- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] nvme-rdma: unquiesce admin_q before destroy it
by Yu Kuai 06 Feb '25

06 Feb '25

From: "Chunguang.xu" <chunguang.xu(a)shopee.com> mainline inclusion from mainline-v6.13-rc2 commit 5858b687559809f05393af745cbadf06dee61295 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLET CVE: CVE-2024-49569 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15 #1 [ff61d23de260fc08] schedule at ffffffff8323c014 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006 #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362 #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25 RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574 RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004 R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500 ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b This due to we have quiesced admi_q before cancel requests, but forgot to unquiesce before destroy it, as a result we fail to drain the pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and simplify the code. Fixes: 958dc1d32c80 ("nvme-rdma: add clean action for failed reconnection") Reported-by: Yingfu.zhou <yingfu.zhou(a)shopee.com> Signed-off-by: Chunguang.xu <chunguang.xu(a)shopee.com> Signed-off-by: Yue.zhao <yue.zhao(a)shopee.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/rdma.c [Lots of patches change context] Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/nvme/host/rdma.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index e7d5385ebc0b..1e6aa0731719 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -1167,11 +1167,7 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) nvme_rdma_destroy_io_queues(ctrl, new); } destroy_admin: - nvme_stop_admin_queue(&ctrl->ctrl); - blk_sync_queue(ctrl->ctrl.admin_q); - nvme_rdma_stop_queue(&ctrl->queues[0]); - nvme_cancel_admin_tagset(&ctrl->ctrl); - nvme_rdma_destroy_admin_queue(ctrl, new); + nvme_rdma_teardown_admin_queue(ctrl, new); return ret; } -- 2.39.2

2 1

[PATCH OLK-6.6] i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
by Yu Kuai 06 Feb '25

06 Feb '25

From: Jarkko Nikula <jarkko.nikula(a)linux.intel.com> stable inclusion from stable-v6.6.66 commit a6dc4b4fda2e147e557050eaae51ff15edeb680b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLEV CVE: CVE-2024-45828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6ca2738174e4ee44edb2ab2d86ce74f015a0cc32 ] Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when the ring is being stopped. Depending on timing between ring stop request completion, interrupt handler removal and code execution this may lead to a NULL pointer dereference in hci_dma_irq_handler() if it gets to run after the io_data pointer is set to NULL in hci_dma_cleanup(). Prevent this my masking the ring interrupts before ring stop request. Signed-off-by: Jarkko Nikula <jarkko.nikula(a)linux.intel.com> Link: https://lore.kernel.org/r/20240920144432.62370-2-jarkko.nikula@linux.intel.… Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i3c/master/mipi-i3c-hci/dma.c b/drivers/i3c/master/mipi-i3c-hci/dma.c index edc3a69bfe31..bcc0c7d4131f 100644 --- a/drivers/i3c/master/mipi-i3c-hci/dma.c +++ b/drivers/i3c/master/mipi-i3c-hci/dma.c @@ -174,10 +174,10 @@ static void hci_dma_cleanup(struct i3c_hci *hci) for (i = 0; i < rings->total; i++) { rh = &rings->headers[i]; + rh_reg_write(INTR_SIGNAL_ENABLE, 0); rh_reg_write(RING_CONTROL, 0); rh_reg_write(CR_SETUP, 0); rh_reg_write(IBI_SETUP, 0); - rh_reg_write(INTR_SIGNAL_ENABLE, 0); if (rh->xfer) dma_free_coherent(&hci->master.dev, -- 2.39.2

2 1

[PATCH OLK-6.6] nvme-rdma: unquiesce admin_q before destroy it
by Yu Kuai 06 Feb '25

06 Feb '25

From: "Chunguang.xu" <chunguang.xu(a)shopee.com> mainline inclusion from mainline-v6.13-rc2 commit 5858b687559809f05393af745cbadf06dee61295 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLET CVE: CVE-2024-49569 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15 #1 [ff61d23de260fc08] schedule at ffffffff8323c014 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006 #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362 #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25 RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574 RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004 R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500 ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b This due to we have quiesced admi_q before cancel requests, but forgot to unquiesce before destroy it, as a result we fail to drain the pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and simplify the code. Fixes: 958dc1d32c80 ("nvme-rdma: add clean action for failed reconnection") Reported-by: Yingfu.zhou <yingfu.zhou(a)shopee.com> Signed-off-by: Chunguang.xu <chunguang.xu(a)shopee.com> Signed-off-by: Yue.zhao <yue.zhao(a)shopee.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Hannes Reinecke <hare(a)suse.de> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/rdma.c [commit 3af755a46881 ("nvme: move nvme_stop_keep_alive() back to original position") is not backported.] Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> --- drivers/nvme/host/rdma.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index c04317a966b3..055b95d2ce93 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -1083,13 +1083,7 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new) nvme_rdma_free_io_queues(ctrl); } destroy_admin: - nvme_quiesce_admin_queue(&ctrl->ctrl); - blk_sync_queue(ctrl->ctrl.admin_q); - nvme_rdma_stop_queue(&ctrl->queues[0]); - nvme_cancel_admin_tagset(&ctrl->ctrl); - if (new) - nvme_remove_admin_tag_set(&ctrl->ctrl); - nvme_rdma_destroy_admin_queue(ctrl); + nvme_rdma_teardown_admin_queue(ctrl, new); return ret; } -- 2.39.2

2 1

[PATCH OLK-6.6] iio: adc: at91: call input_free_device() on allocated iio_dev
by Wupeng Ma 06 Feb '25

06 Feb '25

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v6.6.72 commit 09e067e3c83e0695d338e8a26916e3c2bc44be02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQWA CVE: CVE-2024-57904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit de6a73bad1743e9e81ea5a24c178c67429ff510b upstream. Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached before the allocated iio_dev is stored to st->ts_input. Thus call input_free_device() on input instead of st->ts_input. Fixes: 84882b060301 ("iio: adc: at91_adc: Add support for touchscreens without TSMR") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Link: https://patch.msgid.link/20241207043045.1255409-1-joe@pf.is.s.u-tokyo.ac.jp Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- drivers/iio/adc/at91_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c index de6650f9c4b1c..55f0c1afe505e 100644 --- a/drivers/iio/adc/at91_adc.c +++ b/drivers/iio/adc/at91_adc.c @@ -984,7 +984,7 @@ static int at91_ts_register(struct iio_dev *idev, return ret; err: - input_free_device(st->ts_input); + input_free_device(input); return ret; } -- 2.43.0

2 1

[openeuler:OLK-6.6] BUILD REGRESSION ab9846a05b4f9f25dc949268252f3a898041dd7d
by kernel test robot 06 Feb '25

06 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: ab9846a05b4f9f25dc949268252f3a898041dd7d !14952 drm/mediatek: Set private->all_drm_private[i Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-004-20250205 | |-- drivers-cpufreq-cppc_cpufreq.c:error:invalid-use-of-undefined-type-struct-fb_ctr_pair | |-- drivers-cpufreq-cppc_cpufreq.c:error:storage-size-of-fb_ctrs-isn-t-known | |-- drivers-cpufreq-cppc_cpufreq.c:error:struct-fb_ctr_pair-has-no-member-named-cpu | |-- drivers-cpufreq-cppc_cpufreq.c:error:variable-fb_ctrs-has-initializer-but-incomplete-type | |-- drivers-cpufreq-cppc_cpufreq.c:warning:excess-elements-in-struct-initializer | `-- drivers-cpufreq-cppc_cpufreq.c:warning:unused-variable-fb_ctrs |-- loongarch-allmodconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_KEY_PARSER-when-selected-by-PGP_PRELOAD | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-buildonly-randconfig-002-20250205 `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_dev_user.o:warning:objtool:nbl_dev_start_user_dev-falls-through-to-next-function-__cfi_nbl_mdev_device_release() elapsed time: 938m configs tested: 19 configs skipped: 123 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250205 gcc-14.2.0 arm64 randconfig-002-20250205 gcc-14.2.0 arm64 randconfig-003-20250205 gcc-14.2.0 arm64 randconfig-004-20250205 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250205 gcc-14.2.0 loongarch randconfig-002-20250205 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250205 clang-19 x86_64 buildonly-randconfig-002-20250205 clang-19 x86_64 buildonly-randconfig-003-20250205 clang-19 x86_64 buildonly-randconfig-004-20250205 gcc-12 x86_64 buildonly-randconfig-005-20250205 clang-19 x86_64 buildonly-randconfig-006-20250205 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 86893ebd6e3edffebb8d7dc1091533735c6bb082
by kernel test robot 06 Feb '25

06 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 86893ebd6e3edffebb8d7dc1091533735c6bb082 !14995 mm/compaction: fix UBSAN shift-out-of-bounds warning Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502051727.gu6nNdpL-lkp@intel.com ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-001-20250205 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-002-20250205 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-003-20250205 | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- arm64-randconfig-004-20250205 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:error:struct-iommu_iotlb_gather-has-no-member-named-end | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:error:struct-iommu_iotlb_gather-has-no-member-named-pgsize | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:error:struct-iommu_iotlb_gather-has-no-member-named-start | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- include-linux-blk_types.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-cred.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device-class.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-ioport.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-mm.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-swap.h:linux-kabi.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_data-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_datalen-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-data-not-described-in-pgp_parse_packets | `-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-datalen-not-described-in-pgp_parse_packets |-- x86_64-buildonly-randconfig-001-20250205 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-002-20250205 | |-- block-blk-cgroup.o:warning:objtool:local_lock_release:unreachable-instruction | |-- block-blk-ioc.o:warning:objtool:local_lock_release:unreachable-instruction | |-- block-genhd.o:warning:objtool:local_lock_release:unreachable-instruction | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- drivers-firewire-core-cdev.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-misc-cardreader-rtsx_pcr.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-misc-pci_endpoint_test.o:warning:objtool:pci_endpoint_test_ioctl:unreachable-instruction | |-- drivers-misc-tifm_core.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-scsi-sg.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-thunderbolt-ctl.o:warning:objtool:tb_ctl_tx:unreachable-instruction | |-- drivers-thunderbolt-nhi.o:warning:objtool:tb_ring_start:unreachable-instruction | |-- drivers-thunderbolt-path.o:warning:objtool:tb_path_deactivate:unreachable-instruction | |-- drivers-thunderbolt-switch.o:warning:objtool:tb_wait_for_port:unreachable-instruction | |-- drivers-thunderbolt-tunnel.o:warning:objtool:tb_dp_xchg_caps:unreachable-instruction | |-- fs-btrfs-extent_io.o:warning:objtool:local_lock_release:unreachable-instruction | |-- fs-btrfs-reada.o:warning:objtool:local_lock_release:unreachable-instruction | |-- fs-btrfs-reflink.o:warning:objtool:clone_copy_inline_extent:unreachable-instruction | |-- fs-btrfs-volumes.o:warning:objtool:btrfs_shrink_device:unreachable-instruction | |-- fs-xfs-xfs_icache.o:warning:objtool:local_lock_release:unreachable-instruction | |-- fs-xfs-xfs_mount.o:warning:objtool:local_lock_release:unreachable-instruction | |-- fs-xfs-xfs_mru_cache.o:warning:objtool:local_lock_release:unreachable-instruction | |-- kernel-cgroup-cgroup.o:warning:objtool:local_lock_release:unreachable-instruction | |-- kernel-irq-irqdomain.o:warning:objtool:irq_create_mapping_affinity:unreachable-instruction | |-- kernel-locking-mutex.o:warning:objtool:mutex_trylock:unreachable-instruction | |-- kernel-rcu-update.o:warning:objtool:rcutorture_sched_setaffinity:unreachable-instruction | |-- kernel-sched-completion.o:warning:objtool:complete_all:unreachable-instruction | `-- mm-swap.o:warning:objtool:local_lock_acquire:unreachable-instruction |-- x86_64-buildonly-randconfig-003-20250205 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250205 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-005-20250205 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20250205 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- x86_64-defconfig |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page elapsed time: 737m configs tested: 15 configs skipped: 102 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250205 gcc-14.2.0 arm64 randconfig-002-20250205 gcc-14.2.0 arm64 randconfig-003-20250205 gcc-14.2.0 arm64 randconfig-004-20250205 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250205 clang-19 x86_64 buildonly-randconfig-002-20250205 clang-19 x86_64 buildonly-randconfig-003-20250205 clang-19 x86_64 buildonly-randconfig-004-20250205 gcc-12 x86_64 buildonly-randconfig-005-20250205 clang-19 x86_64 buildonly-randconfig-006-20250205 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2722/2722] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:417:21: error: 'struct iommu_iotlb_gather' has no member named 'start'
by kernel test robot 05 Feb '25

05 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 630e9af0966732abe6cd6abe26c09a26f5771a43 commit: 3302f7f978fd408550824b3b33cb7b9922a8331a [2722/2722] net: hns3: add sync command to sync io-pgtable config: arm64-randconfig-004-20250205 (https://download.01.org/0day-ci/archive/20250205/202502051858.byDv5m4A-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250205/202502051858.byDv5m4A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502051858.byDv5m4A-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: In function 'hns3_dma_map_sync': >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:417:21: error: 'struct iommu_iotlb_gather' has no member named 'start' 417 | iotlb_gather.start = iova; | ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:418:21: error: 'struct iommu_iotlb_gather' has no member named 'end' 418 | iotlb_gather.end = iova + granule - 1; | ^ >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:419:21: error: 'struct iommu_iotlb_gather' has no member named 'pgsize' 419 | iotlb_gather.pgsize = granule; | ^ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: In function 'hns3_client_init': drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:5895:1: warning: label 'out_dbg_init' defined but not used [-Wunused-label] 5895 | out_dbg_init: | ^~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: In function 'hns3_reset_notify_init_enet': drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:6207:1: warning: label 'err_init_guid_fail' defined but not used [-Wunused-label] 6207 | err_init_guid_fail: | ^~~~~~~~~~~~~~~~~~ vim +417 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 402 403 #define HNS3_INVALID_PTYPE \ 404 ARRAY_SIZE(hns3_rx_ptype_tbl) 405 406 static void hns3_dma_map_sync(struct device *dev, unsigned long iova) 407 { 408 struct iommu_domain *domain = iommu_get_domain_for_dev(dev); 409 struct iommu_iotlb_gather iotlb_gather; 410 size_t granule; 411 412 if (!domain || domain->type != IOMMU_DOMAIN_DMA) 413 return; 414 415 granule = 1 << __ffs(domain->pgsize_bitmap); 416 iova = ALIGN_DOWN(iova, granule); > 417 iotlb_gather.start = iova; > 418 iotlb_gather.end = iova + granule - 1; > 419 iotlb_gather.pgsize = granule; 420 421 iommu_iotlb_sync(domain, &iotlb_gather); 422 } 423 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] nilfs2: prevent use of deleted inode
by Xiangwei Li 05 Feb '25

05 Feb '25

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v5.10.233 commit 5d4ed71327b0b5f3b179a19dc3c06be9509ab3db category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBJC7J CVE: CVE-2024-53690 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 901ce9705fbb9f330ff1f19600e5daf9770b0175 upstream. syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0", causing an inode duplication during execution. And this causes an underflow of i_nlink in rmdir operations. The inode is used twice by the same task to unmount and remove directories ".nilfs" and "file0", it trigger warning in nilfs_rmdir. Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means that this inode has been deleted, and iput is executed to reclaim it. [1] WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407 ... Call Trace: <TASK> nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342 vfs_rmdir+0x3a3/0x510 fs/namei.c:4394 do_rmdir+0x3b5/0x580 fs/namei.c:4453 __do_sys_rmdir fs/namei.c:4472 [inline] __se_sys_rmdir fs/namei.c:4470 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Link: https://lkml.kernel.org/r/20241209065759.6781-1-konishi.ryusuke@gmail.com Fixes: d25006523d0b ("nilfs2: pathname operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9260555647a5132edd48 Tested-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/nilfs2/inode.c | 8 +++++++- fs/nilfs2/namei.c | 5 +++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 06f4deb550c9..fe3f005d5d55 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -618,8 +618,14 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, inode = nilfs_iget_locked(sb, root, ino); if (unlikely(!inode)) return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) + + if (!(inode->i_state & I_NEW)) { + if (!inode->i_nlink) { + iput(inode); + return ERR_PTR(-ESTALE); + } return inode; + } err = __nilfs_read_inode(sb, root, ino, inode); if (unlikely(err)) { diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c index eeccd69cd797..446af9c21a29 100644 --- a/fs/nilfs2/namei.c +++ b/fs/nilfs2/namei.c @@ -67,6 +67,11 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) inode = NULL; } else { inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino); + if (inode == ERR_PTR(-ESTALE)) { + nilfs_error(dir->i_sb, + "deleted inode referenced: %lu", ino); + return ERR_PTR(-EIO); + } } return d_splice_alias(inode, dentry); -- 2.25.1

2 1

[PATCH OLK-6.6] nilfs2: prevent use of deleted inode
by Xiangwei Li 05 Feb '25

05 Feb '25

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.68 commit 284760b320a0bac411b18108316939707dccb12b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBJC7J CVE: CVE-2024-53690 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 901ce9705fbb9f330ff1f19600e5daf9770b0175 upstream. syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file was reassigned by nilfs_mkdir for "file0", causing an inode duplication during execution. And this causes an underflow of i_nlink in rmdir operations. The inode is used twice by the same task to unmount and remove directories ".nilfs" and "file0", it trigger warning in nilfs_rmdir. Avoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means that this inode has been deleted, and iput is executed to reclaim it. [1] WARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407 ... Call Trace: <TASK> nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342 vfs_rmdir+0x3a3/0x510 fs/namei.c:4394 do_rmdir+0x3b5/0x580 fs/namei.c:4453 __do_sys_rmdir fs/namei.c:4472 [inline] __se_sys_rmdir fs/namei.c:4470 [inline] __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Link: https://lkml.kernel.org/r/20241209065759.6781-1-konishi.ryusuke@gmail.com Fixes: d25006523d0b ("nilfs2: pathname operations") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9260555647a5132edd48 Tested-by: syzbot+9260555647a5132edd48(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/nilfs2/inode.c | 8 +++++++- fs/nilfs2/namei.c | 5 +++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c index 8e1afa39a62e..d8bf86ec6d8d 100644 --- a/fs/nilfs2/inode.c +++ b/fs/nilfs2/inode.c @@ -614,8 +614,14 @@ struct inode *nilfs_iget(struct super_block *sb, struct nilfs_root *root, inode = nilfs_iget_locked(sb, root, ino); if (unlikely(!inode)) return ERR_PTR(-ENOMEM); - if (!(inode->i_state & I_NEW)) + + if (!(inode->i_state & I_NEW)) { + if (!inode->i_nlink) { + iput(inode); + return ERR_PTR(-ESTALE); + } return inode; + } err = __nilfs_read_inode(sb, root, ino, inode); if (unlikely(err)) { diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c index 7f71aa354f36..ac0adeb58e41 100644 --- a/fs/nilfs2/namei.c +++ b/fs/nilfs2/namei.c @@ -67,6 +67,11 @@ nilfs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) inode = NULL; } else { inode = nilfs_iget(dir->i_sb, NILFS_I(dir)->i_root, ino); + if (inode == ERR_PTR(-ESTALE)) { + nilfs_error(dir->i_sb, + "deleted inode referenced: %lu", ino); + return ERR_PTR(-EIO); + } } return d_splice_alias(inode, dentry); -- 2.25.1

2 1

[openeuler:OLK-5.10 2722/2722] ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined
by kernel test robot 05 Feb '25

05 Feb '25

Hi Sean, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 86893ebd6e3edffebb8d7dc1091533735c6bb082 commit: 5476cb89ef2297bd36f8b38e27b54617b6f63236 [2722/2722] x86/vdso: Implement a vDSO for Intel SGX enclave call config: x86_64-buildonly-randconfig-001-20250205 (https://download.01.org/0day-ci/archive/20250205/202502051727.gu6nNdpL-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250205/202502051727.gu6nNdpL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502051727.gu6nNdpL-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined >> llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory -- >> llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] [Backport] riscv: Fix sleeping in invalid context in die()
by Yongjian Sun 05 Feb '25

05 Feb '25

mainline inclusion from mainline-v6.12-rc3 commit 6a97f4118ac07cfdc316433f385dbdc12af5025e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJ6SH CVE: CVE-2024-57939 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. That causes the following warning: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex preempt_count: 110001, expected: 0 RCU nest depth: 0, expected: 0 CPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234 Hardware name: riscv-virtio,qemu (DT) Call Trace: dump_backtrace+0x1c/0x24 show_stack+0x2c/0x38 dump_stack_lvl+0x5a/0x72 dump_stack+0x14/0x1c __might_resched+0x130/0x13a rt_spin_lock+0x2a/0x5c die+0x24/0x112 do_trap_insn_illegal+0xa0/0xea _new_vmalloc_restore_context_a0+0xcc/0xd8 Oops - illegal instruction [#1] Switch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT enabled. Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code") Signed-off-by: Nam Cao <namcao(a)linutronix.de> Cc: stable(a)vger.kernel.org Reviewed-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Link: https://lore.kernel.org/r/20241118091333.1185288-1-namcao@linutronix.de Signed-off-by: Palmer Dabbelt <palmer(a)rivosinc.com> Conflicts: arch/riscv/kernel/traps.c [Context Changed] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- arch/riscv/kernel/traps.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c index c02e3c6df4eb..a37ca944b1b3 100644 --- a/arch/riscv/kernel/traps.c +++ b/arch/riscv/kernel/traps.c @@ -37,7 +37,7 @@ int show_unhandled_signals = 1; -static DEFINE_SPINLOCK(die_lock); +static DEFINE_RAW_SPINLOCK(die_lock); static void dump_kernel_instr(const char *loglvl, struct pt_regs *regs) { @@ -69,7 +69,7 @@ void die(struct pt_regs *regs, const char *str) oops_enter(); - spin_lock_irqsave(&die_lock, flags); + raw_spin_lock_irqsave(&die_lock, flags); console_verbose(); bust_spinlocks(1); @@ -88,7 +88,7 @@ void die(struct pt_regs *regs, const char *str) bust_spinlocks(0); add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); - spin_unlock_irqrestore(&die_lock, flags); + raw_spin_unlock_irqrestore(&die_lock, flags); oops_exit(); if (in_interrupt()) -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] CVE-2025-21668
by Lin Yujun 05 Feb '25

05 Feb '25

Xiaolei Wang (1): pmdomain: imx8mp-blk-ctrl: add missing loop break condition drivers/pmdomain/imx/imx8mp-blk-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] scsi: bfa: Fix use-after-free in bfad_im_module_exit()
by Chen Zhongjin 05 Feb '25

05 Feb '25

From: Ye Bin <yebin10(a)huawei.com> stable inclusion from stable-v4.19.325 commit 0ceac8012d3ddea3317f0d82934293d05feb8af1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFA CVE: CVE-2024-53227 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 178b8f38932d635e90f5f0e9af1986c6f4a89271 ] BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: <TASK> dump_stack_lvl+0x95/0xe0 print_report+0xcb/0x620 kasan_report+0xbd/0xf0 __lock_acquire+0x2aca/0x3a20 lock_acquire+0x19b/0x520 _raw_spin_lock+0x2b/0x40 attribute_container_unregister+0x30/0x160 fc_release_transport+0x19/0x90 [scsi_transport_fc] bfad_im_module_exit+0x23/0x60 [bfa] bfad_init+0xdb/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 fc_attach_transport+0x4f/0x4740 [scsi_transport_fc] bfad_im_module_init+0x17/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25303: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x38/0x50 kfree+0x212/0x480 bfad_im_module_init+0x7e/0x80 [bfa] bfad_init+0x23/0xff0 [bfa] do_one_initcall+0xdc/0x550 do_init_module+0x22d/0x6b0 load_module+0x4e96/0x5ff0 init_module_from_file+0xcd/0x130 idempotent_init_module+0x330/0x620 __x64_sys_finit_module+0xb3/0x110 do_syscall_64+0xc1/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Above issue happens as follows: bfad_init error = bfad_im_module_init() fc_release_transport(bfad_im_scsi_transport_template); if (error) goto ext; ext: bfad_im_module_exit(); fc_release_transport(bfad_im_scsi_transport_template); --> Trigger double release Don't call bfad_im_module_exit() if bfad_im_module_init() failed. Fixes: 7725ccfda597 ("[SCSI] bfa: Brocade BFA FC SCSI driver") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20241023011809.63466-1-yebin@huaweicloud.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/scsi/bfa/bfad.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c index bd7e6a6fc1f1..7a2a9b05ed09 100644 --- a/drivers/scsi/bfa/bfad.c +++ b/drivers/scsi/bfa/bfad.c @@ -1711,9 +1711,8 @@ bfad_init(void) error = bfad_im_module_init(); if (error) { - error = -ENOMEM; printk(KERN_WARNING "bfad_im_module_init failure\n"); - goto ext; + return -ENOMEM; } if (strcmp(FCPI_NAME, " fcpim") == 0) -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
by Wang Wensheng 05 Feb '25

05 Feb '25

From: Ping-Ke Shih <pkshih(a)realtek.com> stable inclusion from stable-v6.6.66 commit 1a0f54cb3fea5d087440b2bae03202c445156a8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI835 CVE: CVE-2024-48873 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c ] The return value of ieee80211_probereq_get() might be NULL, so check it before using to avoid NULL pointer access. Addresses-Coverity-ID: 1529805 ("Dereference null return value") Signed-off-by: Ping-Ke Shih <pkshih(a)realtek.com> Link: https://patch.msgid.link/20240919081216.28505-2-pkshih@realtek.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/net/wireless/realtek/rtw89/fw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 468cfa43ec04..a8e2efae6e52 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -3662,6 +3662,9 @@ static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev, skb = ieee80211_probereq_get(rtwdev->hw, rtwvif->mac_addr, NULL, 0, req->ie_len); + if (!skb) + return -ENOMEM; + skb_put_data(skb, ies->ies[NL80211_BAND_6GHZ], ies->len[NL80211_BAND_6GHZ]); skb_put_data(skb, ies->common_ies, ies->common_ie_len); hdr = (struct ieee80211_hdr *)skb->data; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] mm/compaction: fix UBSAN shift-out-of-bounds warning
by Liu Shixin 05 Feb '25

05 Feb '25

mainline inclusion from mainline-v6.14-rc1 commit d1366e74342e75555af2648a2964deb2d5c92200 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBK3VP CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order) in isolate_freepages_block(). The bogus compound_order can be any value because it is union with flags. Add back the MAX_PAGE_ORDER check to fix the warning. Link: https://lkml.kernel.org/r/20250123021029.2826736-1-liushixin2@huawei.com Fixes: 3da0272a4c7d ("mm/compaction: correctly return failure with bogus compound_order in strict mode") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kemeng Shi <shikemeng(a)huaweicloud.com> Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/compaction.c [ This is partial revert of commit 343e35e561bc. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/compaction.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/compaction.c b/mm/compaction.c index 8010521ff969..e7c1ffc23c9a 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -476,7 +476,8 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, if (PageCompound(page)) { const unsigned int order = compound_order(page); - if (blockpfn + (1UL << order) <= end_pfn) { + if (likely(order < MAX_ORDER) && + (blockpfn + (1UL << order) <= end_pfn)) { blockpfn += (1UL << order) - 1; cursor += (1UL << order) - 1; } -- 2.34.1

2 1

[PATCH OLK-5.10] mm/compaction: fix UBSAN shift-out-of-bounds warning
by Liu Shixin 05 Feb '25

05 Feb '25

mainline inclusion from mainline-v6.14-rc1 commit d1366e74342e75555af2648a2964deb2d5c92200 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBK36F Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order) in isolate_freepages_block(). The bogus compound_order can be any value because it is union with flags. Add back the MAX_PAGE_ORDER check to fix the warning. Link: https://lkml.kernel.org/r/20250123021029.2826736-1-liushixin2@huawei.com Fixes: 3da0272a4c7d ("mm/compaction: correctly return failure with bogus compound_order in strict mode") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kemeng Shi <shikemeng(a)huaweicloud.com> Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/compaction.c [ This is partial revert of commit 5d2cd4265a04. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/compaction.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/compaction.c b/mm/compaction.c index 6035aa46c8ac..c0874138ec3a 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -599,7 +599,8 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, if (PageCompound(page)) { const unsigned int order = compound_order(page); - if (blockpfn + (1UL << order) <= end_pfn) { + if (likely(order < MAX_ORDER) && + (blockpfn + (1UL << order) <= end_pfn)) { blockpfn += (1UL << order) - 1; cursor += (1UL << order) - 1; } -- 2.34.1

2 1

[PATCH OLK-6.6] mm/compaction: fix UBSAN shift-out-of-bounds warning
by Liu Shixin 05 Feb '25

05 Feb '25

mainline inclusion from mainline-v6.14-rc1 commit d1366e74342e75555af2648a2964deb2d5c92200 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBK4CZ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order) in isolate_freepages_block(). The bogus compound_order can be any value because it is union with flags. Add back the MAX_PAGE_ORDER check to fix the warning. Link: https://lkml.kernel.org/r/20250123021029.2826736-1-liushixin2@huawei.com Fixes: 3da0272a4c7d ("mm/compaction: correctly return failure with bogus compound_order in strict mode") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kemeng Shi <shikemeng(a)huaweicloud.com> Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Oscar Salvador <osalvador(a)suse.de> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Mel Gorman <mgorman(a)techsingularity.net> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/compaction.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/compaction.c b/mm/compaction.c index e2735752c374..4a3a5c7607f3 100644 --- a/mm/compaction.c +++ b/mm/compaction.c @@ -650,7 +650,8 @@ static unsigned long isolate_freepages_block(struct compact_control *cc, if (PageCompound(page)) { const unsigned int order = compound_order(page); - if (blockpfn + (1UL << order) <= end_pfn) { + if ((order <= MAX_PAGE_ORDER) && + (blockpfn + (1UL << order) <= end_pfn)) { blockpfn += (1UL << order) - 1; page += (1UL << order) - 1; nr_scanned += (1UL << order) - 1; -- 2.34.1

2 1

[PATCH OLK-6.6] arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
by Liu Mingrui 05 Feb '25

05 Feb '25

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.6.66 commit 96035c0093db258975b8887676afe59a64c34a72 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBH1XN CVE: CVE-2024-57874 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ca62d90085f4af36de745883faab9f8a7cbb45d3 upstream. Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and rejects other values, a partial SETREGSET attempt will randomly succeed or fail depending on the value of the uninitialized value, and the exposure is significantly limited. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing value of the tagged address ctrl will be retained. The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the user_aarch64_view used by a native AArch64 task to manipulate another native AArch64 task. As get_tagged_addr_ctrl() only returns an error value when called for a compat task, tagged_addr_ctrl_get() and tagged_addr_ctrl_set() should never observe an error value from get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that such an error would be unexpected, and error handlnig is not missing in either case. Fixes: 2200aa7154cb ("arm64: mte: ptrace: Add NT_ARM_TAGGED_ADDR_CTRL regset") Cc: <stable(a)vger.kernel.org> # 5.10.x Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20241205121655.1824269-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- arch/arm64/kernel/ptrace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 28a5ddcf0a1e..d34b57caad49 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -1384,7 +1384,7 @@ static int tagged_addr_ctrl_get(struct task_struct *target, { long ctrl = get_tagged_addr_ctrl(target); - if (IS_ERR_VALUE(ctrl)) + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) return ctrl; return membuf_write(&to, &ctrl, sizeof(ctrl)); @@ -1398,6 +1398,10 @@ static int tagged_addr_ctrl_set(struct task_struct *target, const struct int ret; long ctrl; + ctrl = get_tagged_addr_ctrl(target); + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) + return ctrl; + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 0, -1); if (ret) return ret; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: seq: oss: Fix races at processing SysEx messages
by Gu Bowen 05 Feb '25

05 Feb '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.70 commit d2392b79d8af3714ea8878b71c66dc49d3110f44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2T CVE: CVE-2024-57893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0179488ca992d79908b8e26b9213f1554fc5bacc upstream. OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets. Reported-by: Kun Hu <huk23(a)m.fudan.edu.cn> Closes: https://lore.kernel.org/2B7E93E4-B13A-4AE4-8E87-306A8EE9BBB7@m.fudan.edu.cn Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20241230110543.32454-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: sound/core/seq/oss/seq_oss_synth.c [Commit 54da6a092431("locking: Introduce __cleanup() based infrastructure") not merged, The guard() function is not introduced.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- sound/core/seq/oss/seq_oss_synth.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c index c93945917235..33dbe0223326 100644 --- a/sound/core/seq/oss/seq_oss_synth.c +++ b/sound/core/seq/oss/seq_oss_synth.c @@ -79,6 +79,7 @@ static struct seq_oss_synth midi_synth_dev = { }; static DEFINE_SPINLOCK(register_lock); +static DEFINE_MUTEX(sysex_mutex); /* * prototypes @@ -504,16 +505,20 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, unsigned char *dest; struct seq_oss_synth_sysex *sysex; struct seq_oss_synthinfo *info; + int err = -EINVAL; info = snd_seq_oss_synth_info(dp, dev); if (!info) return -ENXIO; + mutex_lock(&sysex_mutex); sysex = info->sysex; if (sysex == NULL) { sysex = kzalloc(sizeof(*sysex), GFP_KERNEL); - if (sysex == NULL) - return -ENOMEM; + if (sysex == NULL) { + err = -ENOMEM; + goto unlock_sysex; + } info->sysex = sysex; } @@ -538,19 +543,25 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, if (sysex->skip) { sysex->skip = 0; sysex->len = 0; - return -EINVAL; /* skip */ + err = -EINVAL; /* skip */ + goto unlock_sysex; } /* copy the data to event record and send it */ ev->flags = SNDRV_SEQ_EVENT_LENGTH_VARIABLE; - if (snd_seq_oss_synth_addr(dp, dev, ev)) - return -EINVAL; + if (snd_seq_oss_synth_addr(dp, dev, ev)) { + err = -EINVAL; + goto unlock_sysex; + } ev->data.ext.len = sysex->len; ev->data.ext.ptr = sysex->buf; sysex->len = 0; + mutex_unlock(&sysex_mutex); return 0; } - return -EINVAL; /* skip */ +unlock_sysex: + mutex_unlock(&sysex_mutex); + return err; /* skip */ } /* -- 2.25.1

2 1

[PATCH OLK-5.10] usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
by GONG Ruiqi 05 Feb '25

05 Feb '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.13-rc1 commit e56aac6e5a25630645607b6856d4b2a17b2311a5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFV CVE: CVE-2024-53203 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "command" variable can be controlled by the user via debugfs. The worry is that if con_index is zero then "&uc->ucsi->connector[con_index - 1]" would be an array underflow. Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.moun… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/typec/ucsi/ucsi_ccg.c [It comes from two reasons: 1. the lack of commit 13f2ec3115c8, which refactors ucsi_ccg_sync_write() to ucsi_ccg_sync_control(); 2. a possible error within the original upstream patch, causing the imbalance of pm_runtime_{get,put}_sync().] Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi_ccg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c index 6db7c8ddd51c..2f2cb3fc8581 100644 --- a/drivers/usb/typec/ucsi/ucsi_ccg.c +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c @@ -571,6 +571,10 @@ static int ucsi_ccg_sync_write(struct ucsi *ucsi, unsigned int offset, uc->has_multiple_dp) { con_index = (uc->last_cmd_sent >> 16) & UCSI_CMD_CONNECTOR_MASK; + if (con_index == 0) { + ret = -EINVAL; + goto err_clear_bit; + } con = &uc->ucsi->connector[con_index - 1]; ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); } -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] mainline patches
by Chen Ridong 05 Feb '25

05 Feb '25

mainline patches Chen Ridong (2): Revert "cgroup: Fix memory leak caused by missing cgroup_bpf_offline" cgroup/bpf: only cgroup v2 can be attached by bpf programs Waiman Long (1): cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains kernel/cgroup/cgroup.c | 21 ++++++++++++--------- kernel/cgroup/cpuset.c | 10 +++++++++- 2 files changed, 21 insertions(+), 10 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] [Backport] ksmbd: fix a missing return value check bug
by Yongjian Sun 05 Feb '25

05 Feb '25

From: Wentao Liang <liangwentao(a)iscas.ac.cn> mainline inclusion from mainline-v6.12-rc3 commit 4c16e1cadcbcaf3c82d5fc310fbd34d0f5d0db7c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQXA CVE: CVE-2024-57925 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() fails to allocate a node, it returns a NULL pointer to the in_work pointer. This can lead to an illegal memory write of in_work->response_buf when allocate_interim_rsp_buf() attempts to perform a kzalloc() on it. To address this issue, incorporating a check for the return value of ksmbd_alloc_work_struct() ensures that the function returns immediately upon allocation failure, thereby preventing the aforementioned illegal memory access. Fixes: 041bba4414cd ("ksmbd: fix wrong interim response on compound") Signed-off-by: Wentao Liang <liangwentao(a)iscas.ac.cn> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/smb/server/smb2pdu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 27a61cb8b487..ceb10a346a72 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -689,6 +689,9 @@ void smb2_send_interim_resp(struct ksmbd_work *work, __le32 status) struct smb2_hdr *rsp_hdr; struct ksmbd_work *in_work = ksmbd_alloc_work_struct(); + if (!in_work) + return; + if (allocate_interim_rsp_buf(in_work)) { pr_err("smb_allocate_rsp_buf failed!\n"); ksmbd_free_work_struct(in_work); -- 2.39.2

2 1

[PATCH OLK-6.6] net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
by Zeng Heng 05 Feb '25

05 Feb '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 295a92e3df32e72aff0f4bc25c310e349d07ffbf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCCV CVE: CVE-2024-49568 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7863c9f3d24ba49dbead7e03dfbe40deb5888fdf ] When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them. Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: D. Wythe <alibuda(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/smc/smc_clc.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- net/smc/af_smc.c | 3 ++- net/smc/smc_clc.c | 8 +++++++- net/smc/smc_clc.h | 8 +++++++- 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 6881fd03ef25..1ad7b05893af 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2280,7 +2280,8 @@ static void smc_find_rdma_v2_device_serv(struct smc_sock *new_smc, goto not_found; smc_v2_ext = smc_get_clc_v2_ext(pclc); - if (!smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL)) + if (!smc_v2_ext || + !smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL)) goto not_found; /* prepare RDMA check */ diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index d96ad04e7dcf..3d0139250cc8 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -352,7 +352,6 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) struct smc_clc_msg_hdr *hdr = &pclc->hdr; struct smc_clc_v2_extension *v2_ext; - v2_ext = smc_get_clc_v2_ext(pclc); pclc_prfx = smc_clc_proposal_get_prefix(pclc); if (hdr->version == SMC_V1) { if (hdr->typev1 == SMC_TYPE_N) @@ -365,6 +364,13 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) sizeof(struct smc_clc_msg_trail)) return false; } else { + v2_ext = smc_get_clc_v2_ext(pclc); + if ((hdr->typev2 != SMC_TYPE_N && + (!v2_ext || v2_ext->hdr.eid_cnt > SMC_CLC_MAX_UEID)) || + (smcd_indicated(hdr->typev2) && + v2_ext->hdr.ism_gid_cnt > SMCD_CLC_MAX_V2_GID_ENTRIES)) + return false; + if (ntohs(hdr->length) != sizeof(*pclc) + sizeof(struct smc_clc_msg_smcd) + diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h index 58777b6a0dfe..0ddf0f5307a7 100644 --- a/net/smc/smc_clc.h +++ b/net/smc/smc_clc.h @@ -366,8 +366,14 @@ static inline struct smc_clc_v2_extension * smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop) { struct smc_clc_msg_smcd *prop_smcd = smc_get_clc_msg_smcd(prop); + u16 max_offset; - if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset)) + max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) - + offsetof(struct smc_clc_msg_proposal_area, pclc_smcd) - + offsetofend(struct smc_clc_msg_smcd, v2_ext_offset); + + if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset) || + ntohs(prop_smcd->v2_ext_offset) > max_offset) return NULL; return (struct smc_clc_v2_extension *) -- 2.25.1

2 1

[PATCH OLK-6.6] workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker
by Zeng Heng 05 Feb '25

05 Feb '25

From: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> stable inclusion from stable-v6.6.72 commit 1fd2a57dcb4de3cb40844a29c71b5d7b46a84334 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2Z CVE: CVE-2024-57888 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de35994ecd2dd6148ab5a6c5050a1670a04dec77 ] After commit 746ae46c1113 ("drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM") amdgpu started seeing the following warning: [ ] workqueue: WQ_MEM_RECLAIM sdma0:drm_sched_run_job_work [gpu_sched] is flushing !WQ_MEM_RECLAIM events:amdgpu_device_delay_enable_gfx_off [amdgpu] ... [ ] Workqueue: sdma0 drm_sched_run_job_work [gpu_sched] ... [ ] Call Trace: [ ] <TASK> ... [ ] ? check_flush_dependency+0xf5/0x110 ... [ ] cancel_delayed_work_sync+0x6e/0x80 [ ] amdgpu_gfx_off_ctrl+0xab/0x140 [amdgpu] [ ] amdgpu_ring_alloc+0x40/0x50 [amdgpu] [ ] amdgpu_ib_schedule+0xf4/0x810 [amdgpu] [ ] ? drm_sched_run_job_work+0x22c/0x430 [gpu_sched] [ ] amdgpu_job_run+0xaa/0x1f0 [amdgpu] [ ] drm_sched_run_job_work+0x257/0x430 [gpu_sched] [ ] process_one_work+0x217/0x720 ... [ ] </TASK> The intent of the verifcation done in check_flush_depedency is to ensure forward progress during memory reclaim, by flagging cases when either a memory reclaim process, or a memory reclaim work item is flushed from a context not marked as memory reclaim safe. This is correct when flushing, but when called from the cancel(_delayed)_work_sync() paths it is a false positive because work is either already running, or will not be running at all. Therefore cancelling it is safe and we can relax the warning criteria by letting the helper know of the calling context. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> Fixes: fca839c00a12 ("workqueue: warn if memory reclaim tries to flush !WQ_MEM_RECLAIM workqueue") References: 746ae46c1113 ("drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM") Cc: Tejun Heo <tj(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Lai Jiangshan <jiangshanlai(a)gmail.com> Cc: Alex Deucher <alexander.deucher(a)amd.com> Cc: Christian König <christian.koenig(a)amd.com Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: <stable(a)vger.kernel.org> # v4.5+ Signed-off-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/workqueue.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- kernel/workqueue.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 5bb2fba9cb8a..db78a74f5455 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -2940,23 +2940,27 @@ static int rescuer_thread(void *__rescuer) * check_flush_dependency - check for flush dependency sanity * @target_wq: workqueue being flushed * @target_work: work item being flushed (NULL for workqueue flushes) + * @from_cancel: are we called from the work cancel path * * %current is trying to flush the whole @target_wq or @target_work on it. - * If @target_wq doesn't have %WQ_MEM_RECLAIM, verify that %current is not - * reclaiming memory or running on a workqueue which doesn't have - * %WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to - * a deadlock. + * If this is not the cancel path (which implies work being flushed is either + * already running, or will not be at all), check if @target_wq doesn't have + * %WQ_MEM_RECLAIM and verify that %current is not reclaiming memory or running + * on a workqueue which doesn't have %WQ_MEM_RECLAIM as that can break forward- + * progress guarantee leading to a deadlock. */ static void check_flush_dependency(struct workqueue_struct *target_wq, - struct work_struct *target_work) + struct work_struct *target_work, + bool from_cancel) { - work_func_t target_func = target_work ? target_work->func : NULL; + work_func_t target_func; struct worker *worker; - if (target_wq->flags & WQ_MEM_RECLAIM) + if (from_cancel || target_wq->flags & WQ_MEM_RECLAIM) return; worker = current_wq_worker(); + target_func = target_work ? target_work->func : NULL; WARN_ONCE(current->flags & PF_MEMALLOC, "workqueue: PF_MEMALLOC task %d(%s) is flushing !WQ_MEM_RECLAIM %s:%ps", @@ -3189,7 +3193,7 @@ void __flush_workqueue(struct workqueue_struct *wq) list_add_tail(&this_flusher.list, &wq->flusher_overflow); } - check_flush_dependency(wq, NULL); + check_flush_dependency(wq, NULL, false); mutex_unlock(&wq->mutex); @@ -3364,7 +3368,7 @@ static bool start_flush_work(struct work_struct *work, struct wq_barrier *barr, pwq = worker->current_pwq; } - check_flush_dependency(pwq->wq, work); + check_flush_dependency(pwq->wq, work, from_cancel); insert_wq_barrier(pwq, barr, work, worker); raw_spin_unlock_irq(&pool->lock); -- 2.25.1

2 1

[PATCH OLK-6.6] net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
by Zeng Heng 05 Feb '25

05 Feb '25

From: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> stable inclusion from stable-v6.6.68 commit 295a92e3df32e72aff0f4bc25c310e349d07ffbf category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBH1XN Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7863c9f3d24ba49dbead7e03dfbe40deb5888fdf ] When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them. Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal") Signed-off-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Wen Gu <guwen(a)linux.alibaba.com> Reviewed-by: D. Wythe <alibuda(a)linux.alibaba.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/smc/smc_clc.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- net/smc/af_smc.c | 3 ++- net/smc/smc_clc.c | 8 +++++++- net/smc/smc_clc.h | 8 +++++++- 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 6881fd03ef25..1ad7b05893af 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2280,7 +2280,8 @@ static void smc_find_rdma_v2_device_serv(struct smc_sock *new_smc, goto not_found; smc_v2_ext = smc_get_clc_v2_ext(pclc); - if (!smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL)) + if (!smc_v2_ext || + !smc_clc_match_eid(ini->negotiated_eid, smc_v2_ext, NULL, NULL)) goto not_found; /* prepare RDMA check */ diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index d96ad04e7dcf..3d0139250cc8 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -352,7 +352,6 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) struct smc_clc_msg_hdr *hdr = &pclc->hdr; struct smc_clc_v2_extension *v2_ext; - v2_ext = smc_get_clc_v2_ext(pclc); pclc_prfx = smc_clc_proposal_get_prefix(pclc); if (hdr->version == SMC_V1) { if (hdr->typev1 == SMC_TYPE_N) @@ -365,6 +364,13 @@ static bool smc_clc_msg_prop_valid(struct smc_clc_msg_proposal *pclc) sizeof(struct smc_clc_msg_trail)) return false; } else { + v2_ext = smc_get_clc_v2_ext(pclc); + if ((hdr->typev2 != SMC_TYPE_N && + (!v2_ext || v2_ext->hdr.eid_cnt > SMC_CLC_MAX_UEID)) || + (smcd_indicated(hdr->typev2) && + v2_ext->hdr.ism_gid_cnt > SMCD_CLC_MAX_V2_GID_ENTRIES)) + return false; + if (ntohs(hdr->length) != sizeof(*pclc) + sizeof(struct smc_clc_msg_smcd) + diff --git a/net/smc/smc_clc.h b/net/smc/smc_clc.h index 58777b6a0dfe..0ddf0f5307a7 100644 --- a/net/smc/smc_clc.h +++ b/net/smc/smc_clc.h @@ -366,8 +366,14 @@ static inline struct smc_clc_v2_extension * smc_get_clc_v2_ext(struct smc_clc_msg_proposal *prop) { struct smc_clc_msg_smcd *prop_smcd = smc_get_clc_msg_smcd(prop); + u16 max_offset; - if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset)) + max_offset = offsetof(struct smc_clc_msg_proposal_area, pclc_v2_ext) - + offsetof(struct smc_clc_msg_proposal_area, pclc_smcd) - + offsetofend(struct smc_clc_msg_smcd, v2_ext_offset); + + if (!prop_smcd || !ntohs(prop_smcd->v2_ext_offset) || + ntohs(prop_smcd->v2_ext_offset) > max_offset) return NULL; return (struct smc_clc_v2_extension *) -- 2.25.1

2 1

[PATCH OLK-6.6] i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
by Zeng Heng 05 Feb '25

05 Feb '25

From: Defa Li <defa.li(a)mediatek.com> stable inclusion from stable-v6.6.66 commit ffe19e363c6f8b992ba835a361542568dea17409 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC4W CVE: CVE-2024-43098 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6cf7b65f7029914dc0cd7db86fac9ee5159008c6 ] A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. Use i3cdev->desc->info instead of calling i3c_device_info() to avoid acquiring the lock twice. v2: - Modified the title and commit message ============================================ WARNING: possible recursive locking detected 6.11.0-mainline -------------------------------------------- init/1 is trying to acquire lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_bus_normaluse_lock but task is already holding lock: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&i3cbus->lock); lock(&i3cbus->lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by init/1: #0: fcffff809b6798f8 (&dev->mutex){....}-{3:3}, at: __driver_attach #1: f1ffff80a6a40dc0 (&i3cbus->lock){++++}-{3:3}, at: i3c_master_register stack backtrace: CPU: 6 UID: 0 PID: 1 Comm: init Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0xc0 dump_stack+0x18/0x24 print_deadlock_bug+0x388/0x390 __lock_acquire+0x18bc/0x32ec lock_acquire+0x134/0x2b0 down_read+0x50/0x19c i3c_bus_normaluse_lock+0x14/0x24 i3c_device_get_info+0x24/0x58 i3c_device_uevent+0x34/0xa4 dev_uevent+0x310/0x384 kobject_uevent_env+0x244/0x414 kobject_uevent+0x14/0x20 device_add+0x278/0x460 device_register+0x20/0x34 i3c_master_register_new_i3c_devs+0x78/0x154 i3c_master_register+0x6a0/0x6d4 mtk_i3c_master_probe+0x3b8/0x4d8 platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa0/0x15c driver_probe_device+0x3c/0x1ac __driver_attach+0xc4/0x1f0 bus_for_each_dev+0x104/0x160 driver_attach+0x24/0x34 bus_add_driver+0x14c/0x294 driver_register+0x68/0x104 __platform_driver_register+0x20/0x30 init_module+0x20/0xfe4 do_one_initcall+0x184/0x464 do_init_module+0x58/0x1ec load_module+0xefc/0x10c8 __arm64_sys_finit_module+0x238/0x33c invoke_syscall+0x58/0x10c el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x50/0xac el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1a8/0x1ac Signed-off-by: Defa Li <defa.li(a)mediatek.com> Link: https://lore.kernel.org/r/20241107132549.25439-1-defa.li@mediatek.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/i3c/master.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c index 70d120dfb090..d40bc8fd7c15 100644 --- a/drivers/i3c/master.c +++ b/drivers/i3c/master.c @@ -280,7 +280,8 @@ static int i3c_device_uevent(const struct device *dev, struct kobj_uevent_env *e struct i3c_device_info devinfo; u16 manuf, part, ext; - i3c_device_get_info(i3cdev, &devinfo); + if (i3cdev->desc) + devinfo = i3cdev->desc->info; manuf = I3C_PID_MANUF_ID(devinfo.pid); part = I3C_PID_PART_ID(devinfo.pid); ext = I3C_PID_EXTRA_INFO(devinfo.pid); -- 2.25.1

2 1

[PATCH OLK-6.6] vsock/bpf: return early if transport is not assigned
by Pu Lehui 05 Feb '25

05 Feb '25

From: Stefano Garzarella <sgarzare(a)redhat.com> stable inclusion from stable-v6.6.74 commit 58e586c30d0b6f5dc0174a41026f2b0a48c9aab6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJXEX CVE: CVE-2025-21670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f6abafcd32f9cfc4b1a2f820ecea70773e26d423 upstream. Some of the core functions can only be called if the transport has been assigned. As Michal reported, a socket might have the transport at NULL, for example after a failed connect(), causing the following trace: BUG: kernel NULL pointer dereference, address: 00000000000000a0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+ RIP: 0010:vsock_connectible_has_data+0x1f/0x40 Call Trace: vsock_bpf_recvmsg+0xca/0x5e0 sock_recvmsg+0xb9/0xc0 __sys_recvfrom+0xb3/0x130 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e So we need to check the `vsk->transport` in vsock_bpf_recvmsg(), especially for connected sockets (stream/seqpacket) as we already do in __vsock_connectible_recvmsg(). Fixes: 634f1a7110b4 ("vsock: support sockmap") Cc: stable(a)vger.kernel.org Reported-by: Michal Luczaj <mhal(a)rbox.co> Closes: https://lore.kernel.org/netdev/5ca20d4c-1017-49c2-9516-f6f75fd331e9@rbox.co/ Tested-by: Michal Luczaj <mhal(a)rbox.co> Reported-by: syzbot+3affdbfc986ecd9200fd(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/677f84a8.050a0220.25a300.01b3.GAE@google.com/ Tested-by: syzbot+3affdbfc986ecd9200fd(a)syzkaller.appspotmail.com Reviewed-by: Hyunwoo Kim <v4bel(a)theori.io> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Luigi Leonardi <leonardi(a)redhat.com> Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- net/vmw_vsock/vsock_bpf.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/vmw_vsock/vsock_bpf.c b/net/vmw_vsock/vsock_bpf.c index 4aa6e74ec295..f201d9eca1df 100644 --- a/net/vmw_vsock/vsock_bpf.c +++ b/net/vmw_vsock/vsock_bpf.c @@ -77,6 +77,7 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags, int *addr_len) { struct sk_psock *psock; + struct vsock_sock *vsk; int copied; psock = sk_psock_get(sk); @@ -84,6 +85,13 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, return __vsock_recvmsg(sk, msg, len, flags); lock_sock(sk); + vsk = vsock_sk(sk); + + if (!vsk->transport) { + copied = -ENODEV; + goto out; + } + if (vsock_has_data(sk, psock) && sk_psock_queue_empty(psock)) { release_sock(sk); sk_psock_put(sk, psock); @@ -108,6 +116,7 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, copied = sk_msg_recvmsg(sk, psock, msg, len, flags); } +out: release_sock(sk); sk_psock_put(sk, psock); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-56605
by Lin Ruifeng 05 Feb '25

05 Feb '25

fix CVE-2024-56605 Fedor Pchelkin (1): Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc Ignat Korchagin (1): Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() net/bluetooth/l2cap_sock.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.22.0

2 3

[PATCH OLK-5.10] arm64: errata: Add Cortex-A55 to the repeat tlbi list
by Bowen You 05 Feb '25

05 Feb '25

From: James Morse <james.morse(a)arm.com> mainline inclusion from mainline-v6.1-rc1 commit 171df58028bf4649460fb146a56a58dcb0c8f75a category: bugfix bugzilla: 190345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Cortex-A55 is affected by an erratum where in rare circumstances the CPUs may not handle a race between a break-before-make sequence on one CPU, and another CPU accessing the same page. This could allow a store to a page that has been unmapped. Work around this by adding the affected CPUs to the list that needs TLB sequences to be done twice. Signed-off-by: James Morse <james.morse(a)arm.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220930131959.3082594-1-james.morse@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/cpu_errata.c [Some erratum are not added into repeat tlbi list] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 17 +++++++++++++++++ arch/arm64/kernel/cpu_errata.c | 5 +++++ 3 files changed, 24 insertions(+) diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index af12c363a699..7a087383d8c2 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -68,6 +68,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A55 | #1530923 | ARM64_ERRATUM_1530923 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A55 | #2441007 | ARM64_ERRATUM_2441007 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A57 | #832075 | ARM64_ERRATUM_832075 | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A57 | #852523 | N/A | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 8b8f48b2a51e..751f6c1a2bcc 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -624,6 +624,23 @@ config ARM64_ERRATUM_1530923 config ARM64_WORKAROUND_REPEAT_TLBI bool +config ARM64_ERRATUM_2441007 + bool "Cortex-A55: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help + This option adds a workaround for ARM Cortex-A55 erratum #2441007. + + Under very rare circumstances, affected Cortex-A55 CPUs + may not handle a race between a break-before-make sequence on one + CPU, and another CPU accessing the same page. This could allow a + store to a page that has been unmapped. + + Work around this by adding the affected CPUs to the list that needs + TLB sequences to be done twice. + + If unsure, say Y. + config ARM64_ERRATUM_1286807 bool "Cortex-A76: Modification of the translation table for a virtual address might lead to read-after-read ordering violation" default y diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 7f175b3aac15..c7bac554ca8c 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -297,6 +297,11 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { /* Kryo4xx Gold (rcpe to rfpe) => (r0p0 to r3p0) */ ERRATA_MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xe), }, +#endif +#ifdef CONFIG_ARM64_ERRATUM_2441007 + { + ERRATA_MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), + }, #endif {}, }; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Bluetooth: L2CAP: fix CVE-2024-56605
by Lin Ruifeng 05 Feb '25

05 Feb '25

fix CVE-2024-56605 Fedor Pchelkin (1): Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc Ignat Korchagin (1): [Backport] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() net/bluetooth/l2cap_sock.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.22.0

2 3

[openeuler:openEuler-1.0-LTS 1343/1343] fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction
by kernel test robot 05 Feb '25

05 Feb '25

Hi Theodore, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: 41298197ead9e85ee2ec1d52122f03fd1863cff2 [1343/1343] ext4: convert BUG_ON's to WARN_ON's in mballoc.c config: x86_64-randconfig-101-20241223 (https://download.01.org/0day-ci/archive/20250205/202502050119.jyApN4Fx-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250205/202502050119.jyApN4Fx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502050119.jyApN4Fx-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/ext4/mballoc.c:12: In file included from fs/ext4/ext4_jbd2.h:16: In file included from include/linux/jbd2.h:26: In file included from include/linux/buffer_head.h:14: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. fs/ext4/mballoc.c:4734: warning: Function parameter or member 'bh' not described in 'ext4_free_blocks' >> fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 04 Feb '25

04 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250204/202502042318.pGS3sedi-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502042318.pGS3sedi-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized
by kernel test robot 29 Jan '25

29 Jan '25

Hi Yu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: b9f356e64a7eda411ba8b63df9d4c5e204f16025 [1407/1407] block-io-hierarchy: core hierarchy iodump implementation config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250129/202501290356.I10Fs5vR-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250129/202501290356.I10Fs5vR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501290356.I10Fs5vR-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/asm-generic/preempt.h:5, from ./arch/arm64/include/generated/asm/preempt.h:1, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/wait.h:9, from include/linux/wait_bit.h:8, from include/linux/fs.h:7, from include/linux/seq_file.h:11, from block/blk-io-hierarchy/iodump.c:14: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from 'threshold_store' at block/blk-io-hierarchy/iodump.c:240:6: >> include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function 'threshold_store': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ block/blk-io-hierarchy/iodump.c:234:14: note: 'b' declared here 234 | char b[MAX_BUF_LEN + 1]; | ^ vim +/b +59 include/linux/thread_info.h 0f60a8efe4005a Kees Cook 2016-07-12 50 f5509cc18daa7f Kees Cook 2016-06-07 51 #ifdef CONFIG_HARDENED_USERCOPY f5509cc18daa7f Kees Cook 2016-06-07 52 extern void __check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 53 bool to_user); f5509cc18daa7f Kees Cook 2016-06-07 54 a85d6b8242dc78 Kees Cook 2016-09-07 55 static __always_inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 56 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 57 { 81409e9e280588 Kees Cook 2016-08-31 58 if (!__builtin_constant_p(n)) f5509cc18daa7f Kees Cook 2016-06-07 @59 __check_object_size(ptr, n, to_user); f5509cc18daa7f Kees Cook 2016-06-07 60 } f5509cc18daa7f Kees Cook 2016-06-07 61 #else f5509cc18daa7f Kees Cook 2016-06-07 62 static inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 63 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 64 { } f5509cc18daa7f Kees Cook 2016-06-07 65 #endif /* CONFIG_HARDENED_USERCOPY */ f5509cc18daa7f Kees Cook 2016-06-07 66 :::::: The code at line 59 was first introduced by commit :::::: f5509cc18daa7f82bcc553be70df2117c8eedc16 mm: Hardened usercopy :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2720/2720] drivers/block/null_blk/main.o: warning: objtool: local_lock_release()+0x16c: unreachable instruction
by kernel test robot 29 Jan '25

29 Jan '25

Hi Damien, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 683824f7f33a10565e9afcc9358ed8004d851077 commit: 35959f33a5dde63a001111516adda66dbe7a7027 [2720/2720] null_blk: Move driver into its own directory config: x86_64-buildonly-randconfig-006-20250124 (https://download.01.org/0day-ci/archive/20250129/202501290314.CKmch30j-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250129/202501290314.CKmch30j-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501290314.CKmch30j-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/block/null_blk/main.o: warning: objtool: local_lock_release()+0x16c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] include/asm-generic/bitops/non-atomic.h:106:27: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'}
by kernel test robot 29 Jan '25

29 Jan '25

Hi Steven, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [1407/1407] Net: ethernet: Support 3snic 3s9xx network card config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250129/202501290212.Q2TSAA3o-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250129/202501290212.Q2TSAA3o-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501290212.Q2TSAA3o-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:492:5: warning: no previous prototype for 'sss_nic_get_io_stats_size' [-Wmissing-prototypes] 492 | u32 sss_nic_get_io_stats_size(const struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/bitops.h:39, from include/linux/bitops.h:20, from include/linux/kernel.h:11, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:6: In function 'test_bit', inlined from 'sss_nic_add_ethtool_link_mode' at drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:764:7: >> include/asm-generic/bitops/non-atomic.h:106:27: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'} [-Warray-bounds=] 106 | return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1))); | ~~~~^~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c: In function 'sss_nic_add_ethtool_link_mode': drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:759:40: note: object 'hw_mode' of size 4 759 | u32 hw_mode, u32 op) | ~~~~^~~~~~~ vim +106 include/asm-generic/bitops/non-atomic.h 4117b02132d1cf9 Akinobu Mita 2006-03-26 98 4117b02132d1cf9 Akinobu Mita 2006-03-26 99 /** 4117b02132d1cf9 Akinobu Mita 2006-03-26 100 * test_bit - Determine whether a bit is set 4117b02132d1cf9 Akinobu Mita 2006-03-26 101 * @nr: bit number to test 4117b02132d1cf9 Akinobu Mita 2006-03-26 102 * @addr: Address to start counting from 4117b02132d1cf9 Akinobu Mita 2006-03-26 103 */ 4117b02132d1cf9 Akinobu Mita 2006-03-26 104 static inline int test_bit(int nr, const volatile unsigned long *addr) 4117b02132d1cf9 Akinobu Mita 2006-03-26 105 { d05be13bcc6ec61 Jiri Slaby 2007-10-18 @106 return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1))); 4117b02132d1cf9 Akinobu Mita 2006-03-26 107 } 4117b02132d1cf9 Akinobu Mita 2006-03-26 108 :::::: The code at line 106 was first introduced by commit :::::: d05be13bcc6ec615fb2e9556a9b85d52800669b6 define first set of BIT* macros :::::: TO: Jiri Slaby <jirislaby(a)gmail.com> :::::: CC: Linus Torvalds <torvalds(a)woody.linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2720/2720] kernel/sched/core.o: warning: objtool: preempt_count_add()+0xdc: unreachable instruction
by kernel test robot 28 Jan '25

28 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 683824f7f33a10565e9afcc9358ed8004d851077 commit: 2fe77d25dac03b271f454e3f0c006616fdce4e55 [2720/2720] sched: Core-wide rq->lock config: x86_64-buildonly-randconfig-006-20250124 (https://download.01.org/0day-ci/archive/20250128/202501282335.hXkI4N24-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250128/202501282335.hXkI4N24-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501282335.hXkI4N24-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/sched/core.o: warning: objtool: preempt_count_add()+0xdc: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1343/1343] fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction
by kernel test robot 28 Jan '25

28 Jan '25

Hi Theodore, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: 41298197ead9e85ee2ec1d52122f03fd1863cff2 [1343/1343] ext4: convert BUG_ON's to WARN_ON's in mballoc.c config: x86_64-randconfig-101-20241223 (https://download.01.org/0day-ci/archive/20250128/202501280034.3ctUnk1s-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250128/202501280034.3ctUnk1s-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501280034.3ctUnk1s-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/ext4/mballoc.c:12: In file included from fs/ext4/ext4_jbd2.h:16: In file included from include/linux/jbd2.h:26: In file included from include/linux/buffer_head.h:14: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. fs/ext4/mballoc.c:4734: warning: Function parameter or member 'bh' not described in 'ext4_free_blocks' >> fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1334/1334] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 27 Jan '25

27 Jan '25

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: 190aae97bcddbed131a203f829257b168f5058ce [1334/1334] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-randconfig-103-20241218 (https://download.01.org/0day-ci/archive/20250127/202501272153.j77d8naO-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250127/202501272153.j77d8naO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501272153.j77d8naO-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 27 Jan '25

27 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250127/202501272114.s699yjVJ-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501272114.s699yjVJ-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
by Li Lingfeng 27 Jan '25

27 Jan '25

From: Yang Erkun <yangerkun(a)huawei.com> HULK inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCOJ CVE: CVE-2024-56779 -------------------------------- The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files remain open. Consequently, if an action attempts to open a file, it can potentially send two rpc_task to nfs server. NFS CLIENT thread1 thread2 open("file") ... nfs4_do_open _nfs4_do_open _nfs4_open_and_get_state _nfs4_proc_open nfs4_run_open_task /* rpc_task1 */ rpc_run_task rpc_wait_for_completion_task umount -f nfs_umount_begin rpc_killall_tasks rpc_signal_task rpc_task1 been wakeup and return -512 _nfs4_do_open // while loop ... nfs4_run_open_task /* rpc_task2 */ rpc_run_task rpc_wait_for_completion_task While processing an open request, nfsd will first attempt to find or allocate an nfs4_openowner. If it finds an nfs4_openowner that is not marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since two rpc_task can attempt to open the same file simultaneously from the client to server, and because two instances of nfsd can run concurrently, this situation can lead to lots of memory leak. Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be triggered. NFS SERVER nfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // alloc oo1, stateid1 nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // find oo1, without NFS4_OO_CONFIRMED release_openowner unhash_openowner_locked list_del_init(&oo->oo_perclient) // cannot find this oo // from client, LEAK!!! alloc_stateowner // alloc oo2 nfsd4_process_open2 init_open_stateid // associate oo1 // with stateid1, stateid1 LEAK!!! nfs4_get_vfs_file // alloc nfsd_file1 and nfsd_file_mark1 // all LEAK!!! nfsd4_process_open2 ... write_threads ... nfsd_destroy_serv nfsd_shutdown_net nfs4_state_shutdown_net nfs4_state_destroy_net destroy_client __destroy_client // won't find oo1!!! nfsd_shutdown_generic nfsd_file_cache_shutdown kmem_cache_destroy for nfsd_file_slab and nfsd_file_mark_slab // bark since nfsd_file1 // and nfsd_file_mark1 // still alive ======================================================================= BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown() ----------------------------------------------------------------------- Slab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28 flags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xac/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1ae/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Disabling lock debugging due to kernel taint Object 0xff11000110e2ac38 @offset=3128 Allocated in nfsd_file_do_acquire+0x20f/0xa30 [nfsd] age=1635 cpu=3 pid=800 nfsd_file_do_acquire+0x20f/0xa30 [nfsd] nfsd_file_acquire_opened+0x5f/0x90 [nfsd] nfs4_get_vfs_file+0x4c9/0x570 [nfsd] nfsd4_process_open2+0x713/0x1070 [nfsd] nfsd4_open+0x74b/0x8b0 [nfsd] nfsd4_proc_compound+0x70b/0xc20 [nfsd] nfsd_dispatch+0x1b4/0x3a0 [nfsd] svc_process_common+0x5b8/0xc50 [sunrpc] svc_process+0x2ab/0x3b0 [sunrpc] svc_handle_xprt+0x681/0xa20 [sunrpc] nfsd+0x183/0x220 [nfsd] kthread+0x199/0x1e0 ret_from_fork+0x31/0x60 ret_from_fork_asm+0x1a/0x30 Add nfs4_openowner_unhashed to help found unhashed nfs4_openowner, and break nfsd4_open process to fix this problem. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 901fc68636cd..dfa2aa91fcac 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1625,6 +1625,12 @@ static void release_open_stateid(struct nfs4_ol_stateid *stp) free_ol_stateid_reaplist(&reaplist); } +static bool nfs4_openowner_unhashed(struct nfs4_openowner *oo) +{ + return list_empty(&oo->oo_owner.so_strhash) && + list_empty(&oo->oo_perclient); +} + static void unhash_openowner_locked(struct nfs4_openowner *oo) { struct nfs4_client *clp = oo->oo_owner.so_client; @@ -4632,6 +4638,12 @@ init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open) spin_lock(&oo->oo_owner.so_client->cl_lock); spin_lock(&fp->fi_lock); + if (nfs4_openowner_unhashed(oo)) { + mutex_unlock(&stp->st_mutex); + stp = NULL; + goto out_unlock; + } + retstp = nfsd4_find_existing_open(fp, open); if (retstp) goto out_unlock; @@ -5751,6 +5763,11 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf if (!stp) { stp = init_open_stateid(fp, open); + if (!stp) { + status = nfserr_jukebox; + goto out; + } + if (!open->op_stp) new_stp = true; } -- 2.31.1

2 1

[PATCH OLK-6.6 0/7] Support MATA monitor feature for MPAM
by Zeng Heng 26 Jan '25

26 Jan '25

Support MATA monitor feature for MPAM Zeng Heng (7): arm64/mpam: Support MATA monitor feature for MPAM arm64/mpam: Add judgment to distinguish MSMON_MBWU_CAPTURE definition arm64/mpam: fix MBA granularity conversion formula arm64/mpam: fix bug in percent_to_mbw_max() arm64/mpam: Fix out-of-bound access of mbwu_state array arm64/mpam: Fix out-of-bound access of cfg array arm64/mpam: Improve conversion accuracy between percent and fixed-point fraction arch/x86/kernel/cpu/resctrl/monitor.c | 53 ++++++++++ drivers/platform/mpam/mpam_devices.c | 31 ++++-- drivers/platform/mpam/mpam_resctrl.c | 138 +++++++++++++++++++++----- fs/resctrl/internal.h | 15 --- fs/resctrl/monitor.c | 47 +-------- include/linux/resctrl.h | 17 ++++ 6 files changed, 208 insertions(+), 93 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6] igb: Fix potential invalid memory access in igb_init_module()
by dinglongwei 26 Jan '25

26 Jan '25

From: Yuan Can <yuancan(a)huawei.com> stable inclusion from stable-v6.6.66 commit f309733a8c9da7d4266a8a3755020b738a570cae category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCGB CVE: CVE-2024-52332 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0566f83d206c7a864abcd741fe39d6e0ae5eef29 ] The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier can be called when igb fails to install, resulting to invalid memory access. Fixes: bbd98fe48a43 ("igb: Fix DCA errors and do not use context index for 82576") Signed-off-by: Yuan Can <yuancan(a)huawei.com> Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/net/ethernet/intel/igb/igb_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 49b349fa2254..c38be2880efc 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -665,6 +665,10 @@ static int __init igb_init_module(void) dca_register_notify(&dca_notifier); #endif ret = pci_register_driver(&igb_driver); +#ifdef CONFIG_IGB_DCA + if (ret) + dca_unregister_notify(&dca_notifier); +#endif return ret; } -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-56604_openEuler-1.0-LTS
by dinglongwei 26 Jan '25

26 Jan '25

CVE-2024-56604_openEuler-1.0-LTS Ignat Korchagin (1): Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() Luiz Augusto von Dentz (1): Bluetooth: Consolidate code around sk_alloc into a helper function include/net/bluetooth/bluetooth.h | 2 ++ net/bluetooth/af_bluetooth.c | 21 +++++++++++++++++++++ net/bluetooth/bnep/sock.c | 10 +--------- net/bluetooth/hci_sock.c | 10 ++-------- net/bluetooth/l2cap_sock.c | 10 +--------- net/bluetooth/rfcomm/sock.c | 21 +++++++-------------- net/bluetooth/sco.c | 10 +--------- 7 files changed, 35 insertions(+), 49 deletions(-) -- 2.22.0

2 3

[openeuler:openEuler-1.0-LTS 1414/1414] kismet: WARNING: unmet direct dependencies detected for SPI_PHYTIUM when selected by SPI_PHYTIUM_PLAT
by kernel test robot 25 Jan '25

25 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: e8483fcd43fc1dbb8d21bb7eacce804cbab6a7c6 [1414/1414] spi: add phytium spi support config: x86_64-kismet-CONFIG_SPI_PHYTIUM-CONFIG_SPI_PHYTIUM_PLAT-0-0 (https://download.01.org/0day-ci/archive/20250125/202501251001.ng3yamJ9-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250125/202501251001.ng3yamJ9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501251001.ng3yamJ9-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for SPI_PHYTIUM when selected by SPI_PHYTIUM_PLAT WARNING: unmet direct dependencies detected for SPI_PHYTIUM Depends on [n]: SPI [=y] && SPI_MASTER [=y] && (ARCH_PHYTIUM || COMPILE_TEST [=n]) Selected by [y]: - SPI_PHYTIUM_PLAT [=y] && SPI [=y] && SPI_MASTER [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1414/1414] kismet: WARNING: unmet direct dependencies detected for SPI_PHYTIUM when selected by SPI_PHYTIUM_PCI
by kernel test robot 25 Jan '25

25 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: e8483fcd43fc1dbb8d21bb7eacce804cbab6a7c6 [1414/1414] spi: add phytium spi support config: x86_64-kismet-CONFIG_SPI_PHYTIUM-CONFIG_SPI_PHYTIUM_PCI-0-0 (https://download.01.org/0day-ci/archive/20250125/202501250926.0Py02eTR-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250125/202501250926.0Py02eTR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501250926.0Py02eTR-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for SPI_PHYTIUM when selected by SPI_PHYTIUM_PCI WARNING: unmet direct dependencies detected for SPI_PHYTIUM Depends on [n]: SPI [=y] && SPI_MASTER [=y] && (ARCH_PHYTIUM || COMPILE_TEST [=n]) Selected by [y]: - SPI_PHYTIUM_PCI [=y] && SPI [=y] && SPI_MASTER [=y] && PCI [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 6b6d5871437c4adda78a8fb495b923380a7f9d2e
by kernel test robot 25 Jan '25

25 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 6b6d5871437c4adda78a8fb495b923380a7f9d2e !14974 BMA: Fix Oops and spin lock deadlock problem, and change the version number. Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501242129.SwiNXW4P-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501250220.0DIDHdPf-lkp@intel.com include/net/tcp.h: linux/kabi.h is included more than once. include/trace/stages/init.h:2:23: warning: 'str__fs__trace_system_name' defined but not used [-Wunused-const-variable=] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- loongarch-allmodconfig | |-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- x86_64-buildonly-randconfig-004-20250124 | `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_dev_user.o:warning:objtool:nbl_dev_start_user_dev-falls-through-to-next-function-__cfi_nbl_mdev_device_release() `-- x86_64-randconfig-r062-20250125 `-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used elapsed time: 726m configs tested: 19 configs skipped: 124 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250124 clang-20 arm64 randconfig-002-20250124 clang-20 arm64 randconfig-003-20250124 clang-19 arm64 randconfig-004-20250124 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250124 gcc-14.2.0 loongarch randconfig-002-20250124 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250124 gcc-12 x86_64 buildonly-randconfig-002-20250124 gcc-12 x86_64 buildonly-randconfig-003-20250124 clang-19 x86_64 buildonly-randconfig-004-20250124 clang-19 x86_64 buildonly-randconfig-005-20250124 clang-19 x86_64 buildonly-randconfig-006-20250124 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1414/1414] include/scsi/scsi_cmnd.h:327:19: warning: 'scsi_cmnd' may be used uninitialized
by kernel test robot 25 Jan '25

25 Jan '25

Hi chenxiang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: da51139d17e9d53d61a9877d9042e43b85d71ee1 commit: b4adbc622b73d2bc61e6d712e0a916e568f0ce3f [1414/1414] scsi: hisi_sas: add support for DIF/DIX feature of v3 hw config: arm64-defconfig (https://download.01.org/0day-ci/archive/20250125/202501250607.mBS8g6wb-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250125/202501250607.mBS8g6wb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501250607.mBS8g6wb-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/scsi/libsas.h:36, from include/scsi/sas_ata.h:29, from drivers/scsi/hisi_sas/hisi_sas.h:27, from drivers/scsi/hisi_sas/hisi_sas_main.c:12: In function 'scsi_prot_sglist', inlined from 'hisi_sas_dif_dma_map' at drivers/scsi/hisi_sas/hisi_sas_main.c:442:2: >> include/scsi/scsi_cmnd.h:327:19: warning: 'scsi_cmnd' may be used uninitialized [-Wmaybe-uninitialized] 327 | return cmd->prot_sdb ? cmd->prot_sdb->table.sgl : NULL; | ~~~^~~~~~~~~~ drivers/scsi/hisi_sas/hisi_sas_main.c: In function 'hisi_sas_dif_dma_map': drivers/scsi/hisi_sas/hisi_sas_main.c:412:27: note: 'scsi_cmnd' was declared here 412 | struct scsi_cmnd *scsi_cmnd; | ^~~~~~~~~ vim +/scsi_cmnd +327 include/scsi/scsi_cmnd.h 7027ad72a689797 Martin K. Petersen 2008-07-17 324 7027ad72a689797 Martin K. Petersen 2008-07-17 325 static inline struct scatterlist *scsi_prot_sglist(struct scsi_cmnd *cmd) 7027ad72a689797 Martin K. Petersen 2008-07-17 326 { 7027ad72a689797 Martin K. Petersen 2008-07-17 @327 return cmd->prot_sdb ? cmd->prot_sdb->table.sgl : NULL; 7027ad72a689797 Martin K. Petersen 2008-07-17 328 } 7027ad72a689797 Martin K. Petersen 2008-07-17 329 :::::: The code at line 327 was first introduced by commit :::::: 7027ad72a689797475973c6feb5f0b673382f779 [SCSI] Support devices with protection information :::::: TO: Martin K. Petersen <martin.petersen(a)oracle.com> :::::: CC: James Bottomley <James.Bottomley(a)HansenPartnership.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1842/1842] include/net/tcp.h: linux/kabi.h is included more than once.
by kernel test robot 25 Jan '25

25 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6b6d5871437c4adda78a8fb495b923380a7f9d2e commit: b809fb63adcda7223e4c19370fcc567128332e49 [1842/1842] kabi: reserve space for struct rate_sample compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501250220.0DIDHdPf-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/net/tcp.h: linux/kabi.h is included more than once. vim +29 include/net/tcp.h 18 19 #include <linux/list.h> 20 #include <linux/tcp.h> 21 #include <linux/bug.h> 22 #include <linux/slab.h> 23 #include <linux/cache.h> 24 #include <linux/percpu.h> 25 #include <linux/skbuff.h> 26 #include <linux/kref.h> 27 #include <linux/ktime.h> 28 #include <linux/indirect_call_wrapper.h> > 29 #include <linux/kabi.h> 30 31 #include <net/inet_connection_sock.h> 32 #include <net/inet_timewait_sock.h> 33 #include <net/inet_hashtables.h> 34 #include <net/checksum.h> 35 #include <net/request_sock.h> 36 #include <net/sock_reuseport.h> 37 #include <net/sock.h> 38 #include <net/snmp.h> 39 #include <net/ip.h> 40 #include <net/tcp_states.h> 41 #include <net/inet_ecn.h> 42 #include <net/dst.h> 43 #include <net/mptcp.h> 44 45 #include <linux/seq_file.h> 46 #include <linux/memcontrol.h> 47 #include <linux/bpf-cgroup.h> 48 #include <linux/siphash.h> > 49 #include <linux/kabi.h> 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 683824f7f33a10565e9afcc9358ed8004d851077
by kernel test robot 25 Jan '25

25 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 683824f7f33a10565e9afcc9358ed8004d851077 !14960 mainline to olk-5.10 RDMA/hns: Check atomic wr length Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501241230.GPAoTpQP-lkp@intel.com include/trace/trace_events.h:27:23: warning: 'str__fs__trace_system_name' defined but not used [-Wunused-const-variable=] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-allnoconfig | |-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function | |-- include-linux-blk_types.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-cred.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device-class.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-device.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-ioport.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-mm.h:linux-kabi.h-is-included-more-than-once. | |-- include-linux-swap.h:linux-kabi.h-is-included-more-than-once. | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_data-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Excess-function-parameter-_datalen-description-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-data-not-described-in-pgp_parse_packets | |-- crypto-asymmetric_keys-pgp_library.c:warning:Function-parameter-or-member-datalen-not-described-in-pgp_parse_packets | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250124 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-002-20250124 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- include-linux-backing-dev.h:warning:struct-cgroup_subsys-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-linux-minmax.h:warning:comparison-of-distinct-pointer-types-lacks-a-cast | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-buildonly-randconfig-004-20250124 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_object_max_active | `-- fs-fscache-main.c:warning:unused-variable-fscache_min_op_max_active |-- x86_64-buildonly-randconfig-005-20250124 | `-- include-linux-backing-dev.h:warning:declaration-of-struct-cgroup_subsys-will-not-be-visible-outside-of-this-function |-- x86_64-buildonly-randconfig-006-20250124 | |-- drivers-dma-buf-heaps-heap-helpers.o:warning:objtool:dma_heap_dma_buf_release:unreachable-instruction | |-- drivers-memstick-core-memstick.o:warning:objtool:local_lock_release:unreachable-instruction | |-- drivers-mtd-nand-raw-arasan-nand-controller.o:warning:objtool:anfc_sel_read_page_hw_ecc:unreachable-instruction | |-- drivers-mtd-nand-raw-cadence-nand-controller.o:warning:objtool:cadence_nand_cdma_transfer:unreachable-instruction | |-- drivers-mtd-nand-raw-nand_hynix.o:warning:objtool:hynix_nand_decode_id:unreachable-instruction | |-- drivers-mtd-nand-raw-nand_toshiba.o:warning:objtool:toshiba_nand_decode_id:unreachable-instruction | |-- drivers-regulator-core.o:warning:objtool:regulator_resolve_supply:unreachable-instruction | |-- drivers-spi-spi-cadence-quadspi.o:warning:objtool:cqspi_exec_mem_op:unreachable-instruction | |-- drivers-spi-spi-zynqmp-gqspi.o:warning:objtool:zynqmp_qspi_exec_op:unreachable-instruction | |-- fs-btrfs-file-item.o:warning:objtool:btrfs_csum_one_bio:unreachable-instruction | |-- ipc-util.o:warning:objtool:local_lock_release:unreachable-instruction | |-- kernel-locking-rwsem.o:warning:objtool:down_read_trylock:unreachable-instruction | |-- kernel-pid.o:warning:objtool:local_lock_release:unreachable-instruction | |-- kernel-rcu-update.o:warning:objtool:rcutorture_sched_setaffinity:unreachable-instruction | |-- mm-debug_vm_pgtable.o:warning:objtool:pte_basic_tests:unreachable-instruction | |-- mm-huge_memory.o:warning:objtool:do_huge_pmd_anonymous_page:unreachable-instruction | `-- mm-memory.o:warning:objtool:copy_page_range:unreachable-instruction |-- x86_64-defconfig | |-- include-linux-lsm_hook_defs.h:warning:file_ioctl_compat_default-defined-but-not-used | |-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-page_alloc.c:warning:no-previous-prototype-for-arch_memmap_init | `-- mm-page_alloc.c:warning:no-previous-prototype-for-should_fail_alloc_page |-- x86_64-randconfig-121-20250124 | `-- include-trace-trace_events.h:warning:str__fs__trace_system_name-defined-but-not-used `-- x86_64-randconfig-161-20250124 `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data elapsed time: 730m configs tested: 15 configs skipped: 118 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250124 clang-20 arm64 randconfig-002-20250124 clang-20 arm64 randconfig-003-20250124 clang-19 arm64 randconfig-004-20250124 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250124 gcc-12 x86_64 buildonly-randconfig-002-20250124 gcc-12 x86_64 buildonly-randconfig-003-20250124 clang-19 x86_64 buildonly-randconfig-004-20250124 clang-19 x86_64 buildonly-randconfig-005-20250124 clang-19 x86_64 buildonly-randconfig-006-20250124 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1841/1841] include/trace/stages/init.h:2:23: warning: 'str__fs__trace_system_name' defined but not used
by kernel test robot 24 Jan '25

24 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6b6d5871437c4adda78a8fb495b923380a7f9d2e commit: e127275c9aa7024511b06e1f31374bd242c461b0 [1841/1841] vfs: add bare tracepoints for vfs read and release config: loongarch-allyesconfig (https://download.01.org/0day-ci/archive/20250124/202501242129.SwiNXW4P-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250124/202501242129.SwiNXW4P-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501242129.SwiNXW4P-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/trace/trace_events.h:27, from include/trace/define_trace.h:102, from include/trace/events/fs.h:33, from fs/read_write.c:28: >> include/trace/stages/init.h:2:23: warning: 'str__fs__trace_system_name' defined but not used [-Wunused-const-variable=] 2 | #define __app__(x, y) str__##x##y | ^~~~~ include/trace/stages/init.h:3:21: note: in expansion of macro '__app__' 3 | #define __app(x, y) __app__(x, y) | ^~~~~~~ include/trace/stages/init.h:5:29: note: in expansion of macro '__app' 5 | #define TRACE_SYSTEM_STRING __app(TRACE_SYSTEM_VAR,__trace_system_name) | ^~~~~ include/trace/stages/init.h:8:27: note: in expansion of macro 'TRACE_SYSTEM_STRING' 8 | static const char TRACE_SYSTEM_STRING[] = \ | ^~~~~~~~~~~~~~~~~~~ include/trace/stages/init.h:11:1: note: in expansion of macro 'TRACE_MAKE_SYSTEM_STR' 11 | TRACE_MAKE_SYSTEM_STR(); | ^~~~~~~~~~~~~~~~~~~~~ vim +/str__fs__trace_system_name +2 include/trace/stages/init.h af6b9668e85ffd Steven Rostedt (Google 2022-03-03 @2) #define __app__(x, y) str__##x##y af6b9668e85ffd Steven Rostedt (Google 2022-03-03 3) #define __app(x, y) __app__(x, y) af6b9668e85ffd Steven Rostedt (Google 2022-03-03 4) :::::: The code at line 2 was first introduced by commit :::::: af6b9668e85ffd1502aada8036ccbf4dbd481708 tracing: Move the defines to create TRACE_EVENTS into their own files :::::: TO: Steven Rostedt (Google) <rostedt(a)goodmis.org> :::::: CC: Steven Rostedt (Google) <rostedt(a)goodmis.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0