machine. Check the qdisc statistics: $ tc -s qdisc show dev <oif> Statistics after 10s of iPerf3 TCP test before the fix (note that netem's backlog > limit, netem stopped accepting packets): qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0 Statistics after the fix: qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0) backlog 0b 0p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0 tbf segments the GSO SKBs (tbf_segment) and updates the netem's 'qlen'. The interface fully stops transferring packets and "locks". In this case, the child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at its limit and no more packets are accepted. This patch adds a counter for the entries in the tfifo. Netem's 'qlen' is only decreased when a packet is returned by its dequeue function, and not during enqueuing into the child qdisc. External updates to 'qlen' are thus accounted for and only the behavior of the backlog statistics changes. As in other qdiscs, 'qlen' then keeps track of how many packets are held in netem and all of its children. As before, sch->limit remains as the maximum number of packets in the tfifo. The same applies to netem's backlog statistics. Fixes: 50612537e9ab ("netem: fix classful handling") Signed-off-by: Martin Ottens <martin.ottens(a)fau.de> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://patch.msgid.link/20241210131412.1837202-1-martin.ottens@fau.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_netem.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index d36eeb7b0502..152dbbe8fd31 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -78,6 +78,8 @@ struct netem_sched_data { struct sk_buff *t_head; struct sk_buff *t_tail; + u32 t_len; + /* optional qdisc for classful handling (NULL at netem init) */ struct Qdisc *qdisc; @@ -382,6 +384,7 @@ static void tfifo_reset(struct Qdisc *sch) rtnl_kfree_skbs(q->t_head, q->t_tail); q->t_head = NULL; q->t_tail = NULL; + q->t_len = 0; } static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch) @@ -411,6 +414,7 @@ static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch) rb_link_node(&nskb->rbnode, parent, p); rb_insert_color(&nskb->rbnode, &q->t_root); } + q->t_len++; sch->q.qlen++; } @@ -517,7 +521,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, 1<<get_random_u32_below(8); } - if (unlikely(sch->q.qlen >= sch->limit)) { + if (unlikely(q->t_len >= sch->limit)) { /* re-link segs, so that qdisc_drop_all() frees them all */ skb->next = segs; qdisc_drop_all(skb, sch, to_free); @@ -701,8 +705,8 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) tfifo_dequeue: skb = __qdisc_dequeue_head(&sch->q); if (skb) { - qdisc_qstats_backlog_dec(sch, skb); deliver: + qdisc_qstats_backlog_dec(sch, skb); qdisc_bstats_update(sch, skb); return skb; } @@ -718,8 +722,7 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) if (time_to_send <= now && q->slot.slot_next <= now) { netem_erase_head(q, skb); - sch->q.qlen--; - qdisc_qstats_backlog_dec(sch, skb); + q->t_len--; skb->next = NULL; skb->prev = NULL; /* skb->dev shares skb->rbnode area, @@ -746,16 +749,21 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) if (net_xmit_drop_count(err)) qdisc_qstats_drop(sch); qdisc_tree_reduce_backlog(sch, 1, pkt_len); + sch->qstats.backlog -= pkt_len; + sch->q.qlen--; } goto tfifo_dequeue; } + sch->q.qlen--; goto deliver; } if (q->qdisc) { skb = q->qdisc->ops->dequeue(q->qdisc); - if (skb) + if (skb) { + sch->q.qlen--; goto deliver; + } } qdisc_watchdog_schedule_ns(&q->watchdog, @@ -765,8 +773,10 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) if (q->qdisc) { skb = q->qdisc->ops->dequeue(q->qdisc); - if (skb) + if (skb) { + sch->q.qlen--; goto deliver; + } } return NULL; } -- 2.25.1

2 1

[PATCH OLK-6.6] netfilter: IDLETIMER: Fix for possible ABBA deadlock
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Phil Sutter <phil(a)nwl.cc> stable inclusion from stable-v6.6.67 commit 8c2c8445cda8f59c38dec7dc10509bcb23ae26a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCF5 CVE: CVE-2024-54683 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f36b01994d68ffc253c8296e2228dfe6e6431c03 ] Deletion of the last rule referencing a given idletimer may happen at the same time as a read of its file in sysfs: | ====================================================== | WARNING: possible circular locking dependency detected | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted | ------------------------------------------------------ | iptables/3303 is trying to acquire lock: | ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20 | | but task is already holding lock: | ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v] | | which lock already depends on the new lock. A simple reproducer is: | #!/bin/bash | | while true; do | iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | done & | while true; do | cat /sys/class/xt_idletimer/timers/testme >/dev/null | done Avoid this by freeing list_mutex right after deleting the element from the list, then continuing with the teardown. Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation") Signed-off-by: Phil Sutter <phil(a)nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_IDLETIMER.c | 52 +++++++++++++++++++----------------- 1 file changed, 28 insertions(+), 24 deletions(-) diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c index f8b25b6f5da7..9869ef3c2ab3 100644 --- a/net/netfilter/xt_IDLETIMER.c +++ b/net/netfilter/xt_IDLETIMER.c @@ -409,21 +409,23 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par) mutex_lock(&list_mutex); - if (--info->timer->refcnt == 0) { - pr_debug("deleting timer %s\n", info->label); - - list_del(&info->timer->entry); - timer_shutdown_sync(&info->timer->timer); - cancel_work_sync(&info->timer->work); - sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr); - kfree(info->timer->attr.attr.name); - kfree(info->timer); - } else { + if (--info->timer->refcnt > 0) { pr_debug("decreased refcnt of timer %s to %u\n", info->label, info->timer->refcnt); + mutex_unlock(&list_mutex); + return; } + pr_debug("deleting timer %s\n", info->label); + + list_del(&info->timer->entry); mutex_unlock(&list_mutex); + + timer_shutdown_sync(&info->timer->timer); + cancel_work_sync(&info->timer->work); + sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr); + kfree(info->timer->attr.attr.name); + kfree(info->timer); } static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par) @@ -434,25 +436,27 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par) mutex_lock(&list_mutex); - if (--info->timer->refcnt == 0) { - pr_debug("deleting timer %s\n", info->label); - - list_del(&info->timer->entry); - if (info->timer->timer_type & XT_IDLETIMER_ALARM) { - alarm_cancel(&info->timer->alarm); - } else { - timer_shutdown_sync(&info->timer->timer); - } - cancel_work_sync(&info->timer->work); - sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr); - kfree(info->timer->attr.attr.name); - kfree(info->timer); - } else { + if (--info->timer->refcnt > 0) { pr_debug("decreased refcnt of timer %s to %u\n", info->label, info->timer->refcnt); + mutex_unlock(&list_mutex); + return; } + pr_debug("deleting timer %s\n", info->label); + + list_del(&info->timer->entry); mutex_unlock(&list_mutex); + + if (info->timer->timer_type & XT_IDLETIMER_ALARM) { + alarm_cancel(&info->timer->alarm); + } else { + timer_shutdown_sync(&info->timer->timer); + } + cancel_work_sync(&info->timer->work); + sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr); + kfree(info->timer->attr.attr.name); + kfree(info->timer); } -- 2.25.1

2 1

[PATCH OLK-6.6] netfilter: conntrack: clamp maximum hashtable size to INT_MAX
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.72 commit d5807dd1328bbc86e059c5de80d1bbee9d58ca3d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQN CVE: CVE-2025-21648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 ] Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns. Fixes: 9cc1c73ad666 ("netfilter: conntrack: avoid integer overflow when resizing") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index e4ae2a08da6a..34ad5975fbf3 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -2568,12 +2568,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) struct hlist_nulls_head *hash; unsigned int nr_slots, i; - if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) + if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head))) return NULL; BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); + if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head))) + return NULL; + hash = kvcalloc(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL); if (hash && nulls) -- 2.25.1

2 1

[PATCH OLK-6.6] ipv6: Fix soft lockups in fib6_select_path under high next hop churn
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Omid Ehtemam-Haghighi <omid.ehtemamhaghighi(a)menlosecurity.com> mainline inclusion from mainline-v6.13-rc1 commit d9ccb18f83ea2bb654289b6ecf014fd267cc988b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOT CVE: CVE-2024-56703 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using the `bird` service, these routers continuously update BGP-advertised routes due to frequently changing nexthop destinations, while also managing significant IPv6 traffic. The lockups occur during the traversal of the multipath circular linked-list in the `fib6_select_path` function, particularly while iterating through the siblings in the list. The issue typically arises when the nodes of the linked list are unexpectedly deleted concurrently on a different core—indicated by their 'next' and 'previous' elements pointing back to the node itself and their reference count dropping to zero. This results in an infinite loop, leading to a soft lockup that triggers a system panic via the watchdog timer. Apply RCU primitives in the problematic code sections to resolve the issue. Where necessary, update the references to fib6_siblings to annotate or use the RCU APIs. Include a test script that reproduces the issue. The script periodically updates the routing table while generating a heavy load of outgoing IPv6 traffic through multiple iperf3 clients. It consistently induces infinite soft lockups within a couple of minutes. Kernel log: 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d -- <IRQ stack> -- 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb [exception RIP: fib6_select_path+299] RIP: ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287 RAX: ffff975850b43600 RBX: ffff975850b40200 RCX: 0000000000000000 RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618 RBP: ffffbd13003d3800 R8: 0000000000000000 R9: ffff975850b40200 R10: 0000000000000000 R11: 0000000000000000 R12: ffffbd13003d3830 R13: ffff975850b436a8 R14: ffff975850b43600 R15: 0000000000000007 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c 10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c 11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5 12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47 13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0 14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274 15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474 16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615 17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec 18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3 19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9 20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice] 21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice] 22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice] 23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000 24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581 25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9 26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47 27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30 28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f 29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64 30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb Fixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table") Reported-by: Adrian Oliver <kernel(a)aoliver.ca> Signed-off-by: Omid Ehtemam-Haghighi <omid.ehtemamhaghighi(a)menlosecurity.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Ido Schimmel <idosch(a)idosch.org> Cc: Kuniyuki Iwashima <kuniyu(a)amazon.com> Cc: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20241106010236.1239299-1-omid.ehtemamhaghighi@menl… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/route.c tools/testing/selftests/net/Makefile [commit cd9ebde125bf which not merged lead to conflict] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ip6_fib.c | 8 +- net/ipv6/route.c | 45 ++- tools/testing/selftests/net/Makefile | 1 + .../net/ipv6_route_update_soft_lockup.sh | 262 ++++++++++++++++++ 4 files changed, 297 insertions(+), 19 deletions(-) create mode 100755 tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index afa9073567dc..023ac39041a2 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -1179,8 +1179,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, while (sibling) { if (sibling->fib6_metric == rt->fib6_metric && rt6_qualify_for_ecmp(sibling)) { - list_add_tail(&rt->fib6_siblings, - &sibling->fib6_siblings); + list_add_tail_rcu(&rt->fib6_siblings, + &sibling->fib6_siblings); break; } sibling = rcu_dereference_protected(sibling->fib6_next, @@ -1241,7 +1241,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, fib6_siblings) sibling->fib6_nsiblings--; rt->fib6_nsiblings = 0; - list_del_init(&rt->fib6_siblings); + list_del_rcu(&rt->fib6_siblings); rt6_multipath_rebalance(next_sibling); return err; } @@ -1954,7 +1954,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; rt->fib6_nsiblings = 0; - list_del_init(&rt->fib6_siblings); + list_del_rcu(&rt->fib6_siblings); rt6_multipath_rebalance(next_sibling); } diff --git a/net/ipv6/route.c b/net/ipv6/route.c index fc5c53462025..c5cee40a658b 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -418,8 +418,8 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, struct flowi6 *fl6, int oif, bool have_oif_match, const struct sk_buff *skb, int strict) { - struct fib6_info *sibling, *next_sibling; struct fib6_info *match = res->f6i; + struct fib6_info *sibling; if (!match->nh && (!match->fib6_nsiblings || have_oif_match)) goto out; @@ -445,8 +445,8 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, if (fl6->mp_hash <= atomic_read(&match->fib6_nh->fib_nh_upper_bound)) goto out; - list_for_each_entry_safe(sibling, next_sibling, &match->fib6_siblings, - fib6_siblings) { + list_for_each_entry_rcu(sibling, &match->fib6_siblings, + fib6_siblings) { const struct fib6_nh *nh = sibling->fib6_nh; int nh_upper_bound; @@ -5186,14 +5186,18 @@ static void ip6_route_mpath_notify(struct fib6_info *rt, * nexthop. Since sibling routes are always added at the end of * the list, find the first sibling of the last route appended */ + rcu_read_lock(); + if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) { - rt = list_first_entry(&rt_last->fib6_siblings, - struct fib6_info, - fib6_siblings); + rt = list_first_or_null_rcu(&rt_last->fib6_siblings, + struct fib6_info, + fib6_siblings); } if (rt) inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags); + + rcu_read_unlock(); } static bool ip6_route_mpath_should_notify(const struct fib6_info *rt) @@ -5538,17 +5542,21 @@ static size_t rt6_nlmsg_size(struct fib6_info *f6i) nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size, &nexthop_len); } else { - struct fib6_info *sibling, *next_sibling; struct fib6_nh *nh = f6i->fib6_nh; + struct fib6_info *sibling; nexthop_len = 0; if (f6i->fib6_nsiblings) { rt6_nh_nlmsg_size(nh, &nexthop_len); - list_for_each_entry_safe(sibling, next_sibling, - &f6i->fib6_siblings, fib6_siblings) { + rcu_read_lock(); + + list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, + fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } + + rcu_read_unlock(); } nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); } @@ -5712,7 +5720,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0) goto nla_put_failure; } else if (rt->fib6_nsiblings) { - struct fib6_info *sibling, *next_sibling; + struct fib6_info *sibling; struct nlattr *mp; mp = nla_nest_start_noflag(skb, RTA_MULTIPATH); @@ -5724,14 +5732,21 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, 0) < 0) goto nla_put_failure; - list_for_each_entry_safe(sibling, next_sibling, - &rt->fib6_siblings, fib6_siblings) { + rcu_read_lock(); + + list_for_each_entry_rcu(sibling, &rt->fib6_siblings, + fib6_siblings) { if (fib_add_nexthop(skb, &sibling->fib6_nh->nh_common, sibling->fib6_nh->fib_nh_weight, - AF_INET6, 0) < 0) + AF_INET6, 0) < 0) { + rcu_read_unlock(); + goto nla_put_failure; + } } + rcu_read_unlock(); + nla_nest_end(skb, mp); } else if (rt->nh) { if (nla_put_u32(skb, RTA_NH_ID, rt->nh->id)) @@ -6168,7 +6183,7 @@ void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info, err = -ENOBUFS; seq = info->nlh ? info->nlh->nlmsg_seq : 0; - skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any()); + skb = nlmsg_new(rt6_nlmsg_size(rt), GFP_ATOMIC); if (!skb) goto errout; @@ -6181,7 +6196,7 @@ void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info, goto errout; } rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE, - info->nlh, gfp_any()); + info->nlh, GFP_ATOMIC); return; errout: if (err < 0) diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile index f89dc5cd6111..ebe3f5874af7 100644 --- a/tools/testing/selftests/net/Makefile +++ b/tools/testing/selftests/net/Makefile @@ -53,6 +53,7 @@ TEST_PROGS += bind_bhash.sh TEST_PROGS += ip_local_port_range.sh TEST_PROGS += rps_default_mask.sh TEST_PROGS += big_tcp.sh +TEST_PROGS += ipv6_route_update_soft_lockup.sh TEST_PROGS_EXTENDED := toeplitz_client.sh toeplitz.sh TEST_GEN_FILES = socket nettest TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy reuseport_addr_any diff --git a/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh b/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh new file mode 100755 index 000000000000..a6b2b1f9c641 --- /dev/null +++ b/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh @@ -0,0 +1,262 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0 +# +# Testing for potential kernel soft lockup during IPv6 routing table +# refresh under heavy outgoing IPv6 traffic. If a kernel soft lockup +# occurs, a kernel panic will be triggered to prevent associated issues. +# +# +# Test Environment Layout +# +# ┌----------------┐ ┌----------------┐ +# | SOURCE_NS | | SINK_NS | +# | NAMESPACE | | NAMESPACE | +# |(iperf3 clients)| |(iperf3 servers)| +# | | | | +# | | | | +# | ┌-----------| nexthops |---------┐ | +# | |veth_source|<--------------------------------------->|veth_sink|<┐ | +# | └-----------|2001:0DB8:1::0:1/96 2001:0DB8:1::1:1/96 |---------┘ | | +# | | ^ 2001:0DB8:1::1:2/96 | | | +# | | . . | fwd | | +# | ┌---------┐ | . . | | | +# | | IPv6 | | . . | V | +# | | routing | | . 2001:0DB8:1::1:80/96| ┌-----┐ | +# | | table | | . | | lo | | +# | | nexthop | | . └--------┴-----┴-┘ +# | | update | | ............................> 2001:0DB8:2::1:1/128 +# | └-------- ┘ | +# └----------------┘ +# +# The test script sets up two network namespaces, source_ns and sink_ns, +# connected via a veth link. Within source_ns, it continuously updates the +# IPv6 routing table by flushing and inserting IPV6_NEXTHOP_ADDR_COUNT nexthop +# IPs destined for SINK_LOOPBACK_IP_ADDR in sink_ns. This refresh occurs at a +# rate of 1/ROUTING_TABLE_REFRESH_PERIOD per second for TEST_DURATION seconds. +# +# Simultaneously, multiple iperf3 clients within source_ns generate heavy +# outgoing IPv6 traffic. Each client is assigned a unique port number starting +# at 5000 and incrementing sequentially. Each client targets a unique iperf3 +# server running in sink_ns, connected to the SINK_LOOPBACK_IFACE interface +# using the same port number. +# +# The number of iperf3 servers and clients is set to half of the total +# available cores on each machine. +# +# NOTE: We have tested this script on machines with various CPU specifications, +# ranging from lower to higher performance as listed below. The test script +# effectively triggered a kernel soft lockup on machines running an unpatched +# kernel in under a minute: +# +# - 1x Intel Xeon E-2278G 8-Core Processor @ 3.40GHz +# - 1x Intel Xeon E-2378G Processor 8-Core @ 2.80GHz +# - 1x AMD EPYC 7401P 24-Core Processor @ 2.00GHz +# - 1x AMD EPYC 7402P 24-Core Processor @ 2.80GHz +# - 2x Intel Xeon Gold 5120 14-Core Processor @ 2.20GHz +# - 1x Ampere Altra Q80-30 80-Core Processor @ 3.00GHz +# - 2x Intel Xeon Gold 5120 14-Core Processor @ 2.20GHz +# - 2x Intel Xeon Silver 4214 24-Core Processor @ 2.20GHz +# - 1x AMD EPYC 7502P 32-Core @ 2.50GHz +# - 1x Intel Xeon Gold 6314U 32-Core Processor @ 2.30GHz +# - 2x Intel Xeon Gold 6338 32-Core Processor @ 2.00GHz +# +# On less performant machines, you may need to increase the TEST_DURATION +# parameter to enhance the likelihood of encountering a race condition leading +# to a kernel soft lockup and avoid a false negative result. +# +# NOTE: The test may not produce the expected result in virtualized +# environments (e.g., qemu) due to differences in timing and CPU handling, +# which can affect the conditions needed to trigger a soft lockup. + +source lib.sh +source net_helper.sh + +TEST_DURATION=300 +ROUTING_TABLE_REFRESH_PERIOD=0.01 + +IPERF3_BITRATE="300m" + + +IPV6_NEXTHOP_ADDR_COUNT="128" +IPV6_NEXTHOP_ADDR_MASK="96" +IPV6_NEXTHOP_PREFIX="2001:0DB8:1" + + +SOURCE_TEST_IFACE="veth_source" +SOURCE_TEST_IP_ADDR="2001:0DB8:1::0:1/96" + +SINK_TEST_IFACE="veth_sink" +# ${SINK_TEST_IFACE} is populated with the following range of IPv6 addresses: +# 2001:0DB8:1::1:1 to 2001:0DB8:1::1:${IPV6_NEXTHOP_ADDR_COUNT} +SINK_LOOPBACK_IFACE="lo" +SINK_LOOPBACK_IP_MASK="128" +SINK_LOOPBACK_IP_ADDR="2001:0DB8:2::1:1" + +nexthop_ip_list="" +termination_signal="" +kernel_softlokup_panic_prev_val="" + +terminate_ns_processes_by_pattern() { + local ns=$1 + local pattern=$2 + + for pid in $(ip netns pids ${ns}); do + [ -e /proc/$pid/cmdline ] && grep -qe "${pattern}" /proc/$pid/cmdline && kill -9 $pid + done +} + +cleanup() { + echo "info: cleaning up namespaces and terminating all processes within them..." + + + # Terminate iperf3 instances running in the source_ns. To avoid race + # conditions, first iterate over the PIDs and terminate those + # associated with the bash shells running the + # `while true; do iperf3 -c ...; done` loops. In a second iteration, + # terminate the individual `iperf3 -c ...` instances. + terminate_ns_processes_by_pattern ${source_ns} while + terminate_ns_processes_by_pattern ${source_ns} iperf3 + + # Repeat the same process for sink_ns + terminate_ns_processes_by_pattern ${sink_ns} while + terminate_ns_processes_by_pattern ${sink_ns} iperf3 + + # Check if any iperf3 instances are still running. This could happen + # if a core has entered an infinite loop and the timeout for detecting + # the soft lockup has not expired, but either the test interval has + # already elapsed or the test was terminated manually (e.g., with ^C) + for pid in $(ip netns pids ${source_ns}); do + if [ -e /proc/$pid/cmdline ] && grep -qe 'iperf3' /proc/$pid/cmdline; then + echo "FAIL: unable to terminate some iperf3 instances. Soft lockup is underway. A kernel panic is on the way!" + exit ${ksft_fail} + fi + done + + if [ "$termination_signal" == "SIGINT" ]; then + echo "SKIP: Termination due to ^C (SIGINT)" + elif [ "$termination_signal" == "SIGALRM" ]; then + echo "PASS: No kernel soft lockup occurred during this ${TEST_DURATION} second test" + fi + + cleanup_ns ${source_ns} ${sink_ns} + + sysctl -qw kernel.softlockup_panic=${kernel_softlokup_panic_prev_val} +} + +setup_prepare() { + setup_ns source_ns sink_ns + + ip -n ${source_ns} link add name ${SOURCE_TEST_IFACE} type veth peer name ${SINK_TEST_IFACE} netns ${sink_ns} + + # Setting up the Source namespace + ip -n ${source_ns} addr add ${SOURCE_TEST_IP_ADDR} dev ${SOURCE_TEST_IFACE} + ip -n ${source_ns} link set dev ${SOURCE_TEST_IFACE} qlen 10000 + ip -n ${source_ns} link set dev ${SOURCE_TEST_IFACE} up + ip netns exec ${source_ns} sysctl -qw net.ipv6.fib_multipath_hash_policy=1 + + # Setting up the Sink namespace + ip -n ${sink_ns} addr add ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK} dev ${SINK_LOOPBACK_IFACE} + ip -n ${sink_ns} link set dev ${SINK_LOOPBACK_IFACE} up + ip netns exec ${sink_ns} sysctl -qw net.ipv6.conf.${SINK_LOOPBACK_IFACE}.forwarding=1 + + ip -n ${sink_ns} link set ${SINK_TEST_IFACE} up + ip netns exec ${sink_ns} sysctl -qw net.ipv6.conf.${SINK_TEST_IFACE}.forwarding=1 + + + # Populate nexthop IPv6 addresses on the test interface in the sink_ns + echo "info: populating ${IPV6_NEXTHOP_ADDR_COUNT} IPv6 addresses on the ${SINK_TEST_IFACE} interface ..." + for IP in $(seq 1 ${IPV6_NEXTHOP_ADDR_COUNT}); do + ip -n ${sink_ns} addr add ${IPV6_NEXTHOP_PREFIX}::$(printf "1:%x" "${IP}")/${IPV6_NEXTHOP_ADDR_MASK} dev ${SINK_TEST_IFACE}; + done + + # Preparing list of nexthops + for IP in $(seq 1 ${IPV6_NEXTHOP_ADDR_COUNT}); do + nexthop_ip_list=$nexthop_ip_list" nexthop via ${IPV6_NEXTHOP_PREFIX}::$(printf "1:%x" $IP) dev ${SOURCE_TEST_IFACE} weight 1" + done +} + + +test_soft_lockup_during_routing_table_refresh() { + # Start num_of_iperf_servers iperf3 servers in the sink_ns namespace, + # each listening on ports starting at 5001 and incrementing + # sequentially. Since iperf3 instances may terminate unexpectedly, a + # while loop is used to automatically restart them in such cases. + echo "info: starting ${num_of_iperf_servers} iperf3 servers in the sink_ns namespace ..." + for i in $(seq 1 ${num_of_iperf_servers}); do + cmd="iperf3 --bind ${SINK_LOOPBACK_IP_ADDR} -s -p $(printf '5%03d' ${i}) --rcv-timeout 200 &>/dev/null" + ip netns exec ${sink_ns} bash -c "while true; do ${cmd}; done &" &>/dev/null + done + + # Wait for the iperf3 servers to be ready + for i in $(seq ${num_of_iperf_servers}); do + port=$(printf '5%03d' ${i}); + wait_local_port_listen ${sink_ns} ${port} tcp + done + + # Continuously refresh the routing table in the background within + # the source_ns namespace + ip netns exec ${source_ns} bash -c " + while \$(ip netns list | grep -q ${source_ns}); do + ip -6 route add ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK} ${nexthop_ip_list}; + sleep ${ROUTING_TABLE_REFRESH_PERIOD}; + ip -6 route delete ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK}; + done &" + + # Start num_of_iperf_servers iperf3 clients in the source_ns namespace, + # each sending TCP traffic on sequential ports starting at 5001. + # Since iperf3 instances may terminate unexpectedly (e.g., if the route + # to the server is deleted in the background during a route refresh), a + # while loop is used to automatically restart them in such cases. + echo "info: starting ${num_of_iperf_servers} iperf3 clients in the source_ns namespace ..." + for i in $(seq 1 ${num_of_iperf_servers}); do + cmd="iperf3 -c ${SINK_LOOPBACK_IP_ADDR} -p $(printf '5%03d' ${i}) --length 64 --bitrate ${IPERF3_BITRATE} -t 0 --connect-timeout 150 &>/dev/null" + ip netns exec ${source_ns} bash -c "while true; do ${cmd}; done &" &>/dev/null + done + + echo "info: IPv6 routing table is being updated at the rate of $(echo "1/${ROUTING_TABLE_REFRESH_PERIOD}" | bc)/s for ${TEST_DURATION} seconds ..." + echo "info: A kernel soft lockup, if detected, results in a kernel panic!" + + wait +} + +# Make sure 'iperf3' is installed, skip the test otherwise +if [ ! -x "$(command -v "iperf3")" ]; then + echo "SKIP: 'iperf3' is not installed. Skipping the test." + exit ${ksft_skip} +fi + +# Determine the number of cores on the machine +num_of_iperf_servers=$(( $(nproc)/2 )) + +# Check if we are running on a multi-core machine, skip the test otherwise +if [ "${num_of_iperf_servers}" -eq 0 ]; then + echo "SKIP: This test is not valid on a single core machine!" + exit ${ksft_skip} +fi + +# Since the kernel soft lockup we're testing causes at least one core to enter +# an infinite loop, destabilizing the host and likely affecting subsequent +# tests, we trigger a kernel panic instead of reporting a failure and +# continuing +kernel_softlokup_panic_prev_val=$(sysctl -n kernel.softlockup_panic) +sysctl -qw kernel.softlockup_panic=1 + +handle_sigint() { + termination_signal="SIGINT" + cleanup + exit ${ksft_skip} +} + +handle_sigalrm() { + termination_signal="SIGALRM" + cleanup + exit ${ksft_pass} +} + +trap handle_sigint SIGINT +trap handle_sigalrm SIGALRM + +(sleep ${TEST_DURATION} && kill -s SIGALRM $$)& + +setup_prepare +test_soft_lockup_during_routing_table_refresh -- 2.25.1

2 1

[PATCH OLK-6.6] net/mlx5e: Don't call cleanup on profile rollback failure
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Cosmin Ratiu <cratiu(a)nvidia.com> mainline inclusion from mainline-v6.12-rc4 commit 4dbc1d1a9f39c3711ad2a40addca04d07d9ab5d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SU8 CVE: CVE-2024-50146 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When profile rollback fails in mlx5e_netdev_change_profile, the netdev profile var is left set to NULL. Avoid a crash when unloading the driver by not calling profile->cleanup in such a case. This was encountered while testing, with the original trigger that the wq rescuer thread creation got interrupted (presumably due to Ctrl+C-ing modprobe), which gets converted to ENOMEM (-12) by mlx5e_priv_init, the profile rollback also fails for the same reason (signal still active) so the profile is left as NULL, leading to a crash later in _mlx5e_remove. [ 732.473932] mlx5_core 0000:08:00.1: E-Switch: Unload vfs: mode(OFFLOADS), nvfs(2), necvfs(0), active vports(2) [ 734.525513] workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR [ 734.557372] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12 [ 734.559187] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: new profile init failed, -12 [ 734.560153] workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR [ 734.589378] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12 [ 734.591136] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 [ 745.537492] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 745.538222] #PF: supervisor read access in kernel mode <snipped> [ 745.551290] Call Trace: [ 745.551590] <TASK> [ 745.551866] ? __die+0x20/0x60 [ 745.552218] ? page_fault_oops+0x150/0x400 [ 745.555307] ? exc_page_fault+0x79/0x240 [ 745.555729] ? asm_exc_page_fault+0x22/0x30 [ 745.556166] ? mlx5e_remove+0x6b/0xb0 [mlx5_core] [ 745.556698] auxiliary_bus_remove+0x18/0x30 [ 745.557134] device_release_driver_internal+0x1df/0x240 [ 745.557654] bus_remove_device+0xd7/0x140 [ 745.558075] device_del+0x15b/0x3c0 [ 745.558456] mlx5_rescan_drivers_locked.part.0+0xb1/0x2f0 [mlx5_core] [ 745.559112] mlx5_unregister_device+0x34/0x50 [mlx5_core] [ 745.559686] mlx5_uninit_one+0x46/0xf0 [mlx5_core] [ 745.560203] remove_one+0x4e/0xd0 [mlx5_core] [ 745.560694] pci_device_remove+0x39/0xa0 [ 745.561112] device_release_driver_internal+0x1df/0x240 [ 745.561631] driver_detach+0x47/0x90 [ 745.562022] bus_remove_driver+0x84/0x100 [ 745.562444] pci_unregister_driver+0x3b/0x90 [ 745.562890] mlx5_cleanup+0xc/0x1b [mlx5_core] [ 745.563415] __x64_sys_delete_module+0x14d/0x2f0 [ 745.563886] ? kmem_cache_free+0x1b0/0x460 [ 745.564313] ? lockdep_hardirqs_on_prepare+0xe2/0x190 [ 745.564825] do_syscall_64+0x6d/0x140 [ 745.565223] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 745.565725] RIP: 0033:0x7f1579b1288b Fixes: 3ef14e463f6e ("net/mlx5e: Separate between netdev objects and mlx5e profiles initialization") Signed-off-by: Cosmin Ratiu <cratiu(a)nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c index bb5c41f0e8ba..dc6c62f20dac 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c @@ -6118,7 +6118,9 @@ static void mlx5e_remove(struct auxiliary_device *adev) mlx5e_dcbnl_delete_app(priv); unregister_netdev(priv->netdev); _mlx5e_suspend(adev, false); - priv->profile->cleanup(priv); + /* Avoid cleanup if profile rollback failed. */ + if (priv->profile) + priv->profile->cleanup(priv); mlx5e_destroy_netdev(priv); mlx5e_devlink_port_unregister(mlx5e_dev); mlx5e_destroy_devlink(mlx5e_dev); -- 2.25.1

2 3

[PATCH OLK-6.6] ethtool: fail closed if we can't get max channel used in indirection tables
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.11-rc1 commit 2899d58462ba868287d6ff3acad3675e7adf934f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUATO CVE: CVE-2024-46834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change. Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Link: https://patch.msgid.link/20240710174043.754664-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ethtool/common.c [commit fb6e30a72539 pass a pointer to parameters to ethtool_get_max_rxfh_channel(), which not merged lead to conflict.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ethtool/channels.c | 6 ++---- net/ethtool/common.c | 26 +++++++++++++++----------- net/ethtool/common.h | 2 +- net/ethtool/ioctl.c | 4 +--- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/net/ethtool/channels.c b/net/ethtool/channels.c index 7b4bbd674bae..cee188da54f8 100644 --- a/net/ethtool/channels.c +++ b/net/ethtool/channels.c @@ -171,11 +171,9 @@ ethnl_set_channels(struct ethnl_req_info *req_info, struct genl_info *info) */ if (ethtool_get_max_rxnfc_channel(dev, &max_rxnfc_in_use)) max_rxnfc_in_use = 0; - if (!netif_is_rxfh_configured(dev) || - ethtool_get_max_rxfh_channel(dev, &max_rxfh_in_use)) - max_rxfh_in_use = 0; + max_rxfh_in_use = ethtool_get_max_rxfh_channel(dev); if (channels.combined_count + channels.rx_count <= max_rxfh_in_use) { - GENL_SET_ERR_MSG(info, "requested channel counts are too low for existing indirection table settings"); + GENL_SET_ERR_MSG_FMT(info, "requested channel counts are too low for existing indirection table (%d)", max_rxfh_in_use); return -EINVAL; } if (channels.combined_count + channels.rx_count <= max_rxnfc_in_use) { diff --git a/net/ethtool/common.c b/net/ethtool/common.c index f5598c5f50de..450354315291 100644 --- a/net/ethtool/common.c +++ b/net/ethtool/common.c @@ -587,35 +587,39 @@ int ethtool_get_max_rxnfc_channel(struct net_device *dev, u64 *max) return err; } -int ethtool_get_max_rxfh_channel(struct net_device *dev, u32 *max) +u32 ethtool_get_max_rxfh_channel(struct net_device *dev) { - u32 dev_size, current_max = 0; + u32 dev_size, current_max; u32 *indir; int ret; + if (!netif_is_rxfh_configured(dev)) + return 0; + if (!dev->ethtool_ops->get_rxfh_indir_size || !dev->ethtool_ops->get_rxfh) - return -EOPNOTSUPP; + return 0; dev_size = dev->ethtool_ops->get_rxfh_indir_size(dev); if (dev_size == 0) - return -EOPNOTSUPP; + return 0; indir = kcalloc(dev_size, sizeof(indir[0]), GFP_USER); if (!indir) - return -ENOMEM; + return U32_MAX; ret = dev->ethtool_ops->get_rxfh(dev, indir, NULL, NULL); - if (ret) - goto out; + if (ret) { + current_max = U32_MAX; + goto out_free; + } + current_max = 0; while (dev_size--) current_max = max(current_max, indir[dev_size]); - *max = current_max; - -out: +out_free: kfree(indir); - return ret; + return current_max; } int ethtool_check_ops(const struct ethtool_ops *ops) diff --git a/net/ethtool/common.h b/net/ethtool/common.h index 28b8aaaf9bcb..b55705a9ad5a 100644 --- a/net/ethtool/common.h +++ b/net/ethtool/common.h @@ -42,7 +42,7 @@ int __ethtool_get_link(struct net_device *dev); bool convert_legacy_settings_to_link_ksettings( struct ethtool_link_ksettings *link_ksettings, const struct ethtool_cmd *legacy_settings); -int ethtool_get_max_rxfh_channel(struct net_device *dev, u32 *max); +u32 ethtool_get_max_rxfh_channel(struct net_device *dev); int ethtool_get_max_rxnfc_channel(struct net_device *dev, u64 *max); int __ethtool_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info); diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 4486cbe2faf0..7bf015fad447 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -1847,9 +1847,7 @@ static noinline_for_stack int ethtool_set_channels(struct net_device *dev, * indirection table/rxnfc settings */ if (ethtool_get_max_rxnfc_channel(dev, &max_rxnfc_in_use)) max_rxnfc_in_use = 0; - if (!netif_is_rxfh_configured(dev) || - ethtool_get_max_rxfh_channel(dev, &max_rxfh_in_use)) - max_rxfh_in_use = 0; + max_rxfh_in_use = ethtool_get_max_rxfh_channel(dev); if (channels.combined_count + channels.rx_count <= max_t(u64, max_rxnfc_in_use, max_rxfh_in_use)) return -EINVAL; -- 2.25.1

2 3

[PATCH OLK-6.6 v2 0/2] net: Fix CVE-2024-56658
by Dong Chenchen 15 Feb '25

15 Feb '25

Fix CVE-2024-56658 Dong Chenchen (1): net: Fix kabi breakage in struct net Eric Dumazet (1): net: defer final 'struct net' free in netns dismantle include/net/net_namespace.h | 1 + net/core/net_namespace.c | 20 +++++++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-5.10] ila: serialize calls to nf_register_net_hooks()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.233 commit d3017895e393536b234cf80a83fc463c08a28137 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID33 CVE: CVE-2024-57900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 260466b576bca0081a7d4acecc8e93687aa22d0e ] syzbot found a race in ila_add_mapping() [1] commit 031ae72825ce ("ila: call nf_unregister_net_hooks() sooner") attempted to fix a similar issue. Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands. Add a mutex to make sure at most one thread is calling nf_register_net_hooks(). [1] BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 Read of size 4 at addr ffff888028f40008 by task dhcpcd/5501 CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269 NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 process_backlog+0x443/0x15f0 net/core/dev.c:6117 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0xa94/0x1010 net/core/dev.c:7074 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") Reported-by: syzbot+47e761d22ecf745f72b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6772c9ae.050a0220.2f3838.04c7.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Florian Westphal <fw(a)strlen.de> Cc: Tom Herbert <tom(a)herbertland.com> Link: https://patch.msgid.link/20241230162849.2795486-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ila/ila_xlat.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c index 2e7a36a1ea0a..8483116dfa23 100644 --- a/net/ipv6/ila/ila_xlat.c +++ b/net/ipv6/ila/ila_xlat.c @@ -201,6 +201,8 @@ static const struct nf_hook_ops ila_nf_hook_ops[] = { }, }; +static DEFINE_MUTEX(ila_mutex); + static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) { struct ila_net *ilan = net_generic(net, ila_net_id); @@ -208,16 +210,20 @@ static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) spinlock_t *lock = ila_get_lock(ilan, xp->ip.locator_match); int err = 0, order; - if (!ilan->xlat.hooks_registered) { + if (!READ_ONCE(ilan->xlat.hooks_registered)) { /* We defer registering net hooks in the namespace until the * first mapping is added. */ - err = nf_register_net_hooks(net, ila_nf_hook_ops, - ARRAY_SIZE(ila_nf_hook_ops)); + mutex_lock(&ila_mutex); + if (!ilan->xlat.hooks_registered) { + err = nf_register_net_hooks(net, ila_nf_hook_ops, + ARRAY_SIZE(ila_nf_hook_ops)); + if (!err) + WRITE_ONCE(ilan->xlat.hooks_registered, true); + } + mutex_unlock(&ila_mutex); if (err) return err; - - ilan->xlat.hooks_registered = true; } ila = kzalloc(sizeof(*ila), GFP_KERNEL); -- 2.25.1

2 1

[PATCH OLK-5.10] sched: sch_cake: add bounds checks to host bulk flow fairness counts
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Toke Høiland-Jørgensen <toke(a)redhat.com> mainline inclusion from mainline-v6.13-rc7 commit 737d4d91d35b5f7fa5bb442651472277318b0bfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQOT CVE: CVE-2025-21647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error). As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour. Fixes: 546ea84d07e3 ("sched: sch_cake: fix bulk flow accounting logic for host fairness") Reported-by: syzbot+f63600d288bfb7057424(a)syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Acked-by: Dave Taht <dave.taht(a)gmail.com> Link: https://patch.msgid.link/20250107120105.70685-1-toke@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_cake.c [commit 7e3cf0843fe5 use get_random_{u8,u16}() in cake_dequeue, which not merged lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_cake.c | 140 +++++++++++++++++++++++-------------------- 1 file changed, 75 insertions(+), 65 deletions(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index 4ddb43a6644a..e0030c16143f 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -643,6 +643,63 @@ static bool cake_ddst(int flow_mode) return (flow_mode & CAKE_FLOW_DUAL_DST) == CAKE_FLOW_DUAL_DST; } +static void cake_dec_srchost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_dsrc(flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count)) + q->hosts[flow->srchost].srchost_bulk_flow_count--; +} + +static void cake_inc_srchost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_dsrc(flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count < CAKE_QUEUES)) + q->hosts[flow->srchost].srchost_bulk_flow_count++; +} + +static void cake_dec_dsthost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_ddst(flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count--; +} + +static void cake_inc_dsthost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_ddst(flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count < CAKE_QUEUES)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count++; +} + +static u16 cake_get_flow_quantum(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + u16 host_load = 1; + + if (cake_dsrc(flow_mode)) + host_load = max(host_load, + q->hosts[flow->srchost].srchost_bulk_flow_count); + + if (cake_ddst(flow_mode)) + host_load = max(host_load, + q->hosts[flow->dsthost].dsthost_bulk_flow_count); + + /* The get_random_u16() is a way to apply dithering to avoid + * accumulating roundoff errors + */ + return (q->flow_quantum * quantum_div[host_load] + + (prandom_u32() >> 16)) >> 16; +} + static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, int flow_mode, u16 flow_override, u16 host_override) { @@ -789,10 +846,8 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, allocate_dst = cake_ddst(flow_mode); if (q->flows[outer_hash + k].set == CAKE_SET_BULK) { - if (allocate_src) - q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; - if (allocate_dst) - q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; + cake_dec_srchost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); + cake_dec_dsthost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); } found: /* reserve queue for future packets in same flow */ @@ -817,9 +872,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].srchost_tag = srchost_hash; found_src: srchost_idx = outer_hash + k; - if (q->flows[reduced_hash].set == CAKE_SET_BULK) - q->hosts[srchost_idx].srchost_bulk_flow_count++; q->flows[reduced_hash].srchost = srchost_idx; + + if (q->flows[reduced_hash].set == CAKE_SET_BULK) + cake_inc_srchost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); } if (allocate_dst) { @@ -840,9 +896,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].dsthost_tag = dsthost_hash; found_dst: dsthost_idx = outer_hash + k; - if (q->flows[reduced_hash].set == CAKE_SET_BULK) - q->hosts[dsthost_idx].dsthost_bulk_flow_count++; q->flows[reduced_hash].dsthost = dsthost_idx; + + if (q->flows[reduced_hash].set == CAKE_SET_BULK) + cake_inc_dsthost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); } } @@ -1855,10 +1912,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* flowchain */ if (!flow->set || flow->set == CAKE_SET_DECAYING) { - struct cake_host *srchost = &b->hosts[flow->srchost]; - struct cake_host *dsthost = &b->hosts[flow->dsthost]; - u16 host_load = 1; - if (!flow->set) { list_add_tail(&flow->flowchain, &b->new_flows); } else { @@ -1868,18 +1921,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, flow->set = CAKE_SET_SPARSE; b->sparse_flow_count++; - if (cake_dsrc(q->flow_mode)) - host_load = max(host_load, srchost->srchost_bulk_flow_count); - - if (cake_ddst(q->flow_mode)) - host_load = max(host_load, dsthost->dsthost_bulk_flow_count); - - flow->deficit = (b->flow_quantum * - quantum_div[host_load]) >> 16; + flow->deficit = cake_get_flow_quantum(b, flow, q->flow_mode); } else if (flow->set == CAKE_SET_SPARSE_WAIT) { - struct cake_host *srchost = &b->hosts[flow->srchost]; - struct cake_host *dsthost = &b->hosts[flow->dsthost]; - /* this flow was empty, accounted as a sparse flow, but actually * in the bulk rotation. */ @@ -1887,12 +1930,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, b->sparse_flow_count--; b->bulk_flow_count++; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count++; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; - + cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); } if (q->buffer_used > q->buffer_max_used) @@ -1949,13 +1988,11 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) { struct cake_sched_data *q = qdisc_priv(sch); struct cake_tin_data *b = &q->tins[q->cur_tin]; - struct cake_host *srchost, *dsthost; ktime_t now = ktime_get(); struct cake_flow *flow; struct list_head *head; bool first_flow = true; struct sk_buff *skb; - u16 host_load; u64 delay; u32 len; @@ -2055,11 +2092,6 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) q->cur_flow = flow - b->flows; first_flow = false; - /* triple isolation (modified DRR++) */ - srchost = &b->hosts[flow->srchost]; - dsthost = &b->hosts[flow->dsthost]; - host_load = 1; - /* flow isolation (DRR++) */ if (flow->deficit <= 0) { /* Keep all flows with deficits out of the sparse and decaying @@ -2071,11 +2103,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) b->sparse_flow_count--; b->bulk_flow_count++; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count++; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; + cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); flow->set = CAKE_SET_BULK; } else { @@ -2087,19 +2116,7 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) } } - if (cake_dsrc(q->flow_mode)) - host_load = max(host_load, srchost->srchost_bulk_flow_count); - - if (cake_ddst(q->flow_mode)) - host_load = max(host_load, dsthost->dsthost_bulk_flow_count); - - WARN_ON(host_load > CAKE_QUEUES); - - /* The shifted prandom_u32() is a way to apply dithering to - * avoid accumulating roundoff errors - */ - flow->deficit += (b->flow_quantum * quantum_div[host_load] + - (prandom_u32() >> 16)) >> 16; + flow->deficit += cake_get_flow_quantum(b, flow, q->flow_mode); list_move_tail(&flow->flowchain, &b->old_flows); goto retry; @@ -2123,11 +2140,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) if (flow->set == CAKE_SET_BULK) { b->bulk_flow_count--; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count--; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; + cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); b->decaying_flow_count++; } else if (flow->set == CAKE_SET_SPARSE || @@ -2145,12 +2159,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) else if (flow->set == CAKE_SET_BULK) { b->bulk_flow_count--; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count--; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; - + cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); } else b->decaying_flow_count--; -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: conntrack: clamp maximum hashtable size to INT_MAX
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.13-rc7 commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQN CVE: CVE-2025-21648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns. Fixes: 9cc1c73ad666 ("netfilter: conntrack: avoid integer overflow when resizing") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index f2634cda262c..9090d677ddfa 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -2435,12 +2435,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) struct hlist_nulls_head *hash; unsigned int nr_slots, i; - if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) + if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head))) return NULL; BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); + if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head))) + return NULL; + hash = kvcalloc(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL); if (hash && nulls) -- 2.25.1

2 1

[PATCH OLK-5.10] net: inet6: do not leave a dangling sk pointer in inet6_create()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit 35360255ca30776dee34d9fa764cffa24d0a5f65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPG CVE: CVE-2024-56600 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9df99c395d0f55fb444ef39f4d6f194ca437d884 ] sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear the sock sk pointer on error. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-8-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/af_inet6.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index 3bd7e3a04229..bf23dbbf7536 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -259,31 +259,29 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, */ inet->inet_sport = htons(inet->inet_num); err = sk->sk_prot->hash(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (sk->sk_prot->init) { err = sk->sk_prot->init(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (!kern) { err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } out: return err; out_rcu_unlock: rcu_read_unlock(); goto out; +out_sk_release: + sk_common_release(sk); + sock->sk = NULL; + goto out; } static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len, -- 2.25.1

2 1

[PATCH OLK-5.10] net: inet: do not leave a dangling sk pointer in inet_create()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit 2bc34d8c8898ae9fddf4612501aabb22d76c2b2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPL CVE: CVE-2024-56601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff ] sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-7-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/af_inet.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index f8aba75192a7..c6ec22f314c4 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -373,32 +373,30 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, inet->inet_sport = htons(inet->inet_num); /* Add to protocol hash chains. */ err = sk->sk_prot->hash(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (sk->sk_prot->init) { err = sk->sk_prot->init(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (!kern) { err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } out: return err; out_rcu_unlock: rcu_read_unlock(); goto out; +out_sk_release: + sk_common_release(sk); + sock->sk = NULL; + goto out; } -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: x_tables: fix LED ID check in led_tg_check()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v5.10.231 commit ad28612ebae1fcc1104bd432e99e99d87f6bfe09 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO6 CVE: CVE-2024-56650 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7 ] Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 print_report+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_report+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? netlink_deliver_tap+0x2e/0x1b0 netlink_unicast+0x7f8/0x990 ? __pfx_netlink_unicast+0x10/0x10 ? __virt_addr_valid+0x183/0x530 ? __check_object_size+0x48e/0x900 netlink_sendmsg+0x8e4/0xcb0 ? __pfx_netlink_sendmsg+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? __pfx_____sys_sendmsg+0x10/0x10 __sys_sendmsg+0x292/0x380 ? __pfx___sys_sendmsg+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? exc_page_fault+0x590/0x8c0 ? do_syscall_64+0xb6/0x230 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> Since an invalid (without '\0' byte at all) byte sequence may be passed from userspace, add an extra check to ensure that such a sequence is rejected as possible ID and so never passed to 'kstrdup()' and further. Reported-by: syzbot+6c8215822f35fdb35667(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c8215822f35fdb35667 Fixes: 268cb38e1802 ("netfilter: x_tables: add LED trigger target") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_LED.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c index 0371c387b0d1..13a2b5820b34 100644 --- a/net/netfilter/xt_LED.c +++ b/net/netfilter/xt_LED.c @@ -97,7 +97,9 @@ static int led_tg_check(const struct xt_tgchk_param *par) struct xt_led_info_internal *ledinternal; int err; - if (ledinfo->id[0] == '\0') + /* Bail out if empty string or not a string at all. */ + if (ledinfo->id[0] == '\0' || + !memchr(ledinfo->id, '\0', sizeof(ledinfo->id))) return -EINVAL; mutex_lock(&xt_led_mutex); -- 2.25.1

2 3

[PATCH OLK-5.10] wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jeongjun Park <aha310510(a)gmail.com> stable inclusion from stable-v5.10.231 commit c941af142200d975dd3be632aeb490f4cb91dae4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGJ CVE: CVE-2024-53156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8619593634cbdf5abf43f5714df49b04e4ef09ab ] I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ... Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240909103855.68006-1-aha310510@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index 99667aba289d..00dc97ac53b9 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -294,6 +294,9 @@ int htc_connect_service(struct htc_target *target, return -ETIMEDOUT; } + if (target->conn_rsp_epid < 0 || target->conn_rsp_epid >= ENDPOINT_MAX) + return -EINVAL; + *conn_rsp_epid = target->conn_rsp_epid; return 0; err: -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: ipset: add missing range check in bitmap_ip_uadt
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit 35f56c554eb1b56b77b3cf197a6b00922d49033d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB9NOX CVE: CVE-2024-53141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks. Cc: <stable(a)vger.kernel.org> Reported-by: syzbot+58c872f7790a4d2ac951(a)syzkaller.appspotmail.com Fixes: 72205fc68bd1 ("netfilter: ipset: bitmap:ip set type support") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Acked-by: Jozsef Kadlecsik <kadlec(a)blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_bitmap_ip.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c index e4fa00abde6a..5988b9bb9029 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ip.c +++ b/net/netfilter/ipset/ip_set_bitmap_ip.c @@ -163,11 +163,8 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[], ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to); if (ret) return ret; - if (ip > ip_to) { + if (ip > ip_to) swap(ip, ip_to); - if (ip < map->first_ip) - return -IPSET_ERR_BITMAP_RANGE; - } } else if (tb[IPSET_ATTR_CIDR]) { u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); @@ -178,7 +175,7 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[], ip_to = ip; } - if (ip_to > map->last_ip) + if (ip < map->first_ip || ip_to > map->last_ip) return -IPSET_ERR_BITMAP_RANGE; for (; !before(ip_to, ip); ip += map->hosts) { -- 2.25.1

2 5

[PATCH OLK-5.10] net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Pedro Tammela <pctammela(a)mojatatu.com> stable inclusion from stable-v5.10.229 commit ce691c814bc7a3c30c220ffb5b7422715458fd9b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KR7 CVE: CVE-2024-53057 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e95c4384438adeaa772caa560244b1a2efef816 ] In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. Fixes: 066a3b5b2346 ("[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Suggested-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Tested-by: Victor Nogueira <victor(a)mojatatu.com> Signed-off-by: Pedro Tammela <pctammela(a)mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20241024165547.418570-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index efd109652f22..0b809dfb0e43 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -781,7 +781,7 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) drops = max_t(int, n, 0); rcu_read_lock(); while ((parentid = sch->parent)) { - if (TC_H_MAJ(parentid) == TC_H_MAJ(TC_H_INGRESS)) + if (parentid == TC_H_ROOT) break; if (sch->flags & TCQ_F_NOPARENT) -- 2.25.1

2 5

[PATCH OLK-5.10 0/2] net: Fix CVE-2024-50125
by Dong Chenchen 15 Feb '25

15 Feb '25

Fix CVE-2024-50125 Desmond Cheong Zhi Xi (1): Bluetooth: call sock_hold earlier in sco_conn_del Luiz Augusto von Dentz (1): Bluetooth: SCO: Fix UAF on sco_sock_timeout include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 22 ++++++++++++++++++++++ net/bluetooth/sco.c | 17 ++++++++++++----- 3 files changed, 35 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] ila: call nf_unregister_net_hooks() sooner
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.226 commit 93ee345ba349922834e6a9d1dadabaedcc12dce6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWHA CVE: CVE-2024-46782 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 031ae72825cef43e4650140b800ad58bf7a6a466 upstream. syzbot found an use-after-free Read in ila_nf_input [1] Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hooks(). It should be done in the reverse way, with a synchronize_rcu(). This is a good match for a pre_exit() method. [1] BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16 CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup include/linux/rhashtable.h:604 [inline] rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775 process_backlog+0x662/0x15b0 net/core/dev.c:6108 __napi_poll+0xcb/0x490 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:6963 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xbfffffff(buddy) raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000 raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493 prep_new_page mm/page_alloc.c:1501 [inline] get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] ___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103 __kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130 __do_kmalloc_node mm/slub.c:4146 [inline] __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164 __kvmalloc_node_noprof+0x72/0x190 mm/util.c:650 bucket_table_alloc lib/rhashtable.c:186 [inline] rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071 ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613 ops_init+0x359/0x610 net/core/net_namespace.c:139 setup_net+0x515/0xca0 net/core/net_namespace.c:343 copy_net_ns+0x4e2/0x7b0 net/core/net_namespace.c:508 create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228 ksys_unshare+0x619/0xc10 kernel/fork.c:3328 __do_sys_unshare kernel/fork.c:3399 [inline] __se_sys_unshare kernel/fork.c:3397 [inline] __x64_sys_unshare+0x38/0x40 kernel/fork.c:3397 page last free pid 11846 tgid 11846 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1094 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2612 __folio_put+0x2c8/0x440 mm/swap.c:128 folio_put include/linux/mm.h:1486 [inline] free_large_kmalloc+0x105/0x1c0 mm/slub.c:4565 kfree+0x1c4/0x360 mm/slub.c:4588 rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169 ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff88806461ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88806461ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888064620000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888064620080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888064620100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Tom Herbert <tom(a)herbertland.com> Reviewed-by: Florian Westphal <fw(a)strlen.de> Link: https://patch.msgid.link/20240904144418.1162839-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ila/ila.h | 1 + net/ipv6/ila/ila_main.c | 6 ++++++ net/ipv6/ila/ila_xlat.c | 13 +++++++++---- 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/net/ipv6/ila/ila.h b/net/ipv6/ila/ila.h index ad5f6f6ba333..85b92917849b 100644 --- a/net/ipv6/ila/ila.h +++ b/net/ipv6/ila/ila.h @@ -108,6 +108,7 @@ int ila_lwt_init(void); void ila_lwt_fini(void); int ila_xlat_init_net(struct net *net); +void ila_xlat_pre_exit_net(struct net *net); void ila_xlat_exit_net(struct net *net); int ila_xlat_nl_cmd_add_mapping(struct sk_buff *skb, struct genl_info *info); diff --git a/net/ipv6/ila/ila_main.c b/net/ipv6/ila/ila_main.c index 36c58aa257e8..a5b0365c5e48 100644 --- a/net/ipv6/ila/ila_main.c +++ b/net/ipv6/ila/ila_main.c @@ -71,6 +71,11 @@ static __net_init int ila_init_net(struct net *net) return err; } +static __net_exit void ila_pre_exit_net(struct net *net) +{ + ila_xlat_pre_exit_net(net); +} + static __net_exit void ila_exit_net(struct net *net) { ila_xlat_exit_net(net); @@ -78,6 +83,7 @@ static __net_exit void ila_exit_net(struct net *net) static struct pernet_operations ila_net_ops = { .init = ila_init_net, + .pre_exit = ila_pre_exit_net, .exit = ila_exit_net, .id = &ila_net_id, .size = sizeof(struct ila_net), diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c index bee45dfeb187..2e7a36a1ea0a 100644 --- a/net/ipv6/ila/ila_xlat.c +++ b/net/ipv6/ila/ila_xlat.c @@ -620,6 +620,15 @@ int ila_xlat_init_net(struct net *net) return 0; } +void ila_xlat_pre_exit_net(struct net *net) +{ + struct ila_net *ilan = net_generic(net, ila_net_id); + + if (ilan->xlat.hooks_registered) + nf_unregister_net_hooks(net, ila_nf_hook_ops, + ARRAY_SIZE(ila_nf_hook_ops)); +} + void ila_xlat_exit_net(struct net *net) { struct ila_net *ilan = net_generic(net, ila_net_id); @@ -627,10 +636,6 @@ void ila_xlat_exit_net(struct net *net) rhashtable_free_and_destroy(&ilan->xlat.rhash_table, ila_free_cb, NULL); free_bucket_spinlocks(ilan->xlat.locks); - - if (ilan->xlat.hooks_registered) - nf_unregister_net_hooks(net, ila_nf_hook_ops, - ARRAY_SIZE(ila_nf_hook_ops)); } static int ila_xlat_addr(struct sk_buff *skb, bool sir2ila) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 15 Feb '25

15 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6a6cc2b6b95dc80ae01221670e21a8059229a023 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250215/202502152003.YgfLX405-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502152003.YgfLX405-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1926/1926] mm/memcontrol.c:3147:6: warning: no previous prototype for function 'hisi_oom_recover'
by kernel test robot 15 Feb '25

15 Feb '25

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 56197cf035ddc0d25f6d27169455448133fd75dd commit: b498d9f1bacd40d583c0970cab02ad522127a7e7 [1926/1926] arm64/ascend: Add new enable_oom_killer interface for oom contrl config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250215/202502151053.A5sFfyJm-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250215/202502151053.A5sFfyJm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502151053.A5sFfyJm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memcontrol.c:3147:6: warning: no previous prototype for function 'hisi_oom_recover' [-Wmissing-prototypes] 3147 | void hisi_oom_recover(struct obj_cgroup *objcg) | ^ mm/memcontrol.c:3147:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3147 | void hisi_oom_recover(struct obj_cgroup *objcg) | ^ | static 1 warning generated. vim +/hisi_oom_recover +3147 mm/memcontrol.c 3145 3146 #ifdef CONFIG_ASCEND_OOM > 3147 void hisi_oom_recover(struct obj_cgroup *objcg) 3148 { 3149 struct mem_cgroup *memcg; 3150 3151 memcg = get_mem_cgroup_from_objcg(objcg); 3152 if (!mem_cgroup_is_root(memcg)) 3153 memcg_oom_recover(memcg); 3154 css_put(&memcg->css); 3155 } 3156 #else 3157 static inline void hisi_oom_recover(struct obj_cgroup *objcg) { } 3158 #endif 3159 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0