- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2707/2707] include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function
by kernel test robot 17 Jan '25

17 Jan '25

Hi wangyigen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 08e54ea5e4a4948874ca30d91be3e5cca4ecbeec commit: 13e5c52d7cec7621f78bce452b78785e689ed0b2 [2707/2707] cgroup_writeback: bind blkcg and memcg config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20250117/202501170155.aI4YWysc-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250117/202501170155.aI4YWysc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501170155.aI4YWysc-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/filemap.c:15: In file included from include/linux/dax.h:6: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/filemap.c:32: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ mm/filemap.c:823:14: warning: no previous prototype for function '__add_to_page_cache_locked' [-Wmissing-prototypes] 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^ mm/filemap.c:823:10: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^ | static 3 warnings generated. -- In file included from mm/fadvise.c:14: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/fadvise.c:16: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ 2 warnings generated. -- In file included from mm/page-writeback.c:19: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/page-writeback.c:25: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ In file included from mm/page-writeback.c:40: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ 4 warnings generated. -- In file included from mm/swap.c:17: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/swap.c:26: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ In file included from mm/swap.c:32: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ 4 warnings generated. -- In file included from mm/vmscan.c:17: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/vmscan.c:33: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ In file included from mm/vmscan.c:34: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ mm/vmscan.c:569:51: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 569 | size += zone_page_state(zone, NR_ZONE_LRU_BASE + lru); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:1936:4: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 1936 | __count_zid_vm_events(PGSCAN_SKIP, zid, nr_skipped[zid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/vmscan.c:2430:51: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 2430 | inactive = lruvec_page_state(lruvec, NR_LRU_BASE + inactive_lru); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~ mm/vmscan.c:2431:49: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 2431 | active = lruvec_page_state(lruvec, NR_LRU_BASE + active_lru); | ~~~~~~~~~~~ ^ ~~~~~~~~~~ mm/vmscan.c:3263:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3263 | __count_zid_vm_events(ALLOCSTALL, sc->reclaim_idx, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ 9 warnings generated. -- In file included from mm/page_alloc.c:19: In file included from include/linux/mm.h:1581: include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/page_alloc.c:50: >> include/linux/backing-dev.h:418:49: warning: declaration of 'struct cgroup_subsys' will not be visible outside of this function [-Wvisibility] 418 | static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, | ^ In file included from mm/page_alloc.c:59: include/linux/mm_inline.h:34:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:36:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 36 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/page_alloc.c:2609:5: warning: no previous prototype for function 'find_suitable_fallback' [-Wmissing-prototypes] 2609 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^ mm/page_alloc.c:2609:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2609 | int find_suitable_fallback(struct free_area *area, unsigned int order, | ^ | static mm/page_alloc.c:3040:6: warning: no previous prototype for function '__drain_all_pages' [-Wmissing-prototypes] 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^ mm/page_alloc.c:3040:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^ | static mm/page_alloc.c:3449:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3449 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3510:2: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3510 | __count_zid_vm_events(PGALLOC, page_zonenum(page), 1 << order); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:3603:15: warning: no previous prototype for function 'should_fail_alloc_page' [-Wmissing-prototypes] 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^ mm/page_alloc.c:3603:10: note: declare 'static' if the function is not intended to be used outside of this translation unit 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^ | static mm/page_alloc.c:5221:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 5221 | __count_zid_vm_events(PGALLOC, zone_idx(zone), 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/page_alloc.c:6753:20: warning: no previous prototype for function 'memmap_init' [-Wmissing-prototypes] 6753 | void __init __weak memmap_init(void) | ^ mm/page_alloc.c:6753:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6753 | void __init __weak memmap_init(void) | ^ | static mm/page_alloc.c:6791:23: warning: no previous prototype for function 'arch_memmap_init' [-Wmissing-prototypes] 6791 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^ mm/page_alloc.c:6791:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6791 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^ | static mm/page_alloc.c:6909:6: warning: no previous prototype for function '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] 6909 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^ mm/page_alloc.c:6909:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6909 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^ | static 13 warnings generated. vim +418 include/linux/backing-dev.h 417 > 418 static inline void bind_memcg_blkcg_link(struct cgroup_subsys *ss, 419 struct css_set *cset) 420 { 421 } 422 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
by GONG Ruiqi 16 Jan '25

16 Jan '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.13-rc1 commit e56aac6e5a25630645607b6856d4b2a17b2311a5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFV CVE: CVE-2024-53203 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "command" variable can be controlled by the user via debugfs. The worry is that if con_index is zero then "&uc->ucsi->connector[con_index - 1]" would be an array underflow. Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.moun… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/typec/ucsi/ucsi_ccg.c [It comes from two reasons: 1. the lack of commit 13f2ec3115c8, which refactors ucsi_ccg_sync_write() to ucsi_ccg_sync_control(); 2. a possible error within the original upstream patch, causing the imbalance of pm_runtime_{get,put}_sync().] Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi_ccg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c index cf3c8e552def..acbc4def45e6 100644 --- a/drivers/usb/typec/ucsi/ucsi_ccg.c +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c @@ -585,6 +585,10 @@ static int ucsi_ccg_sync_write(struct ucsi *ucsi, unsigned int offset, uc->has_multiple_dp) { con_index = (uc->last_cmd_sent >> 16) & UCSI_CMD_CONNECTOR_MASK; + if (con_index == 0) { + ret = -EINVAL; + goto err_clear_bit; + } con = &uc->ucsi->connector[con_index - 1]; ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); } -- 2.25.1

2 1

[PATCH OLK-6.6] btrfs: don't take dev_replace rwsem on task already holding it
by Yifan Qiao 16 Jan '25

16 Jan '25

From: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> mainline inclusion from mainline-v6.11-rc6 commit 8cca35cb29f81eba3e96ec44dad8696c8a2f9138 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLEX CVE: CVE-2024-48875 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from lockdep: BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started ============================================ WARNING: possible recursive locking detected 6.11.0-rc3-btrfs-for-next #599 Not tainted -------------------------------------------- btrfs/2326 is trying to acquire lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 but task is already holding lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&fs_info->dev_replace.rwsem); lock(&fs_info->dev_replace.rwsem); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by btrfs/2326: #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 stack backtrace: CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x5b/0x80 __lock_acquire+0x2798/0x69d0 ? __pfx___lock_acquire+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x19d/0x4a0 ? btrfs_map_block+0x39f/0x2250 ? __pfx_lock_acquire+0x10/0x10 ? find_held_lock+0x2d/0x110 ? lock_is_held_type+0x8f/0x100 down_read+0x8e/0x440 ? btrfs_map_block+0x39f/0x2250 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x39f/0x2250 ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0 ? __kasan_slab_alloc+0x6e/0x70 ? __pfx_btrfs_map_block+0x10/0x10 ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10 ? kmem_cache_alloc_noprof+0x1f2/0x300 ? mempool_alloc_noprof+0xed/0x2b0 btrfs_submit_chunk+0x28d/0x17e0 ? __pfx_btrfs_submit_chunk+0x10/0x10 ? bvec_alloc+0xd7/0x1b0 ? bio_add_folio+0x171/0x270 ? __pfx_bio_add_folio+0x10/0x10 ? __kasan_check_read+0x20/0x20 btrfs_submit_bio+0x37/0x80 read_extent_buffer_pages+0x3df/0x6c0 btrfs_read_extent_buffer+0x13e/0x5f0 read_tree_block+0x81/0xe0 read_block_for_search+0x4bd/0x7a0 ? __pfx_read_block_for_search+0x10/0x10 btrfs_search_slot+0x78d/0x2720 ? __pfx_btrfs_search_slot+0x10/0x10 ? lock_is_held_type+0x8f/0x100 ? kasan_save_track+0x14/0x30 ? __kasan_slab_alloc+0x6e/0x70 ? kmem_cache_alloc_noprof+0x1f2/0x300 btrfs_get_raid_extent_offset+0x181/0x820 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10 ? down_read+0x194/0x440 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x5b5/0x2250 ? __pfx_btrfs_map_block+0x10/0x10 scrub_submit_initial_read+0x8fe/0x11b0 ? __pfx_scrub_submit_initial_read+0x10/0x10 submit_initial_group_read+0x161/0x3a0 ? lock_release+0x20e/0x710 ? __pfx_submit_initial_group_read+0x10/0x10 ? __pfx_lock_release+0x10/0x10 scrub_simple_mirror.isra.0+0x3eb/0x580 scrub_stripe+0xe4d/0x1440 ? lock_release+0x20e/0x710 ? __pfx_scrub_stripe+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 scrub_chunk+0x257/0x4a0 scrub_enumerate_chunks+0x64c/0xf70 ? __mutex_unlock_slowpath+0x147/0x5f0 ? __pfx_scrub_enumerate_chunks+0x10/0x10 ? bit_wait_timeout+0xb0/0x170 ? __up_read+0x189/0x700 ? scrub_workers_get+0x231/0x300 ? up_write+0x490/0x4f0 btrfs_scrub_dev+0x52e/0xcd0 ? create_pending_snapshots+0x230/0x250 ? __pfx_btrfs_scrub_dev+0x10/0x10 btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? lock_acquire+0x19d/0x4a0 ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10 ? lock_release+0x20e/0x710 ? btrfs_ioctl+0xa09/0x74f0 ? __pfx_lock_release+0x10/0x10 ? do_raw_spin_lock+0x11e/0x240 ? __pfx_do_raw_spin_lock+0x10/0x10 btrfs_ioctl+0xa14/0x74f0 ? lock_acquire+0x19d/0x4a0 ? find_held_lock+0x2d/0x110 ? __pfx_btrfs_ioctl+0x10/0x10 ? lock_release+0x20e/0x710 ? do_sigaction+0x3f0/0x860 ? __pfx_do_vfs_ioctl+0x10/0x10 ? do_raw_spin_lock+0x11e/0x240 ? lockdep_hardirqs_on_prepare+0x270/0x3e0 ? _raw_spin_unlock_irq+0x28/0x50 ? do_sigaction+0x3f0/0x860 ? __pfx_do_sigaction+0x10/0x10 ? __x64_sys_rt_sigaction+0x18e/0x1e0 ? __pfx___x64_sys_rt_sigaction+0x10/0x10 ? __x64_sys_close+0x7c/0xd0 __x64_sys_ioctl+0x137/0x190 do_syscall_64+0x71/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0bd1114f9b Code: Unable to access opcode bytes at 0x7f0bd1114f71. RSP: 002b:00007ffc8a8c3130 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f0bd1114f9b RDX: 00007ffc8a8c35e0 RSI: 00000000ca289435 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000007 R10: 0000000000000008 R11: 0000000000000246 R12: 00007ffc8a8c6c85 R13: 00000000398e72a0 R14: 0000000000004361 R15: 0000000000000004 </TASK> This happens because on RAID stripe-tree filesystems we recurse back into btrfs_map_block() on scrub to perform the logical to device physical mapping. But as the device replace task is already holding the dev_replace::rwsem we deadlock. So don't take the dev_replace::rwsem in case our task is the task performing the device replace. Suggested-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Reviewed-by: Filipe Manana <fdmanana(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/fs.h | 2 ++ fs/btrfs/dev-replace.c | 2 ++ fs/btrfs/volumes.c | 8 +++++--- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/btrfs/fs.h b/fs/btrfs/fs.h index a523d64d5491..d24d41f7811a 100644 --- a/fs/btrfs/fs.h +++ b/fs/btrfs/fs.h @@ -271,6 +271,8 @@ struct btrfs_dev_replace { struct percpu_counter bio_counter; wait_queue_head_t replace_wait; + + struct task_struct *replace_task; }; /* diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c index f87e6ba66462..df230ddf71fc 100644 --- a/fs/btrfs/dev-replace.c +++ b/fs/btrfs/dev-replace.c @@ -646,6 +646,7 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info, return ret; down_write(&dev_replace->rwsem); + dev_replace->replace_task = current; switch (dev_replace->replace_state) { case BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED: case BTRFS_IOCTL_DEV_REPLACE_STATE_FINISHED: @@ -978,6 +979,7 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, list_add(&tgt_device->dev_alloc_list, &fs_devices->alloc_list); fs_devices->rw_devices++; + dev_replace->replace_task = NULL; up_write(&dev_replace->rwsem); btrfs_rm_dev_replace_blocked(fs_info); diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index 093c5a3ef079..7436044549cf 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -6317,13 +6317,15 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op, &stripe_offset, &raid56_full_stripe_start); *length = min_t(u64, em->len - map_offset, max_len); - down_read(&dev_replace->rwsem); + if (dev_replace->replace_task != current) + down_read(&dev_replace->rwsem); + dev_replace_is_ongoing = btrfs_dev_replace_is_ongoing(dev_replace); /* * Hold the semaphore for read during the whole operation, write is * requested at commit time but must wait. */ - if (!dev_replace_is_ongoing) + if (!dev_replace_is_ongoing && dev_replace->replace_task != current) up_read(&dev_replace->rwsem); num_stripes = 1; @@ -6513,7 +6515,7 @@ int btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op, bioc->mirror_num = mirror_num; out: - if (dev_replace_is_ongoing) { + if (dev_replace_is_ongoing && dev_replace->replace_task != current) { lockdep_assert_held(&dev_replace->rwsem); /* Unlock and let waiting writers proceed */ up_read(&dev_replace->rwsem); -- 2.39.2

2 1

[PATCH OLK-6.6] pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
by Pu Lehui 16 Jan '25

16 Jan '25

From: Evgenii Shatokhin <e.shatokhin(a)yadro.com> stable inclusion from stable-v6.6.70 commit 8c6fd5803b988a5e78c9b9e42c70a936d7cfc6ec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI4HE CVE: CVE-2024-57889 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a37eecb705f33726f1fb7cd2a67e514a15dfe693 upstream. If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, ... preempt_count: 1, expected: 0 ... Call Trace: ... __might_resched+0x104/0x10e __might_sleep+0x3e/0x62 mutex_lock+0x20/0x4c regmap_lock_mutex+0x10/0x18 regmap_update_bits_base+0x2c/0x66 mcp23s08_irq_set_type+0x1ae/0x1d6 __irq_set_trigger+0x56/0x172 __setup_irq+0x1e6/0x646 request_threaded_irq+0xb6/0x160 ... We observed the problem while experimenting with a touchscreen driver which used MCP23017 IO expander (I2C). The regmap in the pinctrl-mcp23s08 driver uses a mutex for protection from concurrent accesses, which is the default for regmaps without .fast_io, .disable_locking, etc. mcp23s08_irq_set_type() calls regmap_update_bits_base(), and the latter locks the mutex. However, __setup_irq() locks desc->lock spinlock before calling these functions. As a result, the system tries to lock the mutex whole holding the spinlock. It seems, the internal regmap locks are not needed in this driver at all. mcp->lock seems to protect the regmap from concurrent accesses already, except, probably, in mcp_pinconf_get/set. mcp23s08_irq_set_type() and mcp23s08_irq_mask/unmask() are called under chip_bus_lock(), which calls mcp23s08_irq_bus_lock(). The latter takes mcp->lock and enables regmap caching, so that the potentially slow I2C accesses are deferred until chip_bus_unlock(). The accesses to the regmap from mcp23s08_probe_one() do not need additional locking. In all remaining places where the regmap is accessed, except mcp_pinconf_get/set(), the driver already takes mcp->lock. This patch adds locking in mcp_pinconf_get/set() and disables internal locking in the regmap config. Among other things, it fixes the sleeping in atomic context described above. Fixes: 8f38910ba4f6 ("pinctrl: mcp23s08: switch to regmap caching") Cc: stable(a)vger.kernel.org Signed-off-by: Evgenii Shatokhin <e.shatokhin(a)yadro.com> Link: https://lore.kernel.org/20241209074659.1442898-1-e.shatokhin@yadro.com Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/pinctrl/pinctrl-mcp23s08.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c index 4551575e4e7d..fd97b6ee2a8d 100644 --- a/drivers/pinctrl/pinctrl-mcp23s08.c +++ b/drivers/pinctrl/pinctrl-mcp23s08.c @@ -86,6 +86,7 @@ const struct regmap_config mcp23x08_regmap = { .num_reg_defaults = ARRAY_SIZE(mcp23x08_defaults), .cache_type = REGCACHE_FLAT, .max_register = MCP_OLAT, + .disable_locking = true, /* mcp->lock protects the regmap */ }; EXPORT_SYMBOL_GPL(mcp23x08_regmap); @@ -132,6 +133,7 @@ const struct regmap_config mcp23x17_regmap = { .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults), .cache_type = REGCACHE_FLAT, .val_format_endian = REGMAP_ENDIAN_LITTLE, + .disable_locking = true, /* mcp->lock protects the regmap */ }; EXPORT_SYMBOL_GPL(mcp23x17_regmap); @@ -228,7 +230,9 @@ static int mcp_pinconf_get(struct pinctrl_dev *pctldev, unsigned int pin, switch (param) { case PIN_CONFIG_BIAS_PULL_UP: + mutex_lock(&mcp->lock); ret = mcp_read(mcp, MCP_GPPU, &data); + mutex_unlock(&mcp->lock); if (ret < 0) return ret; status = (data & BIT(pin)) ? 1 : 0; @@ -257,7 +261,9 @@ static int mcp_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, switch (param) { case PIN_CONFIG_BIAS_PULL_UP: + mutex_lock(&mcp->lock); ret = mcp_set_bit(mcp, MCP_GPPU, pin, arg); + mutex_unlock(&mcp->lock); break; default: dev_dbg(mcp->dev, "Invalid config param %04x\n", param); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] CVE-2024-57872
by Pu Lehui 16 Jan '25

16 Jan '25

From: Pu Lehui <pulehui(a)huaweicloud.com> Manivannan Sadhasivam (3): scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() Uwe Kleine-König (1): scsi: ufs: Convert all platform drivers to return void drivers/ufs/host/cdns-pltfrm.c | 9 +++------ drivers/ufs/host/tc-dwc-g210-pltfrm.c | 11 +++-------- drivers/ufs/host/ti-j721e-ufs.c | 6 ++---- drivers/ufs/host/ufs-exynos.c | 9 +++------ drivers/ufs/host/ufs-hisi.c | 9 +++------ drivers/ufs/host/ufs-mediatek.c | 10 +++------- drivers/ufs/host/ufs-qcom.c | 8 +++----- drivers/ufs/host/ufs-renesas.c | 10 +++------- drivers/ufs/host/ufs-sprd.c | 10 +++------- drivers/ufs/host/ufshcd-pltfrm.c | 16 ++++++++++++++++ drivers/ufs/host/ufshcd-pltfrm.h | 1 + 11 files changed, 43 insertions(+), 56 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/4] CVE-2024-57872
by Pu Lehui 16 Jan '25

16 Jan '25

Manivannan Sadhasivam (3): scsi: ufs: pltfrm: Disable runtime PM during removal of glue drivers scsi: ufs: pltfrm: Drop PM runtime reference count after ufshcd_remove() scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() Uwe Kleine-König (1): scsi: ufs: Convert all platform drivers to return void drivers/ufs/host/cdns-pltfrm.c | 9 +++------ drivers/ufs/host/tc-dwc-g210-pltfrm.c | 11 +++-------- drivers/ufs/host/ti-j721e-ufs.c | 6 ++---- drivers/ufs/host/ufs-exynos.c | 9 +++------ drivers/ufs/host/ufs-hisi.c | 9 +++------ drivers/ufs/host/ufs-mediatek.c | 10 +++------- drivers/ufs/host/ufs-qcom.c | 8 +++----- drivers/ufs/host/ufs-renesas.c | 10 +++------- drivers/ufs/host/ufs-sprd.c | 10 +++------- drivers/ufs/host/ufshcd-pltfrm.c | 16 ++++++++++++++++ drivers/ufs/host/ufshcd-pltfrm.h | 1 + 11 files changed, 43 insertions(+), 56 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] sched: qos sched support online task to preempt offline task
by He Yujie 16 Jan '25

16 Jan '25

hulk inclusion category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHNMR CVE: NA -------------------------------- Check_preempt_curr add a condition check to support online task with higher priority to preempt offline task. Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- kernel/sched/fair.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 7df2b07629c0..d8a6686774ea 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -155,6 +155,7 @@ static int hundred_thousand = 100000; static int __unthrottle_qos_cfs_rqs(int cpu); static int unthrottle_qos_cfs_rqs(int cpu); static bool qos_smt_expelled(int this_cpu); +static bool is_offline_task(struct task_struct *p); #endif #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER @@ -9355,6 +9356,11 @@ static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_ if (cse_is_idle != pse_is_idle) return; +#ifdef CONFIG_QOS_SCHED + if (unlikely(is_offline_task(curr) && !is_offline_task(p))) + goto preempt; +#endif + /* * BATCH and IDLE tasks do not preempt others. */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 16 Jan '25

16 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 16 Jan '25

16 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-6.6] bpf: Check size for BTF-based ctx access of pointer members
by Tengda Wu 16 Jan '25

16 Jan '25

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> stable inclusion from stable-v6.6.67 commit c7e1962a3807d2a9e8c192f23cd3a55794d08f90 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBHYOV Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 659b9ba7cb2d7adb64618b87ddfaa528a143766e upstream. Robert Morris reported the following program type which passes the verifier in [0]: SEC("struct_ops/bpf_cubic_init") void BPF_PROG(bpf_cubic_init, struct sock *sk) { asm volatile("r2 = *(u16*)(r1 + 0)"); // verifier should demand u64 asm volatile("*(u32 *)(r2 +1504) = 0"); // 1280 in some configs } The second line may or may not work, but the first instruction shouldn't pass, as it's a narrow load into the context structure of the struct ops callback. The code falls back to btf_ctx_access to ensure correctness and obtaining the types of pointers. Ensure that the size of the access is correctly checked to be 8 bytes, otherwise the verifier thinks the narrow load obtained a trusted BTF pointer and will permit loads/stores as it sees fit. Perform the check on size after we've verified that the load is for a pointer field, as for scalar values narrow loads are fine. Access to structs passed as arguments to a BPF program are also treated as scalars, therefore no adjustment is needed in their case. Existing verifier selftests are broken by this change, but because they were incorrect. Verifier tests for d_path were performing narrow load into context to obtain path pointer, had this program actually run it would cause a crash. The same holds for verifier_btf_ctx_access tests. [0]: https://lore.kernel.org/bpf/51338.1732985814@localhost Fixes: 9e15db66136a ("bpf: Implement accurate raw_tp context access via BTF") Reported-by: Robert Morris <rtm(a)mit.edu> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Link: https://lore.kernel.org/r/20241212092050.3204165-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/bpf/btf.c | 6 ++++++ tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c | 4 ++-- tools/testing/selftests/bpf/progs/verifier_d_path.c | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 4299fb5b8d52..bbc99401b4e7 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -6127,6 +6127,12 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, return false; } + if (size != sizeof(u64)) { + bpf_log(log, "func '%s' size %d must be 8\n", + tname, size); + return false; + } + /* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */ for (i = 0; i < prog->aux->ctx_arg_info_size; i++) { const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i]; diff --git a/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c b/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c index a570e48b917a..bfc3bf18fed4 100644 --- a/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c +++ b/tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c @@ -11,7 +11,7 @@ __success __retval(0) __naked void btf_ctx_access_accept(void) { asm volatile (" \ - r2 = *(u32*)(r1 + 8); /* load 2nd argument value (int pointer) */\ + r2 = *(u64 *)(r1 + 8); /* load 2nd argument value (int pointer) */\ r0 = 0; \ exit; \ " ::: __clobber_all); @@ -23,7 +23,7 @@ __success __retval(0) __naked void ctx_access_u32_pointer_accept(void) { asm volatile (" \ - r2 = *(u32*)(r1 + 0); /* load 1nd argument value (u32 pointer) */\ + r2 = *(u64 *)(r1 + 0); /* load 1nd argument value (u32 pointer) */\ r0 = 0; \ exit; \ " ::: __clobber_all); diff --git a/tools/testing/selftests/bpf/progs/verifier_d_path.c b/tools/testing/selftests/bpf/progs/verifier_d_path.c index ec79cbcfde91..87e51a215558 100644 --- a/tools/testing/selftests/bpf/progs/verifier_d_path.c +++ b/tools/testing/selftests/bpf/progs/verifier_d_path.c @@ -11,7 +11,7 @@ __success __retval(0) __naked void d_path_accept(void) { asm volatile (" \ - r1 = *(u32*)(r1 + 0); \ + r1 = *(u64 *)(r1 + 0); \ r2 = r10; \ r2 += -8; \ r6 = 0; \ @@ -31,7 +31,7 @@ __failure __msg("helper call is not allowed in probe") __naked void d_path_reject(void) { asm volatile (" \ - r1 = *(u32*)(r1 + 0); \ + r1 = *(u64 *)(r1 + 0); \ r2 = r10; \ r2 += -8; \ r6 = 0; \ -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 077fe6dc5c97f9aae30fe6b93fcb91c7c62ccaf4
by kernel test robot 16 Jan '25

16 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 077fe6dc5c97f9aae30fe6b93fcb91c7c62ccaf4 !14663 xsk: Add generic xdp multi-buffer send support Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-002-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | |-- fs-cachefiles-ondemand.c:warning:implicit-conversion-from-enum-cachefiles_obj_ref_trace-to-enum-fscache_obj_ref_trace | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-cachefiles_check_old_object_xattr |-- arm64-randconfig-004-20250115 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-allnoconfig | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-002-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | `-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character |-- x86_64-buildonly-randconfig-004-20250115 | |-- drivers-iommu-amd-iommu.o:warning:objtool:__domain_flush_pages:unreachable-instruction | `-- kernel-time-posix-cpu-timers.o:warning:objtool:run_posix_cpu_timers:unreachable-instruction |-- x86_64-buildonly-randconfig-005-20250115 | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data `-- x86_64-buildonly-randconfig-006-20250115 `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data elapsed time: 778m configs tested: 15 configs skipped: 128 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 clang-20 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 clang-18 arm64 randconfig-004-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 874edbaf1a7d11ba8ef9f03a10f8f38f09814c6a
by kernel test robot 16 Jan '25

16 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 874edbaf1a7d11ba8ef9f03a10f8f38f09814c6a !14856 sched: psi: fix bogus pressure spikes from aggregation race Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-001-20250115 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-002-20250115 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put `-- x86_64-buildonly-randconfig-006-20250115 `-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core.o:warning:objtool:.text.nbl_dev_start_user_dev:unexpected-end-of-section elapsed time: 845m configs tested: 19 configs skipped: 114 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 clang-20 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 clang-18 arm64 randconfig-004-20250115 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250115 gcc-14.2.0 loongarch randconfig-002-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION be7c56a3331fa54879a23bece60f6670e0b0d9ed
by kernel test robot 15 Jan '25

15 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: be7c56a3331fa54879a23bece60f6670e0b0d9ed !14858 ALSA: usb-audio: Fix out of bounds reads when finding clock sources Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-001-20250115 | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-randconfig-003-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | `-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used |-- arm64-randconfig-004-20250115 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250115 | |-- drivers-mmc-core-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-staging-greybus-.tmp_core.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-video-backlight-.tmp_otm3225a.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-autofs-.tmp_expire.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-crypto-.tmp_crypto.o:warning:objtool:missing-symbol-for-section-.text.unlikely | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- x86_64-buildonly-randconfig-002-20250115 | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- kernel-hung_task.c:error:sysctl_hung_task_all_cpu_backtrace-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-003-20250115 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250115 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-of-dynamic.o:warning:objtool:of_reconfig_get_state_change:can-t-find-switch-jump-table | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250115 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- x86_64-buildonly-randconfig-006-20250115 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | `-- net-sched-sch_etf.o:warning:objtool:missing-symbol-for-section-.init.text `-- x86_64-defconfig |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions elapsed time: 776m configs tested: 15 configs skipped: 118 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250115 gcc-14.2.0 arm64 randconfig-002-20250115 gcc-14.2.0 arm64 randconfig-003-20250115 gcc-14.2.0 arm64 randconfig-004-20250115 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250115 gcc-12 x86_64 buildonly-randconfig-002-20250115 gcc-12 x86_64 buildonly-randconfig-003-20250115 clang-19 x86_64 buildonly-randconfig-004-20250115 clang-19 x86_64 buildonly-randconfig-005-20250115 gcc-12 x86_64 buildonly-randconfig-006-20250115 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] quota: flush quota_release_work upon quota writeback
by Baokun Li 15 Jan '25

15 Jan '25

From: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> stable inclusion from stable-v5.10.231 commit 6f3821acd7c3143145999248087de5fb4b48cf26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBWQ CVE: CVE-2024-56780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac6f420291b3fee1113f21d612fa88b628afab5b ] One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots() Since we currently don't always flush the quota_release_work queue in this path, we can end up with the following race: 1. dquot are added to releasing_dquots list during regular operations. 2. FS Freeze starts, however, this does not flush the quota_release_work queue. 3. Freeze completes. 4. Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state: ext4_journal_check_start+0x28/0x110 [ext4] (unreliable) __ext4_journal_start_sb+0x64/0x1c0 [ext4] ext4_release_dquot+0x90/0x1d0 [ext4] quota_release_workfn+0x43c/0x4d0 Which is the following line: WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE); Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores. To avoid this, make sure to flush the workqueue during dquot_writeback_dquots() so we dont have any pending workitems after freeze. Reported-by: Disha Goel <disgoel(a)linux.ibm.com> CC: stable(a)vger.kernel.org Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20241121123855.645335-2-ojaswin@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 89ca36a37376..058f0b94b98d 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -680,6 +680,8 @@ int dquot_writeback_dquots(struct super_block *sb, int type) WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)); + flush_delayed_work(&quota_release_work); + for (cnt = 0; cnt < MAXQUOTAS; cnt++) { if (type != -1 && cnt != type) continue; -- 2.46.1

2 1

[PATCH OLK-5.10] quota: flush quota_release_work upon quota writeback
by Baokun Li 15 Jan '25

15 Jan '25

From: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> stable inclusion from stable-v5.10.231 commit 6f3821acd7c3143145999248087de5fb4b48cf26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBWQ CVE: CVE-2024-56780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac6f420291b3fee1113f21d612fa88b628afab5b ] One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots() Since we currently don't always flush the quota_release_work queue in this path, we can end up with the following race: 1. dquot are added to releasing_dquots list during regular operations. 2. FS Freeze starts, however, this does not flush the quota_release_work queue. 3. Freeze completes. 4. Kernel eventually tries to flush the workqueue while FS is frozen which hits a WARN_ON since transaction gets started during frozen state: ext4_journal_check_start+0x28/0x110 [ext4] (unreliable) __ext4_journal_start_sb+0x64/0x1c0 [ext4] ext4_release_dquot+0x90/0x1d0 [ext4] quota_release_workfn+0x43c/0x4d0 Which is the following line: WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE); Which ultimately results in generic/390 failing due to dmesg noise. This was detected on powerpc machine 15 cores. To avoid this, make sure to flush the workqueue during dquot_writeback_dquots() so we dont have any pending workitems after freeze. Reported-by: Disha Goel <disgoel(a)linux.ibm.com> CC: stable(a)vger.kernel.org Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide") Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20241121123855.645335-2-ojaswin@linux.ibm.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/quota/dquot.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 001482fac9fd..94fa70e38087 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -687,6 +687,8 @@ int dquot_writeback_dquots(struct super_block *sb, int type) WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount)); + flush_delayed_work(&quota_release_work); + for (cnt = 0; cnt < MAXQUOTAS; cnt++) { if (type != -1 && cnt != type) continue; -- 2.46.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-56724
by Liao Chen 15 Jan '25

15 Jan '25

fix CVE-2024-56724 Andy Shevchenko (1): mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device drivers/mfd/intel_soc_pmic_bxtwc.c | 31 ++++++++++++++------------ drivers/platform/x86/intel/bxtwc_tmu.c | 22 +++++------------- 2 files changed, 23 insertions(+), 30 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 15 Jan '25

15 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] *** jffs2: Prevent rtime decompress memory corruption ***
by Yongjian Sun 15 Jan '25

15 Jan '25

*** BLURB HERE *** Kinsey Moore (1): [Backport] jffs2: Prevent rtime decompress memory corruption Richard Weinberger (1): [Backport] jffs2: Fix rtime decompressor fs/jffs2/compr_rtime.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10] NFS: Fix up nfs_ctx_key_to_expire()
by Yang Erkun 15 Jan '25

15 Jan '25

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.16-rc1 commit ca05cbae2a0468e5d78e9b4605936a8bf5da328b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBGMYF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the cached credential exists but doesn't have any expiration callback then exit early. Fix up atomicity issues when replacing the credential with a new one since the existing code could lead to refcount leaks. Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/nfs/inode.c | 4 ++-- fs/nfs/write.c | 41 ++++++++++++++++++++++++++++------------- include/linux/nfs_fs.h | 2 +- 3 files changed, 31 insertions(+), 16 deletions(-) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index cd7d7aa2b3c6..22d425f21087 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -998,7 +998,7 @@ struct nfs_open_context *alloc_nfs_open_context(struct dentry *dentry, ctx->cred = get_cred(filp->f_cred); else ctx->cred = get_current_cred(); - ctx->ll_cred = NULL; + rcu_assign_pointer(ctx->ll_cred, NULL); ctx->state = NULL; ctx->mode = f_mode; ctx->flags = 0; @@ -1037,7 +1037,7 @@ static void __put_nfs_open_context(struct nfs_open_context *ctx, int is_sync) put_cred(ctx->cred); dput(ctx->dentry); nfs_sb_deactive(sb); - put_rpccred(ctx->ll_cred); + put_rpccred(rcu_dereference_protected(ctx->ll_cred, 1)); kfree(ctx->mdsthreshold); kfree_rcu(ctx, rcu_head); } diff --git a/fs/nfs/write.c b/fs/nfs/write.c index 4cf060691979..92239a7571aa 100644 --- a/fs/nfs/write.c +++ b/fs/nfs/write.c @@ -1221,7 +1221,7 @@ nfs_key_timeout_notify(struct file *filp, struct inode *inode) struct nfs_open_context *ctx = nfs_file_open_context(filp); if (nfs_ctx_key_to_expire(ctx, inode) && - !ctx->ll_cred) + !rcu_access_pointer(ctx->ll_cred)) /* Already expired! */ return -EACCES; return 0; @@ -1233,23 +1233,38 @@ nfs_key_timeout_notify(struct file *filp, struct inode *inode) bool nfs_ctx_key_to_expire(struct nfs_open_context *ctx, struct inode *inode) { struct rpc_auth *auth = NFS_SERVER(inode)->client->cl_auth; - struct rpc_cred *cred = ctx->ll_cred; + struct rpc_cred *cred, *new, *old = NULL; struct auth_cred acred = { .cred = ctx->cred, }; + bool ret = false; - if (cred && !cred->cr_ops->crmatch(&acred, cred, 0)) { - put_rpccred(cred); - ctx->ll_cred = NULL; - cred = NULL; - } - if (!cred) - cred = auth->au_ops->lookup_cred(auth, &acred, 0); - if (!cred || IS_ERR(cred)) + rcu_read_lock(); + cred = rcu_dereference(ctx->ll_cred); + if (cred && !(cred->cr_ops->crkey_timeout && + cred->cr_ops->crkey_timeout(cred))) + goto out; + rcu_read_unlock(); + + new = auth->au_ops->lookup_cred(auth, &acred, 0); + if (new == cred) { + put_rpccred(new); return true; - ctx->ll_cred = cred; - return !!(cred->cr_ops->crkey_timeout && - cred->cr_ops->crkey_timeout(cred)); + } + if (IS_ERR_OR_NULL(new)) { + new = NULL; + ret = true; + } else if (new->cr_ops->crkey_timeout && + new->cr_ops->crkey_timeout(new)) + ret = true; + + rcu_read_lock(); + old = rcu_dereference_protected(xchg(&ctx->ll_cred, + RCU_INITIALIZER(new)), 1); +out: + rcu_read_unlock(); + put_rpccred(old); + return ret; } /* diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h index 7488864589a7..010176828f15 100644 --- a/include/linux/nfs_fs.h +++ b/include/linux/nfs_fs.h @@ -71,7 +71,7 @@ struct nfs_open_context { fl_owner_t flock_owner; struct dentry *dentry; const struct cred *cred; - struct rpc_cred *ll_cred; /* low-level cred - use to check for expiry */ + struct rpc_cred __rcu *ll_cred; /* low-level cred - use to check for expiry */ struct nfs4_state *state; fmode_t mode; -- 2.39.2

2 1

[PATCH OLK-5.10] fs/dirty_pages: Add exclusive open lock to prevent null pointer dereference
by Zizhi Wo 15 Jan '25

15 Jan '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBHTNK -------------------------------- The current mechanism for printing dirty pages involves "/proc/dirty/buffer_size" and "/proc/dirty/dirty_list" being able to be opened simultaneously. If "buffer_size" is opened firstly and 1 is written to it, and then "dirty_list" is opened, followed by writing 0 to "buffer_size". Then variable "buf_dirty" will be freed and set to NULL. However, the user can still access "buf_dirty" through the already opened "dirty_list", which could lead to a NULL pointer dereference issue. To prevent the NULL pointer dereference problem, add an exclusive open lock. And now "/proc/dirty/buffer_size" and "/proc/dirty/dirty_list" cannot be opened at the same time unless "/proc/dirty/buffer_size" is opened in read-only mode. At the same time, "buff_used" and "buff_lock" in the original code are not needed, and the redundant code is deleted. Fixes: aeb96447becc ("fs/dirty_pages: dump the number of dirty pages for each inode") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dirty_pages.c | 83 +++++++++++++++++++++++++++--------------------- 1 file changed, 47 insertions(+), 36 deletions(-) diff --git a/fs/dirty_pages.c b/fs/dirty_pages.c index f75a5158d94b..81bd52ad50f0 100644 --- a/fs/dirty_pages.c +++ b/fs/dirty_pages.c @@ -19,12 +19,10 @@ static char *buf_dirty; /* buffer to store number of dirty pages */ static unsigned long buf_size; /* size of buffer in bytes */ static long buff_num; /* size of buffer in number of pages */ static int buff_limit; /* filter threshold of dirty pages*/ +static unsigned long lock_word; /* for exclusive access to buffer */ static struct proc_dir_entry *dirty_dir; -static struct mutex buff_used; /* buffer is in used */ -static struct mutex buff_lock; /* lock when buffer is changed */ - /* proc root directory */ #define DIRTY_ROOT "dirty" /* proc file for buffer allocation and release */ @@ -40,6 +38,18 @@ static void seq_set_overflow(struct seq_file *m) m->count = m->size; } +static bool dirty_pages_lock(void) +{ + if (xchg(&lock_word, 1) == 1) + return false; + return true; +} + +static void dirty_pages_unlock(void) +{ + lock_word = 0; +} + static unsigned long dump_dirtypages_inode(struct inode *inode) { struct pagevec pvec; @@ -195,10 +205,6 @@ static ssize_t seq_read_dirty( size_t n; int err = 0; - if (!mutex_trylock(&buff_used)) - return -EBUSY; - /* don't allow buffer to change during read */ - mutex_lock(&buff_lock); if (m->count == 0) { memset(buf_dirty, 0, buf_size); if (!m->buf) { @@ -210,13 +216,6 @@ static ssize_t seq_read_dirty( goto done; } - /* if buffer changed somehow */ - if (m->size != buf_size) { - mutex_unlock(&buff_lock); - mutex_unlock(&buff_used); - return -EFAULT; - } - n = min(m->count - m->from, size); /* check if this is the last read */ if (n == 0) @@ -234,8 +233,6 @@ static ssize_t seq_read_dirty( else *ppos += copied; - mutex_unlock(&buff_lock); - mutex_unlock(&buff_used); return copied; } @@ -247,6 +244,7 @@ static void free_buf_dirty(void) buf_size = 0; } } + static ssize_t write_proc( struct file *filp, const char *buf, @@ -257,9 +255,6 @@ static ssize_t write_proc( int ret = 0; long old_buff_num; - if (!mutex_trylock(&buff_used)) - return -EBUSY; - if (count > PAGE_SIZE) { ret = -EINVAL; goto error; @@ -283,42 +278,44 @@ static ssize_t write_proc( goto free; } - mutex_lock(&buff_lock); - ret = count; if (buff_num == 0) { free_buf_dirty(); - goto out; + goto free; } if (buff_num == old_buff_num) - goto out; + goto free; free_buf_dirty(); buf_size = PAGE_SIZE * buff_num; buf_dirty = vzalloc(buf_size); - if (!buf_dirty) { + if (!buf_dirty) ret = -ENOMEM; - goto out; - } -out: - mutex_unlock(&buff_lock); free: kfree(msg); error: - mutex_unlock(&buff_used); return ret; } static int proc_dpages_open(struct inode *inode, struct file *filp) { + int ret; + + if (!dirty_pages_lock()) + return -EBUSY; + if (buf_dirty == NULL || buf_size == 0) { pr_warn("please allocate buffer before getting dirty pages\n"); + dirty_pages_unlock(); return -ENOMEM; } - return single_open(filp, proc_dpages_show, NULL); + ret = single_open(filp, proc_dpages_show, NULL); + if (ret) + dirty_pages_unlock(); + return ret; } static int seq_release_dirty(struct inode *inode, struct file *file) @@ -327,6 +324,7 @@ static int seq_release_dirty(struct inode *inode, struct file *file) /* we don't want to free the buf */ m->buf = NULL; + dirty_pages_unlock(); single_release(inode, file); return 0; } @@ -351,7 +349,16 @@ static int proc_limit_show(struct seq_file *m, void *v) static int proc_switch_open(struct inode *inode, struct file *filp) { - return single_open(filp, proc_switch_show, NULL); + int ret; + + if (((filp->f_flags & O_ACCMODE) != O_RDONLY) && !dirty_pages_lock()) + return -EBUSY; + + ret = single_open(filp, proc_switch_show, NULL); + if (ret && ((filp->f_flags & O_ACCMODE) != O_RDONLY)) + dirty_pages_unlock(); + + return ret; } static int proc_limit_open(struct inode *inode, struct file *filp) @@ -359,6 +366,14 @@ static int proc_limit_open(struct inode *inode, struct file *filp) return single_open(filp, proc_limit_show, NULL); } +static int proc_switch_release(struct inode *inode, struct file *filp) +{ + if ((filp->f_flags & O_ACCMODE) != O_RDONLY) + dirty_pages_unlock(); + + return single_release(inode, filp); +} + static ssize_t write_limit_proc( struct file *filp, const char *buf, @@ -405,7 +420,7 @@ static const struct proc_ops proc_switch_operations = { .proc_read = seq_read, .proc_write = write_proc, .proc_lseek = seq_lseek, - .proc_release = single_release, + .proc_release = proc_switch_release, }; static const struct proc_ops proc_limit_operations = { @@ -440,8 +455,6 @@ static int __init dpages_proc_init(void) if (!proc_file) goto fail_limit; - mutex_init(&buff_used); - mutex_init(&buff_lock); return 0; fail_limit: @@ -456,9 +469,7 @@ static int __init dpages_proc_init(void) static void dpages_proc_exit(void) { - mutex_lock(&buff_lock); free_buf_dirty(); - mutex_unlock(&buff_lock); remove_proc_entry(DIRTY_PAGES, dirty_dir); remove_proc_entry(DIRTY_SWITCH, dirty_dir); remove_proc_entry(DIRTY_LIMIT, dirty_dir); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.15.174 commit f5804567cf9605d6e5ec46c0bb786f7d50f18c13 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/gpu/drm/sti/sti_gdp.c [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index c32de6cbf061..0bd3230b2caa 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -629,6 +629,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state->state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = state->crtc_x; dst_y = state->crtc_y; -- 2.22.0

2 1

[PATCH OLK-6.6] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.64 commit 997b64c3f4c1827c5cfda8ae7f5d13f78d28b541 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index 43c72c2604a0..f046f5f7ad25 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -638,6 +638,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y; -- 2.22.0

2 1

[PATCH OLK-5.10] [Backport] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
by Lin Ruifeng 15 Jan '25

15 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v5.15.174 commit f5804567cf9605d6e5ec46c0bb786f7d50f18c13 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHBX6 CVE: CVE-2024-56777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Acked-by: Alain Volmat <alain.volmat(a)foss.st.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/gpu/drm/sti/sti_gdp.c [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/sti/sti_gdp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_gdp.c b/drivers/gpu/drm/sti/sti_gdp.c index 2d5a2b5b78b8..c268a2ef1431 100644 --- a/drivers/gpu/drm/sti/sti_gdp.c +++ b/drivers/gpu/drm/sti/sti_gdp.c @@ -634,6 +634,9 @@ static int sti_gdp_atomic_check(struct drm_plane *drm_plane, mixer = to_sti_mixer(crtc); crtc_state = drm_atomic_get_crtc_state(state->state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = state->crtc_x; dst_y = state->crtc_y; -- 2.22.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 15 Jan '25

15 Jan '25

您好！ Kernel 邀请您参加 2025-01-17 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件申报，也可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/988444011 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-01-17 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件申报，也可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/988444011. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3bfb552dbcbc9d1f3e9eb36c119271a0d590e7f8
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3bfb552dbcbc9d1f3e9eb36c119271a0d590e7f8 !14740 NFSv4: Fix deadlock during the running of state manager Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-001-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250114 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | `-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) |-- arm64-randconfig-003-20250114 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | `-- drivers-staging-gmjstcm-tcm_tis_spi.c:warning:tcm_tis_spi_acpi_match-defined-but-not-used |-- x86_64-allmodconfig | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | `-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests |-- x86_64-allnoconfig | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | `-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions |-- x86_64-buildonly-randconfig-001-20250114 | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-mq-debugfs-zoned.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ov2680.o:warning:objtool:missing-symbol-for-section-.init.text | |-- kernel-trace-preemptirq_delay_test.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250114 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250114 | |-- block-bio-integrity.c:warning:no-previous-prototype-for-function-__bio_integrity_free | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-blkg-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-delta-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-now-not-described-in-blkcg_add_delay | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-q-not-described-in-blkcg_schedule_throttle | |-- block-blk-cgroup.c:warning:Function-parameter-or-member-use_memdelay-not-described-in-blkcg_schedule_throttle | |-- block-blk-iolatency.c:warning:variable-blkiolat-set-but-not-used | |-- block-blk-iolatency.c:warning:variable-changed-set-but-not-used | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250114 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250114 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250114 | |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-function-__blk_mq_sched_dispatch_requests | |-- block-blk-rq-qos.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- block-genhd.c:warning:no-previous-prototype-for-function-disk_scan_partitions | |-- drivers-crypto-ccree-cc_debugfs.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-crypto-ccree-cc_hash.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-fme-mgr.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-fpga-dfl-pci.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-bridge-cdns-dsi.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-gpu-drm-panel-panel-ilitek-ili9881c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ak7375.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-ov2680.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-media-i2c-video-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pci-ats.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-watchdog-menz69_wdt.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-f2fs-recovery.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-defconfig |-- block-blk-merge.c:warning:no-previous-prototype-for-blk_try_req_merge |-- block-blk-mq-sched.c:warning:no-previous-prototype-for-__blk_mq_sched_dispatch_requests `-- block-genhd.c:warning:no-previous-prototype-for-disk_scan_partitions elapsed time: 729m configs tested: 15 configs skipped: 108 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250114 gcc-14.2.0 arm64 randconfig-002-20250114 gcc-14.2.0 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 44e699017cdc4881f46ede1e7b88fde9f037766c
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 44e699017cdc4881f46ede1e7b88fde9f037766c !14838 v2 fs: Filter specific inodes to prevent UAF issues Error/Warning (recently discovered and may have been fixed): drivers/mtd/nand/raw/nand_macronix.o: warning: objtool: nand_power_down_op()+0x1de: unreachable instruction net/hsr/hsr_device.o: warning: objtool: hsr_check_carrier_and_operstate()+0xea: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-defconfig | |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and | |-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- arm64-randconfig-003-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-allnoconfig | `-- samples-bpf-hbm.c:bpf-bpf.h-is-included-more-than-once. |-- x86_64-allyesconfig | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | `-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr |-- x86_64-buildonly-randconfig-001-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-buildonly-randconfig-002-20241228 | |-- drivers-mtd-nand-raw-nand_macronix.o:warning:objtool:nand_power_down_op:unreachable-instruction | `-- net-hsr-hsr_device.o:warning:objtool:hsr_check_carrier_and_operstate:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20250114 | |-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data | |-- fs-cachefiles-rdwr.c:warning:no-previous-prototype-for-function-cachefiles_readpages_work_func | |-- fs-cachefiles-xattr.c:warning:no-previous-prototype-for-function-cachefiles_check_old_object_xattr | |-- fs-fscache-main.c:warning:unused-variable-fscache_min_object_max_active | `-- fs-fscache-main.c:warning:unused-variable-fscache_min_op_max_active |-- x86_64-buildonly-randconfig-004-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data |-- x86_64-buildonly-randconfig-005-20250114 | `-- crypto-af_alg.c:warning:Function-parameter-or-member-min-not-described-in-af_alg_wait_for_data `-- x86_64-randconfig-r062-20250114 |-- block-genhd.c:warning:d-directive-output-may-be-truncated-writing-between-and-bytes-into-a-region-of-size-between-and `-- block-genhd.c:warning:snprintf-output-may-be-truncated-before-the-last-format-character elapsed time: 732m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250114 clang-17 arm64 randconfig-002-20250114 clang-19 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/sti: avoid potential dereference of error pointers
by Li Huafei 14 Jan '25

14 Jan '25

From: Ma Ke <make24(a)iscas.ac.cn> stable inclusion from stable-v6.6.64 commit 8ab73ac97c0fa528f66eeccd9bb53eb6eb7d20dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHLRS CVE: CVE-2024-56776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 831214f77037de02afc287eae93ce97f218d8c04 upstream. The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure. Cc: stable(a)vger.kernel.org Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Link: https://patchwork.freedesktop.org/patch/msgid/20240913090412.2022848-1-make… Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/gpu/drm/sti/sti_cursor.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/sti/sti_cursor.c b/drivers/gpu/drm/sti/sti_cursor.c index db0a1eb53532..c59fcb4dca32 100644 --- a/drivers/gpu/drm/sti/sti_cursor.c +++ b/drivers/gpu/drm/sti/sti_cursor.c @@ -200,6 +200,9 @@ static int sti_cursor_atomic_check(struct drm_plane *drm_plane, return 0; crtc_state = drm_atomic_get_crtc_state(state, crtc); + if (IS_ERR(crtc_state)) + return PTR_ERR(crtc_state); + mode = &crtc_state->mode; dst_x = new_plane_state->crtc_x; dst_y = new_plane_state->crtc_y; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 14 Jan '25

14 Jan '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Benoît Sevens <bsevens(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 01b414448312..de8d7e2c6b3a 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -35,6 +35,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -52,36 +56,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 4fbc633527d173d6e350da6be39009c6a449a802
by kernel test robot 14 Jan '25

14 Jan '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 4fbc633527d173d6e350da6be39009c6a449a802 !14846 net: stmmac: fix TSO DMA API usage causing oops Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202501140558.Dz2Pe9bS-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202501140732.yHKX6wmK-lkp@intel.com drivers/i2c/busses/i2c-zhaoxin-smbus.c:367:36: warning: unused variable 'zxsmb_acpi_match' [-Wunused-const-variable] drivers/irqchip/irq-gic-v3.c:1086:43: error: incompatible integer to pointer conversion passing 'int' to parameter of type 'void *' [-Wint-conversion] include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function [-Wvisibility] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed | |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status | |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr | |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open | |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold | `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put |-- arm64-randconfig-002-20250114 | |-- drivers-i2c-busses-i2c-zhaoxin-smbus.c:warning:unused-variable-zxsmb_acpi_match | `-- kernel-cgroup-cgroup.c:error:use-of-undeclared-identifier-cgroup_psi_stat_show |-- arm64-randconfig-004-20250114 | |-- drivers-irqchip-irq-gic-v3.c:error:incompatible-integer-to-pointer-conversion-passing-int-to-parameter-of-type-void | `-- include-..-drivers-pci-msi-msi.h:warning:declaration-of-struct-msix_entry-will-not-be-visible-outside-of-this-function |-- loongarch-allmodconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-allyesconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- loongarch-randconfig-002-20250114 | `-- drivers-irqchip-irq-loongson-eiointc.c:warning:unused-variable-cores |-- x86_64-allnoconfig | `-- samples-trace_events-trace_custom_sched.c:linux-version.h-not-needed. `-- x86_64-allyesconfig |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_net_event_callback |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_all_vfs_link_changed |-- drivers-net-ethernet-huawei-hibifur-bifur_event.c:warning:no-previous-prototype-for-function-bifur_notify_vf_link_status |-- drivers-net-ethernet-huawei-hibifur-bifur_main.c:warning:no-previous-prototype-for-function-bifur_enable_disable_vf_all |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_alloc_proc_file |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_cmd_exec |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_file_write |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_free_knl_msg_buf |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_close |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_dev_open |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_global_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_from_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_msg_copy_to_usr |-- drivers-net-ethernet-huawei-hibifur-bifur_pfile.c:warning:no-previous-prototype-for-function-bifur_proc_write |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_add |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_file_del |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_build |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_dev_proc_destroy |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_close |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_proc_open |-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_hold `-- drivers-net-ethernet-huawei-hibifur-bifur_vf_mgr.c:warning:no-previous-prototype-for-function-bifur_vf_info_put elapsed time: 738m configs tested: 19 configs skipped: 113 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250114 clang-17 arm64 randconfig-002-20250114 clang-19 arm64 randconfig-003-20250114 gcc-14.2.0 arm64 randconfig-004-20250114 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250114 gcc-14.2.0 loongarch randconfig-002-20250114 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250114 clang-19 x86_64 buildonly-randconfig-002-20250114 clang-19 x86_64 buildonly-randconfig-003-20250114 clang-19 x86_64 buildonly-randconfig-004-20250114 clang-19 x86_64 buildonly-randconfig-005-20250114 clang-19 x86_64 buildonly-randconfig-006-20250114 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: d67515514ca5 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Context conflicts and psi_cgroup_restart(re-enable) is not merged. Move the update_psi_stat_delta into the psi_group_change functions ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- kernel/sched/psi.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 977c973d1e70..b0068145b185 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -962,13 +962,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -981,7 +982,9 @@ static void psi_group_change(struct psi_group *group, int cpu, * change requested through the @clear and @set bits. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); + update_psi_stat_delta(group, cpu, now); record_times(groupc, now); record_cpu_stat_times(group, cpu); @@ -1110,7 +1113,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) int cpu = task_cpu(task); struct psi_group *group; void *iter = NULL; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1120,11 +1122,8 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1135,7 +1134,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); void *iter; - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1153,8 +1151,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } } @@ -1196,8 +1193,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, iter = NULL; while ((group = iterate_groups(prev, &iter)) && group != common) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } #ifdef CONFIG_PSI_FINE_GRAINED @@ -1214,8 +1210,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = iterate_groups(prev, &iter)) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } @@ -1238,12 +1233,11 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { groupc = per_cpu_ptr(group->pcpu, cpu); write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); update_psi_stat_delta(group, cpu, now); record_stat_times(to_psi_group_ext(group), cpu); -- 2.34.1

2 1

[PATCH OLK-6.6] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: df77430639c9 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Just context conflicts. ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> --- kernel/sched/psi.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 9f68756a3bafe..1c8b1f9975138 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -988,13 +988,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -1008,6 +1009,7 @@ static void psi_group_change(struct psi_group *group, int cpu, * SOME and FULL time these may have resulted in. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); /* * Start with TSK_ONCPU, which doesn't have a corresponding @@ -1150,7 +1152,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) { int cpu = task_cpu(task); struct psi_group *group; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1160,11 +1161,9 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - group = task_psi_group(task); do { - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } while ((group = group->parent)); } @@ -1174,7 +1173,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, { struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1192,7 +1190,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } while ((group = group->parent)); } @@ -1236,7 +1234,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, do { if (group == common) break; - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } while ((group = group->parent)); @@ -1255,7 +1253,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = group->parent) { - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1268,7 +1266,6 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) int cpu = task_cpu(task); struct psi_group *group; struct psi_group_cpu *groupc; - u64 now; if (static_branch_likely(&psi_disabled)) return; @@ -1276,14 +1273,15 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - group = task_psi_group(task); do { + u64 now; + if (!group->enabled) continue; groupc = per_cpu_ptr(group->pcpu, cpu); + now = cpu_clock(cpu); write_seqcount_begin(&groupc->seq); @@ -1497,11 +1495,9 @@ void psi_cgroup_restart(struct psi_group *group) for_each_possible_cpu(cpu) { struct rq *rq = cpu_rq(cpu); struct rq_flags rf; - u64 now; rq_lock_irq(rq, &rf); - now = cpu_clock(cpu); - psi_group_change(group, cpu, 0, 0, now, true); + psi_group_change(group, cpu, 0, 0, true); rq_unlock_irq(rq, &rf); } } -- 2.34.1

2 1

[PATCH OLK-5.10] sched: psi: fix bogus pressure spikes from aggregation race
by Chen Ridong 14 Jan '25

14 Jan '25

From: Johannes Weiner <hannes(a)cmpxchg.org> stable inclusion from stable-v6.6.55 commit 1f997b1d13e0b9819468e577622e747b546516fe category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB6YDK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3840cbe24cf060ea05a585ca497814609f5d47d1 ] Brandon reports sporadic, non-sensical spikes in cumulative pressure time (total=) when reading cpu.pressure at a high rate. This is due to a race condition between reader aggregation and tasks changing states. While it affects all states and all resources captured by PSI, in practice it most likely triggers with CPU pressure, since scheduling events are so frequent compared to other resource events. The race context is the live snooping of ongoing stalls during a pressure read. The read aggregates per-cpu records for stalls that have concluded, but will also incorporate ad-hoc the duration of any active state that hasn't been recorded yet. This is important to get timely measurements of ongoing stalls. Those ad-hoc samples are calculated on-the-fly up to the current time on that CPU; since the stall hasn't concluded, it's expected that this is the minimum amount of stall time that will enter the per-cpu records once it does. The problem is that the path that concludes the state uses a CPU clock read that is not synchronized against aggregators; the clock is read outside of the seqlock protection. This allows aggregators to race and snoop a stall with a longer duration than will actually be recorded. With the recorded stall time being less than the last snapshot remembered by the aggregator, a subsequent sample will underflow and observe a bogus delta value, resulting in an erratic jump in pressure. Fix this by moving the clock read of the state change into the seqlock protection. This ensures no aggregation can snoop live stalls past the time that's recorded when the state concludes. Reported-by: Brandon Duffany <brandon(a)buildbuddy.io> Link: https://bugzilla.kernel.org/show_bug.cgi?id=219194 Link: https://lore.kernel.org/lkml/20240827121851.GB438928@cmpxchg.org/ Fixes: df77430639c9 ("psi: Reduce calls to sched_clock() in psi") Cc: stable(a)vger.kernel.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Chengming Zhou <chengming.zhou(a)linux.dev> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: kernel/sched/psi.c [ Context conflicts and psi_cgroup_restart(re-enable) is not merged. Move the update_psi_stat_delta into the psi_group_change functions ] Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- kernel/sched/psi.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index 977c973d1e70..b0068145b185 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -962,13 +962,14 @@ static void record_times(struct psi_group_cpu *groupc, u64 now) } static void psi_group_change(struct psi_group *group, int cpu, - unsigned int clear, unsigned int set, u64 now, + unsigned int clear, unsigned int set, bool wake_clock) { struct psi_group_cpu *groupc; unsigned int t, m; enum psi_states s; u32 state_mask; + u64 now; groupc = per_cpu_ptr(group->pcpu, cpu); @@ -981,7 +982,9 @@ static void psi_group_change(struct psi_group *group, int cpu, * change requested through the @clear and @set bits. */ write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); + update_psi_stat_delta(group, cpu, now); record_times(groupc, now); record_cpu_stat_times(group, cpu); @@ -1110,7 +1113,6 @@ void psi_task_change(struct task_struct *task, int clear, int set) int cpu = task_cpu(task); struct psi_group *group; void *iter = NULL; - u64 now; int stat_set = 0; int stat_clear = 0; @@ -1120,11 +1122,8 @@ void psi_task_change(struct task_struct *task, int clear, int set) psi_flags_change(task, clear, set); psi_stat_flags_change(task, &stat_set, &stat_clear, set, clear); - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, true); + psi_group_change(group, cpu, clear, set, true); psi_group_stat_change(group, cpu, stat_clear, stat_set); } } @@ -1135,7 +1134,6 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, struct psi_group *group, *common = NULL; int cpu = task_cpu(prev); void *iter; - u64 now = cpu_clock(cpu); if (next->pid) { update_throttle_type(next, cpu, true); @@ -1153,8 +1151,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, break; } - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, 0, TSK_ONCPU, now, true); + psi_group_change(group, cpu, 0, TSK_ONCPU, true); psi_group_stat_change(group, cpu, 0, 0); } } @@ -1196,8 +1193,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, iter = NULL; while ((group = iterate_groups(prev, &iter)) && group != common) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } #ifdef CONFIG_PSI_FINE_GRAINED @@ -1214,8 +1210,7 @@ void psi_task_switch(struct task_struct *prev, struct task_struct *next, memstall_type_change) { clear &= ~TSK_ONCPU; for (; group; group = iterate_groups(prev, &iter)) { - update_psi_stat_delta(group, cpu, now); - psi_group_change(group, cpu, clear, set, now, wake_clock); + psi_group_change(group, cpu, clear, set, wake_clock); psi_group_stat_change(group, cpu, stat_clear, stat_set); } @@ -1238,12 +1233,11 @@ void psi_account_irqtime(struct task_struct *task, u32 delta) if (!task->pid) return; - now = cpu_clock(cpu); - while ((group = iterate_groups(task, &iter))) { groupc = per_cpu_ptr(group->pcpu, cpu); write_seqcount_begin(&groupc->seq); + now = cpu_clock(cpu); update_psi_stat_delta(group, cpu, now); record_stat_times(to_psi_group_ext(group), cpu); -- 2.34.1

2 1

[openeuler:OLK-6.6 1823/1823] drivers/irqchip/irq-gic-v3.c:1086:43: error: incompatible integer to pointer conversion passing 'int' to parameter of type 'void *'
by kernel test robot 14 Jan '25

14 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4fbc633527d173d6e350da6be39009c6a449a802 commit: 63f9ef213a477c796c6b343010762513f6315f83 [1823/1823] arm64: Add debugfs dir for xint config: arm64-randconfig-004-20250114 (https://download.01.org/0day-ci/archive/20250114/202501140732.yHKX6wmK-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project f5cd181ffbb7cb61d582fe130d46580d5969d47a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250114/202501140732.yHKX6wmK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501140732.yHKX6wmK-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/irqchip/irq-gic-v3.c:25: In file included from include/linux/irqchip/arm-gic-v3.h:632: In file included from arch/arm64/include/asm/arch_gicv3.h:17: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ drivers/irqchip/irq-gic-v3.c:1042:23: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1042 | int irq = (int)(long)pde_data(file_inode(file)); | ^ drivers/irqchip/irq-gic-v3.c:1086:43: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1086 | return single_open(file, xint_proc_show, pde_data(inode)); | ^ >> drivers/irqchip/irq-gic-v3.c:1086:43: error: incompatible integer to pointer conversion passing 'int' to parameter of type 'void *' [-Wint-conversion] 1086 | return single_open(file, xint_proc_show, pde_data(inode)); | ^~~~~~~~~~~~~~~ include/linux/seq_file.h:166:74: note: passing argument to parameter here 166 | int single_open(struct file *, int (*)(struct seq_file *, void *), void *); | ^ drivers/irqchip/irq-gic-v3.c:1089:30: error: variable has incomplete type 'const struct proc_ops' 1089 | static const struct proc_ops xint_proc_ops = { | ^ drivers/irqchip/irq-gic-v3.c:1089:21: note: forward declaration of 'struct proc_ops' 1089 | static const struct proc_ops xint_proc_ops = { | ^ drivers/irqchip/irq-gic-v3.c:1103:2: error: call to undeclared function 'proc_create_data'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1103 | proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); | ^ drivers/irqchip/irq-gic-v3.c:1111:2: error: call to undeclared function 'remove_proc_entry'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1111 | remove_proc_entry("xint", desc->dir); | ^ 5 warnings and 6 errors generated. vim +1086 drivers/irqchip/irq-gic-v3.c 3053668e6b2119 Jinjie Ruan 2024-11-25 1083 3053668e6b2119 Jinjie Ruan 2024-11-25 1084 static int xint_proc_open(struct inode *inode, struct file *file) 3053668e6b2119 Jinjie Ruan 2024-11-25 1085 { 3053668e6b2119 Jinjie Ruan 2024-11-25 @1086 return single_open(file, xint_proc_show, pde_data(inode)); 3053668e6b2119 Jinjie Ruan 2024-11-25 1087 } 3053668e6b2119 Jinjie Ruan 2024-11-25 1088 :::::: The code at line 1086 was first introduced by commit :::::: 3053668e6b211924bb67c19d791a5a532eca2ad8 arm64: Introduce Xint software solution :::::: TO: Jinjie Ruan <ruanjinjie(a)huawei.com> :::::: CC: Jinjie Ruan <ruanjinjie(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1823/1823] include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function
by kernel test robot 14 Jan '25

14 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4fbc633527d173d6e350da6be39009c6a449a802 commit: ad540a13eb8292fc92651b3bf281088a502a85f9 [1823/1823] virtcca feature: fix msi iova map config: arm64-randconfig-004-20250114 (https://download.01.org/0day-ci/archive/20250114/202501140558.Dz2Pe9bS-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project f5cd181ffbb7cb61d582fe130d46580d5969d47a) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250114/202501140558.Dz2Pe9bS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501140558.Dz2Pe9bS-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/coda/coda_pci.c:5: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2243: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/coda/coda_pci.c:8: >> include/../drivers/pci/msi/msi.h:113:57: warning: declaration of 'struct msix_entry' will not be visible outside of this function [-Wvisibility] 113 | int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int minvec, | ^ 6 warnings generated. vim +113 include/../drivers/pci/msi/msi.h 897a0b6aa8c7ee Ahmed S. Darwish 2022-11-11 107 b12d0bec385b7a Ahmed S. Darwish 2022-11-11 108 /* MSI internal functions invoked from the public APIs */ b12d0bec385b7a Ahmed S. Darwish 2022-11-11 109 void pci_msi_shutdown(struct pci_dev *dev); 18e1926b8c8b7c Ahmed S. Darwish 2022-11-11 110 void pci_msix_shutdown(struct pci_dev *dev); b12d0bec385b7a Ahmed S. Darwish 2022-11-11 111 void pci_free_msi_irqs(struct pci_dev *dev); bbda3407982211 Ahmed S. Darwish 2022-11-11 112 int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec, struct irq_affinity *affd); be7496c1ef47e1 Ahmed S. Darwish 2022-11-11 @113 int __pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries, int minvec, be7496c1ef47e1 Ahmed S. Darwish 2022-11-11 114 int maxvec, struct irq_affinity *affd, int flags); 57127da98bc876 Ahmed S. Darwish 2022-11-11 115 void __pci_restore_msi_state(struct pci_dev *dev); 57127da98bc876 Ahmed S. Darwish 2022-11-11 116 void __pci_restore_msix_state(struct pci_dev *dev); b12d0bec385b7a Ahmed S. Darwish 2022-11-11 117 :::::: The code at line 113 was first introduced by commit :::::: be7496c1ef47e1ba8c4b389ee23178fcf066cc4e PCI/MSI: Move pci_enable_msix_range() to api.c :::::: TO: Ahmed S. Darwish <darwi(a)linutronix.de> :::::: CC: Thomas Gleixner <tglx(a)linutronix.de> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] [Backport] btrfs: check folio mapping after unlock in relocate_one_folio()
by Yongjian Sun 13 Jan '25

13 Jan '25

mainline inclusion from mainline-v6.12-rc3 commit 3e74859ee35edc33a022c3f3971df066ea0ca6b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBG2PL CVE: CVE-2024-56758 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread can modify the mapping (like remove it with invalidate) before we call folio_lock(). This results in an invalid page and we need to try again. In particular, if we are relocating concurrently with aborting a transaction, this can result in a crash like the following: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 76 PID: 1411631 Comm: kworker/u322:5 Workqueue: events_unbound btrfs_reclaim_bgs_work RIP: 0010:set_page_extent_mapped+0x20/0xb0 RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246 RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880 RBP: 0000000003573000 R08: 0000000000000001 R09: ffff88c07fd2f3f0 R10: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000 R13: 0000000003572fff R14: 0000000000100cca R15: 0000000005582fff FS: 0000000000000000(0000) GS:ffff88c07fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000407d00f002 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die+0x78/0xc0 ? page_fault_oops+0x2a8/0x3a0 ? __switch_to+0x133/0x530 ? wq_worker_running+0xa/0x40 ? exc_page_fault+0x63/0x130 ? asm_exc_page_fault+0x22/0x30 ? set_page_extent_mapped+0x20/0xb0 relocate_file_extent_cluster+0x1a7/0x940 relocate_data_extent+0xaf/0x120 relocate_block_group+0x20f/0x480 btrfs_relocate_block_group+0x152/0x320 btrfs_relocate_chunk+0x3d/0x120 btrfs_reclaim_bgs_work+0x2ae/0x4e0 process_scheduled_works+0x184/0x370 worker_thread+0xc6/0x3e0 ? blk_add_timer+0xb0/0xb0 kthread+0xae/0xe0 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork+0x2f/0x40 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork_asm+0x11/0x20 </TASK> This occurs because cleanup_one_transaction() calls destroy_delalloc_inodes() which calls invalidate_inode_pages2() which takes the folio_lock before setting mapping to NULL. We fail to check this, and subsequently call set_extent_mapping(), which assumes that mapping != NULL (in fact it asserts that in debug mode) Note that the "fixes" patch here is not the one that introduced the race (the very first iteration of this code from 2009) but a more recent change that made this particular crash happen in practice. Fixes: e7f1326cc24e ("btrfs: set page extent mapped after read_folio in relocate_one_page") CC: stable(a)vger.kernel.org # 6.1+ Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Boris Burkov <boris(a)bur.io> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/relocation.c [The Evolution from Page to Folio] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/relocation.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index a67dd544a52d..48915256fd8b 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -2732,7 +2732,7 @@ static int relocate_file_extent_cluster(struct inode *inode, PAGE_SIZE); if (ret) goto out; - +again: page = find_lock_page(inode->i_mapping, index); if (!page) { page_cache_sync_readahead(inode->i_mapping, @@ -2769,6 +2769,11 @@ static int relocate_file_extent_cluster(struct inode *inode, ret = -EIO; goto out; } + if (page->mapping != inode->i_mapping) { + unlock_page(page); + put_page(page); + goto again; + } } page_start = page_offset(page); -- 2.39.2

2 1

[PATCH OLK-5.10] drm/i915/hdcp: Add encoder check in hdcp2_get_capability
by He Yujie 13 Jan '25

13 Jan '25

From: Suraj Kandpal <suraj.kandpal(a)intel.com> mainline inclusion from mainline-v6.12-rc1 commit d34f4f058edf1235c103ca9c921dc54820d14d40 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQZ CVE: CVE-2024-53050 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add encoder check in intel_hdcp2_get_capability to avoid null pointer error. Signed-off-by: Suraj Kandpal <suraj.kandpal(a)intel.com> Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240722064451.3610512-3-sura… Conflicts: drivers/gpu/drm/i915/display/intel_hdcp.c drivers/gpu/drm/i915/display/intel_dp_hdcp.c [ Context conflict: 130849f8ec14("drm/i915/hdcp: Use intel_connector as argument for hdcp_2_2_capable") a35239a89259("drm/i915/hdcp: Use correct aux for capability check scenario") 287c0de8b294("drm/i915/hdcp: Move to direct reads for HDCP") 55d9b2b8e440("drm/i915/hdcp: Refactor intel_dp_hdcp2_capable") 8e754d9e9e8a("drm/i915/hdcp: Rename hdcp capable functions") the above patches are not merge. ] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/i915/display/intel_hdcp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/display/intel_hdcp.c b/drivers/gpu/drm/i915/display/intel_hdcp.c index 17a8c2e73a82..020dff600883 100644 --- a/drivers/gpu/drm/i915/display/intel_hdcp.c +++ b/drivers/gpu/drm/i915/display/intel_hdcp.c @@ -86,7 +86,7 @@ bool intel_hdcp_capable(struct intel_connector *connector) /* Is HDCP2.2 capable on Platform and Sink */ bool intel_hdcp2_capable(struct intel_connector *connector) { - struct intel_digital_port *dig_port = intel_attached_dig_port(connector); + struct intel_digital_port *dig_port; struct drm_i915_private *dev_priv = to_i915(connector->base.dev); struct intel_hdcp *hdcp = &connector->hdcp; bool capable = false; @@ -103,6 +103,11 @@ bool intel_hdcp2_capable(struct intel_connector *connector) } mutex_unlock(&dev_priv->hdcp_comp_mutex); + if (!intel_attached_encoder(connector)) + return false; + + dig_port = intel_attached_dig_port(connector); + /* Sink's capability for HDCP2.2 */ hdcp->shim->hdcp_2_2_capable(dig_port, &capable); -- 2.34.1

2 1

[PATCH OLK-5.10] octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
by He Yujie 13 Jan '25

13 Jan '25

From: Dipendra Khadka <kdipendra88(a)gmail.com> stable inclusion from stable-v5.10.231 commit 5ff9de1f2712cbca53da2e37d831eea7ffcb43b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGGI CVE: CVE-2024-56728 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c ] Add error pointer check after calling otx2_mbox_get_rsp(). Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool") Fixes: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support") Signed-off-by: Dipendra Khadka <kdipendra88(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c [ Context conflict: d0cf9503e908 ("octeontx2-pf: ethtool fec mode support") is not merged ] Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c index 196354c142fe..43642eab200a 100644 --- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c +++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c @@ -264,6 +264,11 @@ static void otx2_get_pauseparam(struct net_device *netdev, if (!otx2_sync_mbox_msg(&pfvf->mbox)) { rsp = (struct cgx_pause_frm_cfg *) otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr); + if (IS_ERR(rsp)) { + mutex_unlock(&pfvf->mbox.lock); + return; + } + pause->rx_pause = rsp->rx_pause; pause->tx_pause = rsp->tx_pause; } -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
by He Yujie 13 Jan '25

13 Jan '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v5.10.231 commit b017697a517f8779ada4e8ce1c2c75dbf60a2636 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQZ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cd45e963e44b0f10d90b9e6c0e8b4f47f3c92471 upstream. Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints". This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints. This patch (of 2): It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled. This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller. Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place. So this solves the issue by eliminating the touch_buffer() call itself. Link: https://lkml.kernel.org/r/20241106160811.3316-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20241106160811.3316-2-konishi.ryusuke@gmail.com Fixes: 5305cb830834 ("block: add block_{touch|dirty}_buffer tracepoint") Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: Ubisectech Sirius <bugreport(a)valiantsec.com> Closes: https://lkml.kernel.org/r/86bd3013-887e-4e38-960f-ca45c657f032.bugreport@va… Reported-by: syzbot+9982fb8d18eba905abe2(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9982fb8d18eba905abe2 Tested-by: syzbot+9982fb8d18eba905abe2(a)syzkaller.appspotmail.com Cc: Tejun Heo <tj(a)kernel.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- fs/nilfs2/page.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index 80f1f371d729..d2d6d5c761e8 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -39,7 +39,6 @@ __nilfs_get_page_block(struct page *page, unsigned long block, pgoff_t index, first_block = (unsigned long)index << (PAGE_SHIFT - blkbits); bh = nilfs_page_get_nth_block(page, block - first_block); - touch_buffer(bh); wait_on_buffer(bh); return bh; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix rt warning
by Zheng Zucheng 13 Jan '25

13 Jan '25

Zheng Zucheng (2): sched/rt: Fix rt_runtime leaks with cpu hotplug sched: Replace WARN_ON_ONCE to printk_deferred_once kernel/sched/rt.c | 14 ++++++++++---- kernel/sched/sched.h | 2 +- 2 files changed, 11 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-25.03 0/1] etmem: fix use-after-free of mm in the scan release process
by chenrenhui 13 Jan '25

13 Jan '25

etmem: fix use-after-free of mm in the scan release process chenrenhui (1): etmem: fix use-after-free of mm in the scan release process fs/proc/etmem_proc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6] LoongArch: Fix sleeping in atomic context for PREEMPT_RT
by Xiaomeng Zhang 13 Jan '25

13 Jan '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v6.6.66 commit c5f89458a2ea0800866b9fc690d3fa8367dc8f8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP8 CVE: CVE-2024-56585 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 88fd2b70120d52c1010257d36776876941375490 ] Commit bab1c299f3945ffe79 ("LoongArch: Fix sleeping in atomic context in setup_tlb_handler()") changes the gfp flag from GFP_KERNEL to GFP_ATOMIC for alloc_pages_node(). However, for PREEMPT_RT kernels we can still get a "sleeping in atomic context" error: [ 0.372259] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 0.372266] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 [ 0.372268] preempt_count: 1, expected: 0 [ 0.372270] RCU nest depth: 1, expected: 1 [ 0.372272] 3 locks held by swapper/1/0: [ 0.372274] #0: 900000000c9f5e60 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x524/0x1c60 [ 0.372294] #1: 90000000087013b8 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x50/0x140 [ 0.372305] #2: 900000047fffd388 (&zone->lock){+.+.}-{3:3}, at: __rmqueue_pcplist+0x30c/0xea0 [ 0.372314] irq event stamp: 0 [ 0.372316] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 0.372322] hardirqs last disabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 [ 0.372329] softirqs last enabled at (0): [<9000000005947320>] copy_process+0x9c0/0x26e0 [ 0.372335] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 0.372341] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.12.0-rc7+ #1891 [ 0.372346] Hardware name: Loongson Loongson-3A5000-7A1000-1w-CRB/Loongson-LS3A5000-7A1000-1w-CRB, BIOS vUDK2018-LoongArch-V2.0.0-prebeta9 10/21/2022 [ 0.372349] Stack : 0000000000000089 9000000005a0db9c 90000000071519c8 9000000100388000 [ 0.372486] 900000010038b890 0000000000000000 900000010038b898 9000000007e53788 [ 0.372492] 900000000815bcc8 900000000815bcc0 900000010038b700 0000000000000001 [ 0.372498] 0000000000000001 4b031894b9d6b725 00000000055ec000 9000000100338fc0 [ 0.372503] 00000000000000c4 0000000000000001 000000000000002d 0000000000000003 [ 0.372509] 0000000000000030 0000000000000003 00000000055ec000 0000000000000003 [ 0.372515] 900000000806d000 9000000007e53788 00000000000000b0 0000000000000004 [ 0.372521] 0000000000000000 0000000000000000 900000000c9f5f10 0000000000000000 [ 0.372526] 90000000076f12d8 9000000007e53788 9000000005924778 0000000000000000 [ 0.372532] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 [ 0.372537] ... [ 0.372540] Call Trace: [ 0.372542] [<9000000005924778>] show_stack+0x38/0x180 [ 0.372548] [<90000000071519c4>] dump_stack_lvl+0x94/0xe4 [ 0.372555] [<900000000599b880>] __might_resched+0x1a0/0x260 [ 0.372561] [<90000000071675cc>] rt_spin_lock+0x4c/0x140 [ 0.372565] [<9000000005cbb768>] __rmqueue_pcplist+0x308/0xea0 [ 0.372570] [<9000000005cbed84>] get_page_from_freelist+0x564/0x1c60 [ 0.372575] [<9000000005cc0d98>] __alloc_pages_noprof+0x218/0x1820 [ 0.372580] [<900000000593b36c>] tlb_init+0x1ac/0x298 [ 0.372585] [<9000000005924b74>] per_cpu_trap_init+0x114/0x140 [ 0.372589] [<9000000005921964>] cpu_probe+0x4e4/0xa60 [ 0.372592] [<9000000005934874>] start_secondary+0x34/0xc0 [ 0.372599] [<900000000715615c>] smpboot_entry+0x64/0x6c This is because in PREEMPT_RT kernels normal spinlocks are replaced by rt spinlocks and rt_spin_lock() will cause sleeping. Fix it by disabling NUMA optimization completely for PREEMPT_RT kernels. Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- arch/loongarch/mm/tlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/loongarch/mm/tlb.c b/arch/loongarch/mm/tlb.c index 5fcda8adf90d..5503d4e4b096 100644 --- a/arch/loongarch/mm/tlb.c +++ b/arch/loongarch/mm/tlb.c @@ -289,7 +289,7 @@ static void setup_tlb_handler(int cpu) /* Avoid lockdep warning */ rcu_cpu_starting(cpu); -#ifdef CONFIG_NUMA +#if defined(CONFIG_NUMA) && !defined(CONFIG_PREEMPT_RT) vec_sz = sizeof(exception_handlers); if (pcpu_handlers[cpu]) -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: put bpf_link's program when link is safe to be deallocated
by Tengda Wu 13 Jan '25

13 Jan '25

From: Andrii Nakryiko <andrii(a)kernel.org> stable inclusion from stable-v6.6.66 commit 5fe23c57abadfd46a7a66e81f3536e4757252a0b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBHAY1 CVE: CVE-2024-56786 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f44ec8733a8469143fde1984b5e6931b2e2f6f3f ] In general, BPF link's underlying BPF program should be considered to be reachable through attach hook -> link -> prog chain, and, pessimistically, we have to assume that as long as link's memory is not safe to free, attach hook's code might hold a pointer to BPF program and use it. As such, it's not (generally) correct to put link's program early before waiting for RCU GPs to go through. More eager bpf_prog_put() that we currently do is mostly correct due to BPF program's release code doing similar RCU GP waiting, but as will be shown in the following patches, BPF program can be non-sleepable (and, thus, reliant on only "classic" RCU GP), while BPF link's attach hook can have sleepable semantics and needs to be protected by RCU Tasks Trace, and for such cases BPF link has to go through RCU Tasks Trace + "classic" RCU GPs before being deallocated. And so, if we put BPF program early, we might free BPF program before we free BPF link, leading to use-after-free situation. So, this patch defers bpf_prog_put() until we are ready to perform bpf_link's deallocation. At worst, this delays BPF program freeing by one extra RCU GP, but that seems completely acceptable. Alternatively, we'd need more elaborate ways to determine BPF hook, BPF link, and BPF program lifetimes, and how they relate to each other, which seems like an unnecessary complication. Note, for most BPF links we still will perform eager bpf_prog_put() and link dealloc, so for those BPF links there are no observable changes whatsoever. Only BPF links that use deferred dealloc might notice slightly delayed freeing of BPF programs. Also, to reduce code and logic duplication, extract program put + link dealloc logic into bpf_link_dealloc() helper. Link: https://lore.kernel.org/20241101181754.782341-1-andrii@kernel.org Tested-by: Jordan Rife <jrife(a)google.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/bpf/syscall.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index d5eb3a3edb31..46ef10fddd98 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -2877,12 +2877,24 @@ void bpf_link_inc(struct bpf_link *link) atomic64_inc(&link->refcnt); } +static void bpf_link_dealloc(struct bpf_link *link) +{ + /* now that we know that bpf_link itself can't be reached, put underlying BPF program */ + if (link->prog) + bpf_prog_put(link->prog); + + /* free bpf_link and its containing memory */ + if (link->ops->dealloc_deferred) + link->ops->dealloc_deferred(link); + else + link->ops->dealloc(link); +} + static void bpf_link_defer_dealloc_rcu_gp(struct rcu_head *rcu) { struct bpf_link *link = container_of(rcu, struct bpf_link, rcu); - /* free bpf_link and its containing memory */ - link->ops->dealloc_deferred(link); + bpf_link_dealloc(link); } static void bpf_link_defer_dealloc_mult_rcu_gp(struct rcu_head *rcu) @@ -2904,7 +2916,6 @@ static void bpf_link_free(struct bpf_link *link) sleepable = link->prog->aux->sleepable; /* detach BPF program, clean up used resources */ ops->release(link); - bpf_prog_put(link->prog); } if (ops->dealloc_deferred) { /* schedule BPF link deallocation; if underlying BPF program @@ -2915,8 +2926,9 @@ static void bpf_link_free(struct bpf_link *link) call_rcu_tasks_trace(&link->rcu, bpf_link_defer_dealloc_mult_rcu_gp); else call_rcu(&link->rcu, bpf_link_defer_dealloc_rcu_gp); - } else if (ops->dealloc) - ops->dealloc(link); + } else if (ops->dealloc) { + bpf_link_dealloc(link); + } } static void bpf_link_put_deferred(struct work_struct *work) -- 2.34.1

2 1

[PATCH OLK-6.6] net: stmmac: fix TSO DMA API usage causing oops
by GONG Ruiqi 13 Jan '25

13 Jan '25

From: "Russell King (Oracle)" <rmk+kernel(a)armlinux.org.uk> stable inclusion from stable-v6.6.68 commit db3667c9bbfbbf5de98e6c9542f7e03fb5243286 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBFBOF CVE: CVE-2024-56719 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4c49f38e20a57f8abaebdf95b369295b153d1f8e ] Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members to be later in stmmac_tso_xmit(). The buf (dma cookie) and len stored in this structure are passed to dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that the dma cookie passed to dma_unmap_single() is the same as the value returned from dma_map_single(). However, by moving the assignment later, this is not the case when priv->dma_cap.addr64 > 32 as "des" is offset by proto_hdr_len. This causes problems such as: dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed and with DMA_API_DEBUG enabled: DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes] Fix this by maintaining "des" as the original DMA cookie, and use tso_des to pass the offset DMA cookie to stmmac_tso_allocator(). Full details of the crashes can be found at: https://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/ https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5t… Reported-by: Jon Hunter <jonathanh(a)nvidia.com> Reported-by: Thierry Reding <thierry.reding(a)gmail.com> Fixes: 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") Tested-by: Jon Hunter <jonathanh(a)nvidia.com> Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Reviewed-by: Furong Xu <0x1207(a)gmail.com> Link: https://patch.msgid.link/E1tJXcx-006N4Z-PC@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index ee81e2215487..80acff8b69e9 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -4136,9 +4136,9 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) int tmp_pay_len = 0, first_tx; struct stmmac_tx_queue *tx_q; bool has_vlan, set_ic; + dma_addr_t tso_des, des; u8 proto_hdr_len, hdr; u32 pay_len, mss; - dma_addr_t des; int i; tx_q = &priv->dma_conf.tx_queue[queue]; @@ -4223,14 +4223,15 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) /* If needed take extra descriptors to fill the remaining payload */ tmp_pay_len = pay_len - TSO_MAX_BUFF_SIZE; + tso_des = des; } else { stmmac_set_desc_addr(priv, first, des); tmp_pay_len = pay_len; - des += proto_hdr_len; + tso_des = des + proto_hdr_len; pay_len = 0; } - stmmac_tso_allocator(priv, des, tmp_pay_len, (nfrags == 0), queue); + stmmac_tso_allocator(priv, tso_des, tmp_pay_len, (nfrags == 0), queue); /* In case two or more DMA transmit descriptors are allocated for this * non-paged SKB data, the DMA buffer address should be saved to -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1367/1367] drivers/watchdog/menz69_wdt.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 13 Jan '25

13 Jan '25

Hi Johannes, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: 81ceed41d0c2b2c9300de7bc30c1451680257f52 [1367/1367] watchdog: add driver for the MEN 16z069 IP-Core config: x86_64-buildonly-randconfig-006-20250103 (https://download.01.org/0day-ci/archive/20250113/202501130418.3jlucwx1-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250113/202501130418.3jlucwx1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501130418.3jlucwx1-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/watchdog/menz69_wdt.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1402/1402] block/blk-mq-sched.c:219:5: warning: no previous prototype for function '__blk_mq_sched_dispatch_requests'
by kernel test robot 12 Jan '25

12 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: c1ea82c0ddde70d5998c2f547520afbee10bea2a [1402/1402] block: Limit number of items taken from the I/O scheduler in one go config: x86_64-buildonly-randconfig-004-20250109 (https://download.01.org/0day-ci/archive/20250112/202501120938.POMOjCGU-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250112/202501120938.POMOjCGU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501120938.POMOjCGU-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from block/blk-mq-sched.c:8: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> block/blk-mq-sched.c:219:5: warning: no previous prototype for function '__blk_mq_sched_dispatch_requests' [-Wmissing-prototypes] 219 | int __blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx) | ^ block/blk-mq-sched.c:219:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 219 | int __blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx) | ^ | static 2 warnings generated. vim +/__blk_mq_sched_dispatch_requests +219 block/blk-mq-sched.c 218 > 219 int __blk_mq_sched_dispatch_requests(struct blk_mq_hw_ctx *hctx) 220 { 221 struct request_queue *q = hctx->queue; 222 struct elevator_queue *e = q->elevator; 223 const bool has_sched_dispatch = e && e->type->ops.mq.dispatch_request; 224 int ret = 0; 225 LIST_HEAD(rq_list); 226 227 /* 228 * If we have previous entries on our dispatch list, grab them first for 229 * more fair dispatch. 230 */ 231 if (!list_empty_careful(&hctx->dispatch)) { 232 spin_lock(&hctx->lock); 233 if (!list_empty(&hctx->dispatch)) 234 list_splice_init(&hctx->dispatch, &rq_list); 235 spin_unlock(&hctx->lock); 236 } 237 238 /* 239 * Only ask the scheduler for requests, if we didn't have residual 240 * requests from the dispatch list. This is to avoid the case where 241 * we only ever dispatch a fraction of the requests available because 242 * of low device queue depth. Once we pull requests out of the IO 243 * scheduler, we can no longer merge or sort them. So it's best to 244 * leave them there for as long as we can. Mark the hw queue as 245 * needing a restart in that case. 246 * 247 * We want to dispatch from the scheduler if there was nothing 248 * on the dispatch list or we were able to dispatch from the 249 * dispatch list. 250 */ 251 if (!list_empty(&rq_list)) { 252 blk_mq_sched_mark_restart_hctx(hctx); 253 if (blk_mq_dispatch_rq_list(q, &rq_list, false)) { 254 if (has_sched_dispatch) 255 ret = blk_mq_do_dispatch_sched(hctx); 256 else 257 ret = blk_mq_do_dispatch_ctx(hctx); 258 } 259 } else if (has_sched_dispatch) { 260 ret = blk_mq_do_dispatch_sched(hctx); 261 } else if (hctx->dispatch_busy) { 262 /* dequeue request one by one from sw queue if queue is busy */ 263 ret = blk_mq_do_dispatch_ctx(hctx); 264 } else { 265 blk_mq_flush_busy_ctxs(hctx, &rq_list); 266 blk_mq_dispatch_rq_list(q, &rq_list, false); 267 } 268 269 return ret; 270 } 271 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1402/1402] block/genhd.c:642:5: warning: no previous prototype for function 'disk_scan_partitions'
by kernel test robot 12 Jan '25

12 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: cdfb5c11ad89867cd28c903369fbfebe3f36ca26 [1402/1402] block: fix kabi broken in ioctl.c config: x86_64-buildonly-randconfig-004-20250109 (https://download.01.org/0day-ci/archive/20250112/202501120735.0h1eqZAy-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250112/202501120735.0h1eqZAy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501120735.0h1eqZAy-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from block/genhd.c:10: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> block/genhd.c:642:5: warning: no previous prototype for function 'disk_scan_partitions' [-Wmissing-prototypes] 642 | int disk_scan_partitions(struct gendisk *disk, fmode_t mode) | ^ block/genhd.c:642:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 642 | int disk_scan_partitions(struct gendisk *disk, fmode_t mode) | ^ | static 2 warnings generated. block/genhd.c:533: warning: Function parameter or member 'devt' not described in 'blk_invalidate_devt' vim +/disk_scan_partitions +642 block/genhd.c d2bf1b6723ed0ea Tejun Heo 2010-12-08 641 efc73feb2901d27 Christoph Hellwig 2023-04-07 @642 int disk_scan_partitions(struct gendisk *disk, fmode_t mode) b9484a857f600ca Yu Kuai 2022-08-09 643 { b9484a857f600ca Yu Kuai 2022-08-09 644 struct block_device *bdev; efc73feb2901d27 Christoph Hellwig 2023-04-07 645 int ret; b9484a857f600ca Yu Kuai 2022-08-09 646 efc73feb2901d27 Christoph Hellwig 2023-04-07 647 if (!disk_part_scan_enabled(disk)) efc73feb2901d27 Christoph Hellwig 2023-04-07 648 return -EINVAL; b9484a857f600ca Yu Kuai 2022-08-09 649 b9484a857f600ca Yu Kuai 2022-08-09 650 bdev = bdget_disk(disk, 0); b9484a857f600ca Yu Kuai 2022-08-09 651 if (!bdev) efc73feb2901d27 Christoph Hellwig 2023-04-07 652 return -ENOMEM; b9484a857f600ca Yu Kuai 2022-08-09 653 b9484a857f600ca Yu Kuai 2022-08-09 654 bdev->bd_invalidated = 1; efc73feb2901d27 Christoph Hellwig 2023-04-07 655 efc73feb2901d27 Christoph Hellwig 2023-04-07 656 ret = blkdev_get(bdev, mode, NULL); efc73feb2901d27 Christoph Hellwig 2023-04-07 657 if (!ret) efc73feb2901d27 Christoph Hellwig 2023-04-07 658 blkdev_put(bdev, mode); efc73feb2901d27 Christoph Hellwig 2023-04-07 659 efc73feb2901d27 Christoph Hellwig 2023-04-07 660 return ret; fbbec472351c994 Christoph Hellwig 2023-04-07 661 } fbbec472351c994 Christoph Hellwig 2023-04-07 662 :::::: The code at line 642 was first introduced by commit :::::: efc73feb2901d27dcd01fa859d1378aee42850aa block: merge disk_scan_partitions and blkdev_reread_part :::::: TO: Christoph Hellwig <hch(a)lst.de> :::::: CC: Yongqiang Liu <duanzi(a)zju.edu.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1402/1402] block/bio-integrity.c:41:6: warning: no previous prototype for function '__bio_integrity_free'
by kernel test robot 12 Jan '25

12 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: f9c4e7b09f7d51f9256fe51b9c40657cd7302530 [1402/1402] block: release bip in a right way in error path config: x86_64-buildonly-randconfig-004-20250109 (https://download.01.org/0day-ci/archive/20250112/202501120402.JKRrtYy6-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250112/202501120402.JKRrtYy6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501120402.JKRrtYy6-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from block/bio-integrity.c:23: In file included from include/linux/blkdev.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> block/bio-integrity.c:41:6: warning: no previous prototype for function '__bio_integrity_free' [-Wmissing-prototypes] 41 | void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) | ^ block/bio-integrity.c:41:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 41 | void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) | ^ | static 2 warnings generated. block/bio-integrity.o: warning: objtool: missing symbol for section .init.text vim +/__bio_integrity_free +41 block/bio-integrity.c 40 > 41 void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) 42 { 43 if (bs && mempool_initialized(&bs->bio_integrity_pool)) { 44 if (bip->bip_vec) 45 bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, 46 bip->bip_slab); 47 mempool_free(bip, &bs->bio_integrity_pool); 48 } else { 49 kfree(bip); 50 } 51 } 52 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1395/1395] arch/x86/kvm/vmx.o: warning: objtool: copy_shadow_to_vmcs12()+0x13e: unreachable instruction
by kernel test robot 11 Jan '25

11 Jan '25

Hi Paolo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 97f98c391a1fd153ae010a2faf73f9e03270da6e commit: f98a0954a8ca618f8d94da7f6d52c1a93e6717bb [1395/1395] KVM: nVMX: do not use dangling shadow VMCS after guest reset config: x86_64-buildonly-randconfig-003-20250108 (https://download.01.org/0day-ci/archive/20250111/202501112054.wCj5DExm-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250111/202501112054.wCj5DExm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501112054.wCj5DExm-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/x86/kvm/vmx.c:55: In file included from arch/x86/include/asm/mmu_context.h:12: In file included from arch/x86/include/asm/pgalloc.h:7: include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kvm/vmx.c:4508:6: warning: variable 'vmx_msr_low' set but not used [-Wunused-but-set-variable] 4508 | u32 vmx_msr_low, vmx_msr_high; | ^ arch/x86/kvm/vmx.c:70:32: warning: unused variable 'vmx_cpu_id' [-Wunused-const-variable] 70 | static const struct x86_cpu_id vmx_cpu_id[] = { | ^~~~~~~~~~ 3 warnings generated. >> arch/x86/kvm/vmx.o: warning: objtool: copy_shadow_to_vmcs12()+0x13e: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/7] merge HULK-6.6 patches into OLK-6.6
by Kaixiong Yu 11 Jan '25

11 Jan '25

merge HULK-6.6 CVE patches into OLK-6.6 CVE-No as listed: CVE-2024-56715 CVE-2024-56610 CVE-2024-56617 CVE-2024-53105 CVE-2024-53109 CVE-2024-53056 Brett Creeley (1): ionic: Fix netdev notifier unregister on failure Dan Carpenter (1): drm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy() Hajime Tazaki (1): nommu: pass NULL argument to vma_iter_prealloc() Lorenzo Stoakes (1): mm: refactor map_deny_write_exec() Marco Elver (1): kcsan: Turn report_filterlist_lock into a raw_spinlock Ricardo Neri (1): cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU Roman Gushchin (1): mm: page_alloc: move mlocked flag clearance into free_pages_prepare() drivers/base/cacheinfo.c | 14 ++-- drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 3 +- .../net/ethernet/pensando/ionic/ionic_lif.c | 4 +- include/linux/mman.h | 21 +++++- kernel/kcsan/debugfs.c | 74 +++++++++---------- mm/mmap.c | 2 +- mm/mprotect.c | 2 +- mm/nommu.c | 2 +- mm/page_alloc.c | 15 ++++ mm/swap.c | 14 ---- 10 files changed, 83 insertions(+), 68 deletions(-) -- 2.34.1

2 8

[openeuler:OLK-6.6 1817/1817] drivers/crypto/intel/qat/qat_common/adf_mstate_mgr.h:16:41: warning: '%x' directive output may be truncated writing between 1 and 8 bytes into a region of size 5
by kernel test robot 11 Jan '25

11 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 628e30bc9a3c48a6ab38868cb77fc6497d6ebaa5 commit: 9c362f632151992cafc018d35ccfa745ba4c087e [1817/1817] crypto: qat - implement interface for live migration config: x86_64-randconfig-104-20250111 (https://download.01.org/0day-ci/archive/20250111/202501111843.Tclxgyrp-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250111/202501111843.Tclxgyrp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501111843.Tclxgyrp-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:16: drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c: In function 'adf_gen4_vfmig_load_state': >> drivers/crypto/intel/qat/qat_common/adf_mstate_mgr.h:16:41: warning: '%x' directive output may be truncated writing between 1 and 8 bytes into a region of size 5 [-Wformat-truncation=] 16 | #define ADF_MSTATE_BANK_IDX_IDS "bnk" | ^~~~~ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:381:46: note: in expansion of macro 'ADF_MSTATE_BANK_IDX_IDS' 381 | snprintf(bank_ids, sizeof(bank_ids), ADF_MSTATE_BANK_IDX_IDS "%x", bank_nr); | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:608:71: note: format string is defined here 608 | snprintf(bank_ids, sizeof(bank_ids), ADF_MSTATE_BANK_IDX_IDS "%x", bank_nr); | ^~ In file included from drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:16: drivers/crypto/intel/qat/qat_common/adf_mstate_mgr.h:16:41: note: directive argument in the range [0, 2147483646] 16 | #define ADF_MSTATE_BANK_IDX_IDS "bnk" | ^~~~~ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:381:46: note: in expansion of macro 'ADF_MSTATE_BANK_IDX_IDS' 381 | snprintf(bank_ids, sizeof(bank_ids), ADF_MSTATE_BANK_IDX_IDS "%x", bank_nr); | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:381:9: note: 'snprintf' output between 5 and 12 bytes into a destination of size 8 381 | snprintf(bank_ids, sizeof(bank_ids), ADF_MSTATE_BANK_IDX_IDS "%x", bank_nr); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:16: drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c: In function 'adf_gen4_vfmig_save_etr': >> drivers/crypto/intel/qat/qat_common/adf_mstate_mgr.h:16:41: warning: '%x' directive output may be truncated writing between 1 and 8 bytes into a region of size 5 [-Wformat-truncation=] 16 | #define ADF_MSTATE_BANK_IDX_IDS "bnk" | ^~~~~ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:608:46: note: in expansion of macro 'ADF_MSTATE_BANK_IDX_IDS' 608 | snprintf(bank_ids, sizeof(bank_ids), ADF_MSTATE_BANK_IDX_IDS "%x", bank_nr); | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:608:71: note: format string is defined here 608 | snprintf(bank_ids, sizeof(bank_ids), ADF_MSTATE_BANK_IDX_IDS "%x", bank_nr); | ^~ In file included from drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:16: drivers/crypto/intel/qat/qat_common/adf_mstate_mgr.h:16:41: note: directive argument in the range [0, 2147483646] 16 | #define ADF_MSTATE_BANK_IDX_IDS "bnk" | ^~~~~ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:608:46: note: in expansion of macro 'ADF_MSTATE_BANK_IDX_IDS' 608 | snprintf(bank_ids, sizeof(bank_ids), ADF_MSTATE_BANK_IDX_IDS "%x", bank_nr); | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c:608:9: note: 'snprintf' output between 5 and 12 bytes into a destination of size 8 608 | snprintf(bank_ids, sizeof(bank_ids), ADF_MSTATE_BANK_IDX_IDS "%x", bank_nr); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +16 drivers/crypto/intel/qat/qat_common/adf_mstate_mgr.h 15 > 16 #define ADF_MSTATE_BANK_IDX_IDS "bnk" 17 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0