- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10] BUILD REGRESSION 8c45ad1b4135b7bbeb7c208ce99391363bd666f7
by kernel test robot 28 Mar '25

28 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 8c45ad1b4135b7bbeb7c208ce99391363bd666f7 !15595 io_uring: prevent opcode speculation Unverified Error/Warning (likely false positive, kindly check if interested): drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.o: warning: objtool: st_lsm6dsx_shub_wait_complete() falls through to next function st_lsm6dsx_shub_read_output() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_copy_buffer() falls through to next function scale_line() drivers/media/test-drivers/vivid/vivid-kthread-cap.o: warning: objtool: vivid_thread_vid_cap_tick() falls through to next function plane_vaddr() fs/btrfs/free-space-cache.o: warning: objtool: add_bytes_to_bitmap() falls through to next function tree_insert_offset() fs/btrfs/free-space-tree.o: warning: objtool: update_free_space_extent_count() falls through to next function alloc_bitmap() fs/ufs/balloc.o: warning: objtool: ufs_free_fragments() falls through to next function ufs_clusteracct() Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-004-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-005-20250327 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-101-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-102-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-103-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-104-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() | |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20250326 | |-- drivers-iio-imu-st_lsm6dsx-st_lsm6dsx_shub.o:warning:objtool:st_lsm6dsx_shub_wait_complete-falls-through-to-next-function-st_lsm6dsx_shub_read_output() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_copy_buffer-falls-through-to-next-function-scale_line() | |-- drivers-media-test-drivers-vivid-vivid-kthread-cap.o:warning:objtool:vivid_thread_vid_cap_tick-falls-through-to-next-function-plane_vaddr() | |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-tree_insert_offset() | `-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-alloc_bitmap() |-- x86_64-randconfig-121-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250328 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static `-- x86_64-randconfig-161-20250327 |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- drivers-gpu-drm-bridge-tc358768.o:warning:objtool:tc358768_bridge_pre_enable-falls-through-to-next-function-tc358768_bridge_enable() |-- fs-btrfs-free-space-cache.o:warning:objtool:add_bytes_to_bitmap-falls-through-to-next-function-recalculate_thresholds() |-- fs-btrfs-free-space-cache.o:warning:objtool:bitmap_clear_bits-falls-through-to-next-function-free_bitmap() |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() |-- fs-btrfs-free-space-cache.o:warning:objtool:setup_cluster_bitmap-falls-through-to-next-function-btrfs_init_free_cluster() |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() |-- fs-btrfs-free-space-tree.o:warning:objtool:update_free_space_extent_count-falls-through-to-next-function-add_new_free_space_info() |-- fs-ufs-balloc.o:warning:objtool:ufs_free_fragments-falls-through-to-next-function-ufs_clusteracct() |-- fs-ufs-ialloc.o:warning:objtool:ufs_new_inode-falls-through-to-next-function-ufs2_init_inodes_chunk() |-- fs-ufs-inode.o:warning:objtool:ufs_iget-falls-through-to-next-function-ufs_set_inode_ops() |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory `-- net-ceph-striper.o:warning:objtool:ceph_calc_file_object_mapping-falls-through-to-next-function-ceph_file_to_extents() elapsed time: 1455m configs tested: 17 configs skipped: 128 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250327 gcc-5.5.0 arm64 randconfig-002-20250327 clang-21 arm64 randconfig-003-20250327 clang-21 arm64 randconfig-004-20250327 clang-21 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250327 gcc-12 x86_64 buildonly-randconfig-002-20250327 gcc-12 x86_64 buildonly-randconfig-003-20250327 clang-20 x86_64 buildonly-randconfig-004-20250327 clang-20 x86_64 buildonly-randconfig-005-20250327 gcc-12 x86_64 buildonly-randconfig-006-20250327 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1525/1525] drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 28 Mar '25

28 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3f8283040b83a49bdad8dc3dd4ccd3f50910af28 commit: b8c0480a3eba11ee6616019a3aaa75ee38f06f02 [1525/1525] svm: serach dts to init children device config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280904.ByoMg5CF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280904.ByoMg5CF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/char/svm.c:353:35: sparse: sparse: Using plain integer as NULL pointer vim +353 drivers/char/svm.c 221 222 static int svm_init_core(struct svm_device *sdev) 223 { 224 int err = 0; 225 struct device *dev = sdev->dev; 226 struct acpi_device *adev = ACPI_COMPANION(sdev->dev); 227 struct acpi_device *cdev = NULL; 228 int id = 0; 229 230 down_write(&svm_sem); 231 if (!svm_bus_type.iommu_ops) { 232 err = bus_register(&svm_bus_type); 233 if (err) { 234 up_write(&svm_sem); 235 dev_err(dev, "failed to register svm_bus_type\n"); 236 return err; 237 } 238 239 err = bus_set_iommu(&svm_bus_type, dev->bus->iommu_ops); 240 if (err) { 241 up_write(&svm_sem); 242 dev_err(dev, "failed to set iommu for svm_bus_type\n"); 243 goto err_unregister_bus; 244 } 245 } else if (svm_bus_type.iommu_ops != dev->bus->iommu_ops) { 246 err = -EBUSY; 247 up_write(&svm_sem); 248 dev_err(dev, "iommu_ops configured, but changed!\n"); 249 goto err_unregister_bus; 250 } 251 up_write(&svm_sem); 252 253 list_for_each_entry(cdev, &adev->children, node) { 254 err = svm_acpi_add_core(sdev, cdev, id++); 255 if (err) 256 device_for_each_child(dev, NULL, svm_remove_core); 257 } 258 259 return err; 260 261 err_unregister_bus: 262 bus_unregister(&svm_bus_type); 263 264 return err; 265 } 266 #else 267 static int svm_of_add_core(struct svm_device *sdev, struct device_node *np) 268 { 269 int err; 270 struct resource res; 271 struct core_device *cdev = NULL; 272 char *name = NULL; 273 274 name = devm_kasprintf(sdev->dev, GFP_KERNEL, "svm%llu_%s", 275 sdev->id, np->name); 276 if (name == NULL) 277 return -ENOMEM; 278 279 cdev = kzalloc(sizeof(*cdev), GFP_KERNEL); 280 if (cdev == NULL) 281 return -ENOMEM; 282 283 cdev->dev.of_node = np; 284 cdev->dev.parent = sdev->dev; 285 cdev->dev.bus = &svm_bus_type; 286 cdev->dev.release = cdev_device_release; 287 cdev->smmu_bypass = of_property_read_bool(np, "hisi,smmu_bypass"); 288 dev_set_name(&cdev->dev, "%s", name); 289 290 err = device_register(&cdev->dev); 291 if (err) { 292 dev_info(&cdev->dev, "core_device register failed\n"); 293 put_device(&cdev->dev); 294 kfree(cdev); 295 return err; 296 } 297 298 err = of_dma_configure(&cdev->dev, np, true); 299 if (err) { 300 dev_dbg(&cdev->dev, "of_dma_configure failed\n"); 301 goto err_unregister_dev; 302 } 303 304 err = of_address_to_resource(np, 0, &res); 305 if (err) { 306 dev_info(&cdev->dev, "no reg, FW should install the sid\n"); 307 } else { 308 /* If the reg specified, install sid for the core */ 309 void __iomem *core_base = NULL; 310 int sid = cdev->dev.iommu_fwspec->ids[0]; 311 312 core_base = ioremap(res.start, resource_size(&res)); 313 if (core_base == NULL) { 314 err = -ENOMEM; 315 dev_err(&cdev->dev, "ioremap failed\n"); 316 goto err_unregister_dev; 317 } 318 319 writel_relaxed(sid, core_base + CORE_SID); 320 iounmap(core_base); 321 } 322 323 /* If core device is smmu bypass, request direct map. */ 324 if (cdev->smmu_bypass) { 325 err = iommu_request_dm_for_dev(&cdev->dev); 326 if (err) 327 goto err_unregister_dev; 328 329 return 0; 330 } 331 332 cdev->group = iommu_group_get(&cdev->dev); 333 if (IS_ERR_OR_NULL(cdev->group)) { 334 err = -ENXIO; 335 dev_err(&cdev->dev, "smmu is not right configured\n"); 336 goto err_unregister_dev; 337 } 338 339 cdev->domain = iommu_domain_alloc(sdev->dev->bus); 340 if (cdev->domain == NULL) { 341 err = -ENOMEM; 342 dev_info(&cdev->dev, "failed to alloc domain\n"); 343 goto err_unregister_dev; 344 } 345 346 err = iommu_attach_group(cdev->domain, cdev->group); 347 if (err) { 348 dev_err(&cdev->dev, "failed group to domain\n"); 349 goto err_free_domain; 350 } 351 352 err = iommu_sva_device_init(&cdev->dev, IOMMU_SVA_FEAT_IOPF, > 353 UINT_MAX, 0); 354 if (err) { 355 dev_err(&cdev->dev, "failed to init sva device\n"); 356 goto err_detach_group; 357 } 358 359 return 0; 360 361 err_detach_group: 362 iommu_detach_group(cdev->domain, cdev->group); 363 err_free_domain: 364 iommu_domain_free(cdev->domain); 365 err_unregister_dev: 366 device_unregister(&cdev->dev); 367 368 return err; 369 } 370 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2063/2063] error: unknown target ABI 'ilp32'
by kernel test robot 28 Mar '25

28 Mar '25

Hi Andrew, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b28aab59b06935f0d1c9bce8f013f25b4094764d commit: f9b54a6714445cde83aeff0318cf767b3b81229d [2063/2063] arm64:ilp32: add ARM64_ILP32 to Kconfig config: arm64-randconfig-r112-20250328 (https://download.01.org/0day-ci/archive/20250328/202503280313.olFyEFIT-lkp@…) compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project c2692afc0a92cd5da140dfcdfff7818a5b8ce997) reproduce: (https://download.01.org/0day-ci/archive/20250328/202503280313.olFyEFIT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503280313.olFyEFIT-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/asm-offsets.c:12: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2168: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. arch/arm64/kernel/vdso-ilp32/Makefile:84: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:87: FORCE prerequisite is missing arch/arm64/kernel/vdso-ilp32/Makefile:90: FORCE prerequisite is missing >> clang: warning: -Wl,-soname=linux-ilp32-vdso.so.1: 'linker' input unused [-Wunused-command-line-argument] >> error: unknown target ABI 'ilp32' >> error: unknown target ABI 'ilp32' make[3]: *** [scripts/Makefile.build:373: arch/arm64/kernel/vdso-ilp32/vdso-ilp32.lds] Error 1 make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:84: arch/arm64/kernel/vdso-ilp32/vgettimeofday-ilp32.o] Error 1 >> error: error: unknown target ABI 'ilp32' unknown target ABI 'ilp32' make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:87: arch/arm64/kernel/vdso-ilp32/note-ilp32.o] Error 1 make[3]: *** [arch/arm64/kernel/vdso-ilp32/Makefile:90: arch/arm64/kernel/vdso-ilp32/sigreturn-ilp32.o] Error 1 make[3]: Target 'include/generated/vdso-ilp32-offsets.h' not remade because of errors. make[2]: *** [arch/arm64/Makefile:201: vdso_prepare] Error 2 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 make: Target 'prepare' not remade because of errors. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-21858
by Zhang Changzhong 27 Mar '25

27 Mar '25

Kuniyuki Iwashima (2): geneve: Fix use-after-free in geneve_find_dev(). geneve: Suppress list corruption splat in geneve_destroy_tunnels(). drivers/net/geneve.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) -- 2.9.5

2 3

[openeuler:openEuler-1.0-LTS 1523/1523] fs/.tmp_select.o: warning: objtool: poll_select_finish()+0x1aa: can't find switch jump table
by kernel test robot 27 Mar '25

27 Mar '25

Hi Oleg, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 44ae3d3e5f1f99c0fd5f040e4da88b0c5b3ec76b [1523/1523] select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() config: x86_64-buildonly-randconfig-004-20250327 (https://download.01.org/0day-ci/archive/20250327/202503272038.iOCRCuV8-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503272038.iOCRCuV8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503272038.iOCRCuV8-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/.tmp_select.o: warning: objtool: poll_select_finish()+0x1aa: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ARM: versatile: Add missing of_node_put in dcscb_init
by Peng Zhang 27 Mar '25

27 Mar '25

From: Peng Wu <wupeng58(a)huawei.com> stable inclusion from stable-v4.19.247 commit a0fc05cd17617e63fc13ad0c01f3f0afd890d8ec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP128 CVE: CVE-2022-49457 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit 23b44f9c649bbef10b45fa33080cd8b4166800ae ] The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak. Signed-off-by: Peng Wu <wupeng58(a)huawei.com> Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Link: https://lore.kernel.org/r/20220428230356.69418-1-linus.walleij@linaro.org' Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- arch/arm/mach-vexpress/dcscb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-vexpress/dcscb.c b/arch/arm/mach-vexpress/dcscb.c index ee2a0faafaa1..aaade91f6551 100644 --- a/arch/arm/mach-vexpress/dcscb.c +++ b/arch/arm/mach-vexpress/dcscb.c @@ -146,6 +146,7 @@ static int __init dcscb_init(void) if (!node) return -ENODEV; dcscb_base = of_iomap(node, 0); + of_node_put(node); if (!dcscb_base) return -EADDRNOTAVAIL; cfg = readl_relaxed(dcscb_base + DCS_CFG_R); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
by Peng Zhang 27 Mar '25

27 Mar '25

From: Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> stable inclusion from stable-v4.19.238 commit f04a520a422222fc921bf035dc67414c500a286a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3SR CVE: CVE-2022-49247 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit fbe04b49a54e31f4321d632270207f0e6304cd16 ] If the callback 'start_streaming' fails, then all queued buffers in the driver should be returned with state 'VB2_BUF_STATE_QUEUED'. Currently, they are returned with 'VB2_BUF_STATE_ERROR' which is wrong. Fix this. This also fixes the warning: [ 65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6 [ 65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G W 5.16.0-rc4-62408-g32447129cb30-dirty #14 [ 65.590293] Hardware name: Radxa ROCK Pi 4B (DT) [ 65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common] [ 65.592395] sp : ffff800012bc3ad0 [ 65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8 [ 65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612 [ 65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0 [ 65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff [ 65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78 [ 65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce [ 65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228 [ 65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78 [ 65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880 [ 65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0 [ 65.598940] Call trace: [ 65.599155] vb2_start_streaming+0xd4/0x160 [videobuf2_common] [ 65.599672] vb2_core_streamon+0x17c/0x1a8 [videobuf2_common] [ 65.600179] vb2_streamon+0x54/0x88 [videobuf2_v4l2] [ 65.600619] vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2] [ 65.601103] v4l_streamon+0x3c/0x50 [videodev] [ 65.601521] __video_do_ioctl+0x1a4/0x428 [videodev] [ 65.601977] video_usercopy+0x320/0x828 [videodev] [ 65.602419] video_ioctl2+0x3c/0x58 [videodev] [ 65.602830] v4l2_ioctl+0x60/0x90 [videodev] [ 65.603227] __arm64_sys_ioctl+0xa8/0xe0 [ 65.603576] invoke_syscall+0x54/0x118 [ 65.603911] el0_svc_common.constprop.3+0x84/0x100 [ 65.604332] do_el0_svc+0x34/0xa0 [ 65.604625] el0_svc+0x1c/0x50 [ 65.604897] el0t_64_sync_handler+0x88/0xb0 [ 65.605264] el0t_64_sync+0x16c/0x170 [ 65.605587] ---[ end trace 578e0ba07742170d ]--- Fixes: 8ac456495a33d ("[media] stk1160: Stop device and unqueue buffers when start_streaming() fails") Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld(a)collabora.com> Reviewed-by: Ezequiel Garcia <ezequiel(a)vanguardiasur.com.ar> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/usb/stk1160/stk1160-core.c | 2 +- drivers/media/usb/stk1160/stk1160-v4l.c | 10 +++++----- drivers/media/usb/stk1160/stk1160.h | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c index 468f5ccf4ae6..685872f8b306 100644 --- a/drivers/media/usb/stk1160/stk1160-core.c +++ b/drivers/media/usb/stk1160/stk1160-core.c @@ -413,7 +413,7 @@ static void stk1160_disconnect(struct usb_interface *interface) /* Here is the only place where isoc get released */ stk1160_uninit_isoc(dev); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); video_unregister_device(&dev->vdev); v4l2_device_disconnect(&dev->v4l2_dev); diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c index 504e413edcd2..381f9f189bb7 100644 --- a/drivers/media/usb/stk1160/stk1160-v4l.c +++ b/drivers/media/usb/stk1160/stk1160-v4l.c @@ -269,7 +269,7 @@ static int stk1160_start_streaming(struct stk1160 *dev) stk1160_uninit_isoc(dev); out_stop_hw: usb_set_interface(dev->udev, 0, 0); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); mutex_unlock(&dev->v4l_lock); @@ -317,7 +317,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) stk1160_stop_hw(dev); - stk1160_clear_queue(dev); + stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); stk1160_dbg("streaming stopped\n"); @@ -762,7 +762,7 @@ static const struct video_device v4l_template = { /********************************************************************/ /* Must be called with both v4l_lock and vb_queue_lock hold */ -void stk1160_clear_queue(struct stk1160 *dev) +void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) { struct stk1160_buffer *buf; unsigned long flags; @@ -773,7 +773,7 @@ void stk1160_clear_queue(struct stk1160 *dev) buf = list_first_entry(&dev->avail_bufs, struct stk1160_buffer, list); list_del(&buf->list); - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); stk1160_dbg("buffer [%p/%d] aborted\n", buf, buf->vb.vb2_buf.index); } @@ -783,7 +783,7 @@ void stk1160_clear_queue(struct stk1160 *dev) buf = dev->isoc_ctl.buf; dev->isoc_ctl.buf = NULL; - vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); + vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); stk1160_dbg("buffer [%p/%d] aborted\n", buf, buf->vb.vb2_buf.index); } diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h index acd1c811db08..54a046aacd33 100644 --- a/drivers/media/usb/stk1160/stk1160.h +++ b/drivers/media/usb/stk1160/stk1160.h @@ -177,7 +177,7 @@ struct regval { int stk1160_vb2_setup(struct stk1160 *dev); int stk1160_video_register(struct stk1160 *dev); void stk1160_video_unregister(struct stk1160 *dev); -void stk1160_clear_queue(struct stk1160 *dev); +void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); /* Provided by stk1160-video.c */ int stk1160_alloc_isoc(struct stk1160 *dev); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
by Peng Zhang 27 Mar '25

27 Mar '25

From: Zekun Shen <bruceshenzk(a)gmail.com> stable inclusion from stable-v4.19.238 commit 25efc5d03455c3839249bc77fce5e29ecb54677e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5YP CVE: CVE-2021-47633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------- [ Upstream commit 564d4eceb97eaf381dd6ef6470b06377bb50c95a ] The bug was found during fuzzing. Stacktrace locates it in ath5k_eeprom_convert_pcal_info_5111. When none of the curve is selected in the loop, idx can go up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound. pd = &chinfo[pier].pd_curves[idx]; There are many OOB writes using pd later in the code. So I added a sanity check for idx. Checks for other loops involving AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not used outside the loops. The patch is NOT tested with real device. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] Write of size 1 at addr ffff8880174a4d60 by task modprobe/214 CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1 Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] __kasan_report.cold+0x37/0x7c ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] kasan_report+0xe/0x20 ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k] ath5k_eeprom_init+0x2513/0x6290 [ath5k] ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] ? usleep_range+0xb8/0x100 ? apic_timer_interrupt+0xa/0x20 ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k] ath5k_hw_init+0xb60/0x1970 [ath5k] ath5k_init_ah+0x6fe/0x2530 [ath5k] ? kasprintf+0xa6/0xe0 ? ath5k_stop+0x140/0x140 [ath5k] ? _dev_notice+0xf6/0xf6 ? apic_timer_interrupt+0xa/0x20 ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k] ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] ? mutex_lock+0x89/0xd0 ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] local_pci_probe+0xd3/0x160 pci_device_probe+0x23f/0x3e0 ? pci_device_remove+0x280/0x280 ? pci_device_remove+0x280/0x280 really_probe+0x209/0x5d0 Reported-by: Brendan Dolan-Gavitt <brendandg(a)nyu.edu> Signed-off-by: Zekun Shen <bruceshenzk(a)gmail.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/YckvDdj3mtCkDRIt@a-10-27-26-18.dynapool.vpn.nyu.e… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/net/wireless/ath/ath5k/eeprom.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c index 94d34ee02265..01163b333945 100644 --- a/drivers/net/wireless/ath/ath5k/eeprom.c +++ b/drivers/net/wireless/ath/ath5k/eeprom.c @@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, } } + if (idx == AR5K_EEPROM_N_PD_CURVES) + goto err_out; + ee->ee_pd_gains[mode] = 1; pd = &chinfo[pier].pd_curves[idx]; -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1523/1523] ERROR: "ata_dev_same_device" [drivers/scsi/libsas/libsas.ko] undefined!
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: d856ec500c97835c591ffacc005f514509f1a931 [1523/1523] scsi: libsas: check if the same sata device when flutter config: x86_64-buildonly-randconfig-005-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271838.22rCFdNn-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271838.22rCFdNn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271838.22rCFdNn-lkp@intel.com/ All errors (new ones prefixed by >>): >> ERROR: "ata_dev_same_device" [drivers/scsi/libsas/libsas.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1520/1520] arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.
by kernel test robot 27 Mar '25

27 Mar '25

Hi Peter, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 3acbac72baea337e0ac79801a8ba4b81e3b67014 [1520/1520] x86/speculation: Change FILL_RETURN_BUFFER to work with objtool config: x86_64-randconfig-161-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271858.j6vJ9Bhc-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271858.j6vJ9Bhc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271858.j6vJ9Bhc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e1: unsupported intra-function call >> arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V2 0/3] add support DVMBM in HIP12
by Jinqian Yang 27 Mar '25

27 Mar '25

Patch#1 kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE Patch#2 kvm: hisi_virt: Update TLBI broadcast feature for hip12 Patch#3 KVM: arm64: Add new HiSi CPU type to support DVMBM Xiang Chen (1): kvm: hisi_virt: Update TLBI broadcast feature for hip12 yangjinqian (2): kvm: hisi_virt: fix kernel panic when enable DVMBM in nVHE KVM: arm64: Add new HiSi CPU type to support DVMBM arch/arm64/kvm/hisilicon/hisi_virt.c | 72 ++++++++++++++++++++++++++-- arch/arm64/kvm/hisilicon/hisi_virt.h | 8 ++++ 2 files changed, 76 insertions(+), 4 deletions(-) -- 2.33.0

2 4

[openeuler:openEuler-1.0-LTS 1523/1523] drivers/edac/skx_common.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: e34047f6dc606c123911c6db8fa424bb4a035262 [1523/1523] EDAC, skx_edac: Delete duplicated code config: x86_64-buildonly-randconfig-002-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271455.zeSbmwpC-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271455.zeSbmwpC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271455.zeSbmwpC-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/edac/skx_common.c: In function 'skx_mce_output_error': drivers/edac/skx_common.c:470:15: warning: variable 'type' set but not used [-Wunused-but-set-variable] 470 | char *type, *optype; | ^~~~ >> drivers/edac/skx_common.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 27 Mar '25

27 Mar '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1523/1523] net/netfilter/nft_nat.c:165:23: warning: 'alen' may be used uninitialized in this function
by kernel test robot 27 Mar '25

27 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 1a53a31cdd778dfc49a1bf495394238cb9de9bef [1523/1523] netfilter: nft_nat: allow to specify layer 4 protocol NAT only config: arm64-randconfig-004-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271418.7nn4LU8p-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271418.7nn4LU8p-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271418.7nn4LU8p-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): net/netfilter/nft_nat.c: In function 'nft_nat_init': >> net/netfilter/nft_nat.c:165:23: warning: 'alen' may be used uninitialized in this function [-Wmaybe-uninitialized] 165 | err = nft_validate_register_load(priv->sreg_addr_min, alen); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/alen +165 net/netfilter/nft_nat.c 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 116 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 117 static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 118 const struct nlattr * const tb[]) 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 119 { 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 120 struct nft_nat *priv = nft_expr_priv(expr); d07db9884a5fba Patrick McHardy 2015-04-11 121 unsigned int alen, plen; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 122 u32 family; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 123 int err; 75e8d06d430843 Pablo Neira Ayuso 2015-01-14 124 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 125 if (tb[NFTA_NAT_TYPE] == NULL || 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 126 (tb[NFTA_NAT_REG_ADDR_MIN] == NULL && 5c819a39753d6a Pablo Neira Ayuso 2014-10-16 127 tb[NFTA_NAT_REG_PROTO_MIN] == NULL)) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 128 return -EINVAL; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 129 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 130 switch (ntohl(nla_get_be32(tb[NFTA_NAT_TYPE]))) { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 131 case NFT_NAT_SNAT: eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 132 priv->type = NF_NAT_MANIP_SRC; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 133 break; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 134 case NFT_NAT_DNAT: eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 135 priv->type = NF_NAT_MANIP_DST; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 136 break; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 137 default: cc8272882c3dad Pablo Neira Ayuso 2020-09-22 138 return -EOPNOTSUPP; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 139 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 140 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 141 if (tb[NFTA_NAT_FAMILY] == NULL) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 142 return -EINVAL; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 143 a4c2e8beba8432 Patrick McHardy 2014-03-07 144 family = ntohl(nla_get_be32(tb[NFTA_NAT_FAMILY])); 36596dadf54a92 Pablo Neira Ayuso 2018-01-09 145 if (family != ctx->family) a4c2e8beba8432 Patrick McHardy 2014-03-07 146 return -EOPNOTSUPP; d07db9884a5fba Patrick McHardy 2015-04-11 147 d07db9884a5fba Patrick McHardy 2015-04-11 148 switch (family) { d07db9884a5fba Patrick McHardy 2015-04-11 149 case NFPROTO_IPV4: d07db9884a5fba Patrick McHardy 2015-04-11 150 alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip); d07db9884a5fba Patrick McHardy 2015-04-11 151 break; d07db9884a5fba Patrick McHardy 2015-04-11 152 case NFPROTO_IPV6: d07db9884a5fba Patrick McHardy 2015-04-11 153 alen = FIELD_SIZEOF(struct nf_nat_range, min_addr.ip6); d07db9884a5fba Patrick McHardy 2015-04-11 154 break; d07db9884a5fba Patrick McHardy 2015-04-11 155 default: 1a53a31cdd778d Pablo Neira Ayuso 2021-10-25 156 if (tb[NFTA_NAT_REG_ADDR_MIN]) d07db9884a5fba Patrick McHardy 2015-04-11 157 return -EAFNOSUPPORT; 1a53a31cdd778d Pablo Neira Ayuso 2021-10-25 158 break; d07db9884a5fba Patrick McHardy 2015-04-11 159 } a4c2e8beba8432 Patrick McHardy 2014-03-07 160 priv->family = family; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 161 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 162 if (tb[NFTA_NAT_REG_ADDR_MIN]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 163 priv->sreg_addr_min = b1c96ed37ceeef Patrick McHardy 2015-04-11 164 nft_parse_register(tb[NFTA_NAT_REG_ADDR_MIN]); d07db9884a5fba Patrick McHardy 2015-04-11 @165 err = nft_validate_register_load(priv->sreg_addr_min, alen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 166 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 167 return err; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 168 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 169 if (tb[NFTA_NAT_REG_ADDR_MAX]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 170 priv->sreg_addr_max = b1c96ed37ceeef Patrick McHardy 2015-04-11 171 nft_parse_register(tb[NFTA_NAT_REG_ADDR_MAX]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 172 d07db9884a5fba Patrick McHardy 2015-04-11 173 err = nft_validate_register_load(priv->sreg_addr_max, d07db9884a5fba Patrick McHardy 2015-04-11 174 alen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 175 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 176 return err; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 177 } else { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 178 priv->sreg_addr_max = priv->sreg_addr_min; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 179 } 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 180 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 181 d07db9884a5fba Patrick McHardy 2015-04-11 182 plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 183 if (tb[NFTA_NAT_REG_PROTO_MIN]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 184 priv->sreg_proto_min = b1c96ed37ceeef Patrick McHardy 2015-04-11 185 nft_parse_register(tb[NFTA_NAT_REG_PROTO_MIN]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 186 d07db9884a5fba Patrick McHardy 2015-04-11 187 err = nft_validate_register_load(priv->sreg_proto_min, plen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 188 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 189 return err; eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 190 eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 191 if (tb[NFTA_NAT_REG_PROTO_MAX]) { 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 192 priv->sreg_proto_max = b1c96ed37ceeef Patrick McHardy 2015-04-11 193 nft_parse_register(tb[NFTA_NAT_REG_PROTO_MAX]); 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 194 d07db9884a5fba Patrick McHardy 2015-04-11 195 err = nft_validate_register_load(priv->sreg_proto_max, d07db9884a5fba Patrick McHardy 2015-04-11 196 plen); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 197 if (err < 0) eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 198 return err; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 199 } else { eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 200 priv->sreg_proto_max = priv->sreg_proto_min; 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 201 } 61cfac6b42af98 Pablo Neira Ayuso 2014-10-16 202 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 203 e42eff8a32f8b7 Arturo Borrero 2014-09-04 204 if (tb[NFTA_NAT_FLAGS]) { e42eff8a32f8b7 Arturo Borrero 2014-09-04 205 priv->flags = ntohl(nla_get_be32(tb[NFTA_NAT_FLAGS])); e42eff8a32f8b7 Arturo Borrero 2014-09-04 206 if (priv->flags & ~NF_NAT_RANGE_MASK) cc8272882c3dad Pablo Neira Ayuso 2020-09-22 207 return -EOPNOTSUPP; e42eff8a32f8b7 Arturo Borrero 2014-09-04 208 } e42eff8a32f8b7 Arturo Borrero 2014-09-04 209 20afd423976ef3 Florian Westphal 2016-11-15 210 return nf_ct_netns_get(ctx->net, family); eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 211 } eb31628e37a0a4 Tomasz Bursztyka 2013-10-10 212 :::::: The code at line 165 was first introduced by commit :::::: d07db9884a5fba8c8020166c86183c79a18d066a netfilter: nf_tables: introduce nft_validate_register_load() :::::: TO: Patrick McHardy <kaber(a)trash.net> :::::: CC: Pablo Neira Ayuso <pablo(a)netfilter.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1523/1523] include/asm-generic/atomic-instrumented.h:33:9: warning: 'wait_req' may be used uninitialized
by kernel test robot 27 Mar '25

27 Mar '25

Hi Ryusuke, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 69d39b683755039471781fee8dc7ed96952f771b commit: 6741506ca02825b90e77088e8fce01c3d02edfdd [1523/1523] nilfs2: fix unexpected freezing of nilfs_segctor_sync() config: x86_64-buildonly-randconfig-001-20250327 (https://download.01.org/0day-ci/archive/20250327/202503271341.WPxyfHvo-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250327/202503271341.WPxyfHvo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503271341.WPxyfHvo-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from arch/x86/include/asm/atomic.h:265, from include/linux/atomic.h:7, from arch/x86/include/asm/thread_info.h:54, from include/linux/thread_bits.h:22, from include/linux/thread_info.h:14, from arch/x86/include/asm/preempt.h:7, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/mmzone.h:9, from include/linux/gfp.h:6, from include/linux/mm.h:11, from include/linux/pagemap.h:8, from fs/nilfs2/segment.c:11: In function 'atomic_set', inlined from 'nilfs_segctor_sync' at fs/nilfs2/segment.c:2175:2: >> include/asm-generic/atomic-instrumented.h:33:9: warning: 'wait_req' may be used uninitialized [-Wmaybe-uninitialized] 33 | kasan_check_write(v, sizeof(*v)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:265, from include/asm-generic/bug.h:5, from arch/x86/include/asm/bug.h:83, from include/linux/bug.h:5, from include/linux/mmdebug.h:5, from include/linux/mm.h:10: include/linux/kasan-checks.h: In function 'nilfs_segctor_sync': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ fs/nilfs2/segment.c:2170:43: note: 'wait_req' declared here 2170 | struct nilfs_segctor_wait_request wait_req; | ^~~~~~~~ vim +/wait_req +33 include/asm-generic/atomic-instrumented.h b06ed71a624ba0 Dmitry Vyukov 2018-01-29 30 b06ed71a624ba0 Dmitry Vyukov 2018-01-29 31 static __always_inline void atomic_set(atomic_t *v, int i) b06ed71a624ba0 Dmitry Vyukov 2018-01-29 32 { a35353bb9eb199 Dmitry Vyukov 2018-01-29 @33 kasan_check_write(v, sizeof(*v)); b06ed71a624ba0 Dmitry Vyukov 2018-01-29 34 arch_atomic_set(v, i); b06ed71a624ba0 Dmitry Vyukov 2018-01-29 35 } b06ed71a624ba0 Dmitry Vyukov 2018-01-29 36 :::::: The code at line 33 was first introduced by commit :::::: a35353bb9eb1990a44a0d7585f99e9589bcdb682 locking/atomic, asm-generic: Add KASAN instrumentation to atomic operations :::::: TO: Dmitry Vyukov <dvyukov(a)google.com> :::::: CC: Ingo Molnar <mingo(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] cifs: Revert two patches to prevent statistics leakage on the lo device.
by Wang Zhaolong 26 Mar '25

26 Mar '25

Wang Zhaolong (2): Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" Revert "smb: client: fix TCP timers deadlock after rmmod" fs/cifs/connect.c | 33 +++++++++------------------------ 1 file changed, 9 insertions(+), 24 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION 0d616a77cb5f7198cca524a24f717f59ad51b41b
by kernel test robot 26 Mar '25

26 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0d616a77cb5f7198cca524a24f717f59ad51b41b !15379 bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503252017.UYNRpRjt-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503252115.VoLdAs0Z-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260202.467f83vo-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260613.Q2n0VF4Y-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503260949.1ZCW1y7H-lkp@intel.com arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function [-Werror=return-type] block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction drivers/media/pci/intel/ipu3/ipu3-cio2.o: warning: objtool: cio2_subdev_get_fmt()+0x8a: unreachable instruction drivers/pci/endpoint/functions/pci-epf-test.o: warning: objtool: pci_epf_test_cmd_handler()+0x429: unreachable instruction io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction mm/slab_common.o: warning: objtool: kmalloc_slab()+0x63: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-001-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- arm64-randconfig-003-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpgbe-rnpgbe_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-net-ethernet-mucse-rnpm-rnpm_mbx_fw.h:warning:implicit-truncation-from-int-to-a-one-bit-wide-bit-field-changes-value-from-to | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_file_name-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_driver_log.c:error:unused-function-time_for_log-Werror-Wunused-function | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_HDD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CLEAR_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_DISABLE_ALL_MASK-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_CMD_ENABLE_MSIX-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_MASK_DISABLE-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_INTERRUPT_STATUS_EXIST_IRQ-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:error:unused-variable-PS3_SSD_IOPS_MSIX_VECTORS-Werror-Wunused-const-variable | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_mgrq_resend-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_raid_qos_waitq_notify-Werror-Wmissing-prototypes | `-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:error:unused-function-ps3_scsih_dev_id_get-Werror-Wunused-function |-- x86_64-buildonly-randconfig-001-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-002-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-003-20250325 | |-- arch-x86-kernel-paravirt.c:error:control-reaches-end-of-non-void-function | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-buildonly-randconfig-005-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-bio.o:warning:objtool:bvec_alloc:unreachable-instruction | |-- drivers-media-pci-intel-ipu3-ipu3-cio2.o:warning:objtool:cio2_subdev_get_fmt:unreachable-instruction | |-- drivers-pci-endpoint-functions-pci-epf-test.o:warning:objtool:pci_epf_test_cmd_handler:unreachable-instruction | |-- io_uring-io_uring.o:warning:objtool:__io_uring_free:unreachable-instruction | |-- kernel-rcu-tree.o:warning:objtool:rcu_iw_handler:unreachable-instruction | |-- kernel-rcu-update.o:warning:objtool:synchronize_rcu_tasks_rude:unreachable-instruction | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-slab_common.o:warning:objtool:kmalloc_slab:unreachable-instruction |-- x86_64-buildonly-randconfig-006-20250325 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-102-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | `-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- x86_64-randconfig-121-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-media-tuners-e4000.o:warning:objtool:e4000_set_params-falls-through-to-next-function-e4000_standby() | |-- drivers-mtd-nand-raw-cadence-nand-controller.o:warning:objtool:cadence_nand_setup_interface-falls-through-to-next-function-cadence_nand_read_page() | |-- drivers-net-virtio_net.o:warning:objtool:virtnet_set_affinity-falls-through-to-next-function-virtnet_clean_affinity() | |-- drivers-nvdimm-namespace_devs.o:warning:objtool:size_store-falls-through-to-next-function-nd_namespace_label_update() | |-- fs-btrfs-free-space-cache.o:warning:objtool:btrfs_alloc_from_cluster-falls-through-to-next-function-btrfs_find_space_cluster() | |-- fs-btrfs-free-space-cache.o:warning:objtool:steal_from_bitmap-falls-through-to-next-function-link_free_space() | |-- fs-btrfs-free-space-tree.o:warning:objtool:modify_free_space_bitmap-falls-through-to-next-function-free_space_test_bit() | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- mm-vmscan.o:warning:objtool:do_shrink_slab-falls-through-to-next-function-allow_direct_reclaim() |-- x86_64-randconfig-122-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250325 | `-- net-core-sock_map.c:sparse:sparse:symbol-sock_map_prog_lookup-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250326 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static `-- x86_64-randconfig-161-20250325 `-- mm-memcontrol.c-uncharge_page()-error:uninitialized-symbol-objcg-. elapsed time: 1462m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250325 gcc-9.5.0 arm64 randconfig-002-20250325 clang-18 arm64 randconfig-003-20250325 gcc-7.5.0 arm64 randconfig-004-20250325 clang-20 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250325 gcc-12 x86_64 buildonly-randconfig-002-20250325 clang-20 x86_64 buildonly-randconfig-003-20250325 gcc-12 x86_64 buildonly-randconfig-004-20250325 gcc-12 x86_64 buildonly-randconfig-005-20250325 clang-20 x86_64 buildonly-randconfig-006-20250325 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
by Gu Bowen 26 Mar '25

26 Mar '25

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.247 commit a3660e06675bccec4bf149c7229ea1d491ba10d7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VC CVE: CVE-2022-49478 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 471bec68457aaf981add77b4f590d65dd7da1059 ] Syzbot reported that -1 is used as array index. The problem was in missing validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work. Reported-and-tested-by: syzbot+1a247e36149ffd709a9b(a)syzkaller.appspotmail.com Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c index fcb201a40920..3fb2cfe583e8 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c @@ -2561,6 +2561,11 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, } while (0); mutex_unlock(&pvr2_unit_mtx); + INIT_WORK(&hdw->workpoll, pvr2_hdw_worker_poll); + + if (hdw->unit_number == -1) + goto fail; + cnt1 = 0; cnt2 = scnprintf(hdw->name+cnt1,sizeof(hdw->name)-cnt1,"pvrusb2"); cnt1 += cnt2; @@ -2572,8 +2577,6 @@ struct pvr2_hdw *pvr2_hdw_create(struct usb_interface *intf, if (cnt1 >= sizeof(hdw->name)) cnt1 = sizeof(hdw->name)-1; hdw->name[cnt1] = 0; - INIT_WORK(&hdw->workpoll,pvr2_hdw_worker_poll); - pvr2_trace(PVR2_TRACE_INIT,"Driver unit number is %d, name is %s", hdw->unit_number,hdw->name); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tty: goldfish: Fix free_irq() on remove
by Gu Bowen 26 Mar '25

26 Mar '25

From: Vincent Whitchurch <vincent.whitchurch(a)axis.com> stable inclusion from stable-v4.19.249 commit c83a1d40dc624070a203eb383ef9fb60eb634136 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP33Y CVE: CVE-2022-49724 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 499e13aac6c762e1e828172b0f0f5275651d6512 ] Pass the correct dev_id to free_irq() to fix this splat when the driver is unbound: WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq Trying to free already-free IRQ 65 Call Trace: warn_slowpath_fmt free_irq goldfish_tty_remove platform_remove device_remove device_release_driver_internal device_driver_detach unbind_store drv_attr_store ... Fixes: 465893e18878e119 ("tty: goldfish: support platform_device with id -1") Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Link: https://lore.kernel.org/r/20220609141704.1080024-1-vincent.whitchurch@axis.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/tty/goldfish.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/goldfish.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index ed0f3a7b8fe5..48ea55beaf43 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -427,7 +427,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) tty_unregister_device(goldfish_tty_driver, qtty->console.index); iounmap(qtty->base); qtty->base = NULL; - free_irq(qtty->irq, pdev); + free_irq(qtty->irq, qtty); goldfish_tty_current_line_count--; if (goldfish_tty_current_line_count == 0) goldfish_tty_delete_driver(); -- 2.25.1

2 1

[PATCH OLK-5.10 0/3] bpf: unify array->elem_size usage in arraymap.c and add inner_array_lookup.c selftest
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[PATCH] arm64_mpam: Add prefetch option
by Zeng Heng 26 Mar '25

26 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/mpam.h | 15 +++++ arch/arm64/include/asm/thread_info.h | 4 ++ fs/resctrl/internal.h | 1 + fs/resctrl/rdtgroup.c | 84 ++++++++++++++++++++++++++++ 4 files changed, 104 insertions(+) diff --git a/arch/arm64/include/asm/mpam.h b/arch/arm64/include/asm/mpam.h index 9abe1fe58c34..ac7b6250250c 100644 --- a/arch/arm64/include/asm/mpam.h +++ b/arch/arm64/include/asm/mpam.h @@ -143,16 +143,31 @@ static inline void resctrl_arch_set_rmid(struct task_struct *tsk, u32 rmid) #endif } +#define setbit(x, y) (x |= (1<<y)) +#define clrbit(x, y) (x &= ~(1<<y)) + static inline void mpam_thread_switch(struct task_struct *tsk) { u64 oldregval; int cpu = smp_processor_id(); u64 regval = mpam_get_regval(tsk); + u64 val, val1; if (!IS_ENABLED(CONFIG_ARM64_MPAM) || !static_branch_likely(&mpam_enabled)) return; + asm volatile("mrs %0, S3_1_c15_c6_4" : "=r" (val)); + val1 = val; + + if (task_thread_info(tsk)->prefetch_dis) + setbit(val1, 0); + else + clrbit(val1, 0); + + if (val1 != val) + asm volatile("msr S3_1_c15_c6_4, %0" : : "r"(val1)); + if (regval == READ_ONCE(mpam_resctrl_default_group)) regval = READ_ONCE(per_cpu(arm64_mpam_default, cpu)); diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h index 379d24059f5b..a996caebb08e 100644 --- a/arch/arm64/include/asm/thread_info.h +++ b/arch/arm64/include/asm/thread_info.h @@ -48,7 +48,11 @@ struct thread_info { #endif u32 cpu; +#ifdef CONFIG_ARM64_MPAM + KABI_USE(1, u32 prefetch_dis) +#else KABI_RESERVE(1) +#endif KABI_RESERVE(2) }; diff --git a/fs/resctrl/internal.h b/fs/resctrl/internal.h index fb620beba958..fbc76efa06d9 100644 --- a/fs/resctrl/internal.h +++ b/fs/resctrl/internal.h @@ -173,6 +173,7 @@ struct rdtgroup { struct mongroup mon; enum rdtgrp_mode mode; struct pseudo_lock_region *plr; + u32 prefetch_dis; }; /* List of all resource groups */ diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index 9776b4e2834c..bdf75b75b695 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -822,6 +822,80 @@ static int rdtgroup_tasks_show(struct kernfs_open_file *of, return ret; } +#ifdef CONFIG_ARM64_MPAM +static void update_prefetch_tasks(struct rdtgroup *r, u32 prefetch_dis) +{ + struct task_struct *p, *t; + + rcu_read_lock(); + + for_each_process_thread(p, t) { + if (is_closid_match(t, r) || is_rmid_match(t, r)) { + WRITE_ONCE(task_thread_info(t)->prefetch_dis, prefetch_dis); + /* Update task_struct and will send IPI to target cpu */ + smp_mb(); + update_task_closid_rmid(t); + } + } + + rcu_read_unlock(); +} + +static ssize_t rdtgroup_prefetch_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + u32 prefetch_dis; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (!rdtgrp) { + rdtgroup_kn_unlock(of->kn); + return -ENOENT; + } + rdt_last_cmd_clear(); + + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED || + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) { + ret = -EINVAL; + rdt_last_cmd_puts("Pseudo-locking in progress\n"); + goto unlock; + } + + if (kstrtou32(buf, 0, &prefetch_dis)) { + rdt_last_cmd_printf("Task list parsing error prefetch %s\n", buf); + ret = -EINVAL; + goto unlock; + } + + if (rdtgrp->prefetch_dis != prefetch_dis) { + rdtgrp->prefetch_dis = prefetch_dis; + update_prefetch_tasks(rdtgrp, prefetch_dis); + } + +unlock: + rdtgroup_kn_unlock(of->kn); + + return ret ?: nbytes; +} + +static int rdtgroup_prefetch_show(struct kernfs_open_file *of, + struct seq_file *s, void *v) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (rdtgrp) + seq_printf(s, "%u\n", rdtgrp->prefetch_dis); + else + ret = -ENOENT; + rdtgroup_kn_unlock(of->kn); + + return ret; +} +#endif + static int rdtgroup_closid_show(struct kernfs_open_file *of, struct seq_file *s, void *v) { @@ -1891,6 +1965,16 @@ static struct rftype res_common_files[] = { .seq_show = rdtgroup_tasks_show, .fflags = RFTYPE_BASE, }, +#ifdef CONFIG_ARM64_MPAM + { + .name = "prefetch_dis", + .mode = 0644, + .kf_ops = &rdtgroup_kf_single_ops, + .write = rdtgroup_prefetch_write, + .seq_show = rdtgroup_prefetch_show, + .fflags = RFTYPE_BASE, + }, +#endif { .name = "mon_hw_id", .mode = 0444, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] media: uvcvideo: Remove dangling pointers
by Zhao Yipeng 26 Mar '25

26 Mar '25

From: Ricardo Ribalda <ribalda(a)chromium.org> mainline inclusion from mainline-v6.14-rc1 commit 221cd51efe4565501a3dbf04cc011b537dcce7fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8W CVE: CVE-2024-58002 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled. Cc: stable(a)vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-3-26c867231118@chromium… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/usb/uvc/uvc_ctrl.c drivers/media/usb/uvc/uvc_v4l2.c drivers/media/usb/uvc/uvcvideo.h [The guard() function is not introduced. 'for' loop initial declaration are only allowed in C99 or C11 mode. And other conflicts are contextual due to the commits d9fecd096f67, 9e56380ae625 and d9c8763e6129 not being merged.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/media/usb/uvc/uvc_ctrl.c | 64 +++++++++++++++++++++++++++++++- drivers/media/usb/uvc/uvc_v4l2.c | 2 + drivers/media/usb/uvc/uvcvideo.h | 9 ++++- 3 files changed, 72 insertions(+), 3 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index f2854337cdca..fc02bbcd6245 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1276,6 +1276,40 @@ static void uvc_ctrl_send_slave_event(struct uvc_video_chain *chain, uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes); } +static void uvc_ctrl_set_handle(struct uvc_fh *handle, struct uvc_control *ctrl, + struct uvc_fh *new_handle) +{ + lockdep_assert_held(&handle->chain->ctrl_mutex); + + if (new_handle) { + if (ctrl->handle) + dev_warn_ratelimited(&handle->stream->dev->udev->dev, + "UVC non compliance: Setting an async control with a pending operation."); + + if (new_handle == ctrl->handle) + return; + + if (ctrl->handle) { + WARN_ON(!ctrl->handle->pending_async_ctrls); + if (ctrl->handle->pending_async_ctrls) + ctrl->handle->pending_async_ctrls--; + } + + ctrl->handle = new_handle; + handle->pending_async_ctrls++; + return; + } + + /* Cannot clear the handle for a control not owned by us.*/ + if (WARN_ON(ctrl->handle != handle)) + return; + + ctrl->handle = NULL; + if (WARN_ON(!handle->pending_async_ctrls)) + return; + handle->pending_async_ctrls--; +} + static void uvc_ctrl_status_event_work(struct work_struct *work) { struct uvc_device *dev = container_of(work, struct uvc_device, @@ -1291,7 +1325,8 @@ static void uvc_ctrl_status_event_work(struct work_struct *work) mutex_lock(&chain->ctrl_mutex); handle = ctrl->handle; - ctrl->handle = NULL; + if (handle) + uvc_ctrl_set_handle(handle, ctrl, NULL); list_for_each_entry(mapping, &ctrl->info.mappings, list) { s32 value = __uvc_ctrl_get_value(mapping, w->data); @@ -1684,7 +1719,7 @@ int uvc_ctrl_set(struct uvc_fh *handle, uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT)); if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) - ctrl->handle = handle; + uvc_ctrl_set_handle(handle, ctrl, handle); ctrl->dirty = 1; ctrl->modified = 1; @@ -2330,6 +2365,31 @@ int uvc_ctrl_init_device(struct uvc_device *dev) return 0; } +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle) +{ + struct uvc_entity *entity; + + mutex_lock(&handle->chain->ctrl_mutex); + + if (!handle->pending_async_ctrls) { + mutex_unlock(&handle->chain->ctrl_mutex); + return; + } + + list_for_each_entry(entity, &handle->chain->dev->entities, list) { + unsigned int i; + + for (i = 0; i < entity->ncontrols; ++i) { + if (entity->controls[i].handle != handle) + continue; + uvc_ctrl_set_handle(handle, &entity->controls[i], NULL); + } + } + + WARN_ON(handle->pending_async_ctrls); + mutex_unlock(&handle->chain->ctrl_mutex); +} + /* * Cleanup device controls. */ diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 18a7384b50ee..34b9843cec3a 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -563,6 +563,8 @@ static int uvc_v4l2_release(struct file *file) uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_release\n"); + uvc_ctrl_cleanup_fh(handle); + /* Only free resources if this is a privileged handle. */ if (uvc_has_privileges(handle)) uvc_queue_release(&stream->queue); diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index a738486fd9d6..243caeb4a6d7 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -434,7 +434,11 @@ struct uvc_video_chain { struct uvc_entity *processing; /* Processing unit */ struct uvc_entity *selector; /* Selector unit */ - struct mutex ctrl_mutex; /* Protects ctrl.info */ + struct mutex ctrl_mutex; /* + * Protects ctrl.info, + * ctrl.handle and + * uvc_fh.pending_async_ctrls + */ struct v4l2_prio_state prio; /* V4L2 priority state */ u32 caps; /* V4L2 chain-wide caps */ @@ -626,6 +630,7 @@ struct uvc_fh { struct uvc_video_chain *chain; struct uvc_streaming *stream; enum uvc_handle_state state; + unsigned int pending_async_ctrls; }; struct uvc_driver { @@ -792,6 +797,8 @@ int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl); int uvc_xu_ctrl_query(struct uvc_video_chain *chain, struct uvc_xu_control_query *xqry); +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle); + /* Utility functions */ void uvc_simplify_fraction(u32 *numerator, u32 *denominator, unsigned int n_terms, unsigned int threshold); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 36 +++++++++++++++++++++++++++++++----- 1 file changed, 31 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index cc3308d1c61d..78661186c360 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -383,6 +383,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -396,18 +401,35 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = (BIT(BH_Uptodate) | BIT(BH_Dirty) | BIT(BH_Mapped) | BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); + +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -420,6 +442,10 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); + __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-5.10] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Conflicts due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index d2d6d5c761e8..3b97d2f51ec9 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -390,6 +390,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -402,10 +407,6 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) nilfs_warn(sb, "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = @@ -413,8 +414,28 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | BIT(BH_Delay)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -427,6 +448,9 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-6.6] nilfs2: do not force clear folio if buffer is referenced
by Liu Chuang 26 Mar '25

26 Mar '25

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> mainline inclusion from mainline-v6.14-rc1 commit ca76bb226bf47ff04c782cacbd299f12ddee1ec1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBK0 CVE: CVE-2025-21722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issues reported by syzbot that occurs when the filesystem is corrupted and falls back to read-only, and the associated buffer head use-after-free issue. This patch (of 2): Syzbot has reported that after nilfs2 detects filesystem corruption and falls back to read-only, inconsistencies in the buffer state may occur. One of the inconsistencies is that when nilfs2 calls mark_buffer_dirty() to set a data or metadata buffer as dirty, but it detects that the buffer is not in the uptodate state: WARNING: CPU: 0 PID: 6049 at fs/buffer.c:1177 mark_buffer_dirty+0x2e5/0x520 fs/buffer.c:1177 ... Call Trace: <TASK> nilfs_palloc_commit_alloc_entry+0x4b/0x160 fs/nilfs2/alloc.c:598 nilfs_ifile_create_inode+0x1dd/0x3a0 fs/nilfs2/ifile.c:73 nilfs_new_inode+0x254/0x830 fs/nilfs2/inode.c:344 nilfs_mkdir+0x10d/0x340 fs/nilfs2/namei.c:218 vfs_mkdir+0x2f9/0x4f0 fs/namei.c:4257 do_mkdirat+0x264/0x3a0 fs/namei.c:4280 __do_sys_mkdirat fs/namei.c:4295 [inline] __se_sys_mkdirat fs/namei.c:4293 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4293 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The other is when nilfs_btree_propagate(), which propagates the dirty state to the ancestor nodes of a b-tree that point to a dirty buffer, detects that the origin buffer is not dirty, even though it should be: WARNING: CPU: 0 PID: 5245 at fs/nilfs2/btree.c:2089 nilfs_btree_propagate+0xc79/0xdf0 fs/nilfs2/btree.c:2089 ... Call Trace: <TASK> nilfs_bmap_propagate+0x75/0x120 fs/nilfs2/bmap.c:345 nilfs_collect_file_data+0x4d/0xd0 fs/nilfs2/segment.c:587 nilfs_segctor_apply_buffers+0x184/0x340 fs/nilfs2/segment.c:1006 nilfs_segctor_scan_file+0x28c/0xa50 fs/nilfs2/segment.c:1045 nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1216 [inline] nilfs_segctor_collect fs/nilfs2/segment.c:1540 [inline] nilfs_segctor_do_construct+0x1c28/0x6b90 fs/nilfs2/segment.c:2115 nilfs_segctor_construct+0x181/0x6b0 fs/nilfs2/segment.c:2479 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2587 [inline] nilfs_segctor_thread+0x69e/0xe80 fs/nilfs2/segment.c:2701 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Both of these issues are caused by the callbacks that handle the page/folio write requests, forcibly clear various states, including the working state of the buffers they hold, at unexpected times when they detect read-only fallback. Fix these issues by checking if the buffer is referenced before clearing the page/folio state, and skipping the clear if it is. Link: https://lkml.kernel.org/r/20250107200202.6432-1-konishi.ryusuke@gmail.com Link: https://lkml.kernel.org/r/20250107200202.6432-2-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b2b14916b77acf8626d7 Reported-by: syzbot+d98fd19acd08b36ff422(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=d98fd19acd08b36ff422 Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption") Tested-by: syzbot+b2b14916b77acf8626d7(a)syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/nilfs2/page.c [Conflicts due to previous commits not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- fs/nilfs2/page.c | 34 +++++++++++++++++++++++++++++----- 1 file changed, 29 insertions(+), 5 deletions(-) diff --git a/fs/nilfs2/page.c b/fs/nilfs2/page.c index d2d6d5c761e8..3b97d2f51ec9 100644 --- a/fs/nilfs2/page.c +++ b/fs/nilfs2/page.c @@ -390,6 +390,11 @@ void nilfs_clear_dirty_pages(struct address_space *mapping, bool silent) * nilfs_clear_dirty_page - discard dirty page * @page: dirty page that will be discarded * @silent: suppress [true] or print [false] warning messages + * + * nilfs_clear_dirty_page() clears working states including dirty state for + * the page and its buffers. If the page has buffers, clear only if it is + * confirmed that none of the buffer heads are busy (none have valid + * references and none are locked). */ void nilfs_clear_dirty_page(struct page *page, bool silent) { @@ -402,10 +407,6 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) nilfs_warn(sb, "discard dirty page: offset=%lld, ino=%lu", page_offset(page), inode->i_ino); - ClearPageUptodate(page); - ClearPageMappedToDisk(page); - ClearPageChecked(page); - if (page_has_buffers(page)) { struct buffer_head *bh, *head; const unsigned long clear_bits = @@ -413,8 +414,28 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) BIT(BH_Async_Write) | BIT(BH_NILFS_Volatile) | BIT(BH_NILFS_Checked) | BIT(BH_NILFS_Redirected) | BIT(BH_Delay)); + bool busy, invalidated = false; - bh = head = page_buffers(page); + head = page_buffers(page); +recheck_buffers: + busy = false; + bh = head; + do { + if (atomic_read(&bh->b_count) | buffer_locked(bh)) { + busy = true; + break; + } + } while (bh = bh->b_this_page, bh != head); + + if (busy) { + if (invalidated) + return; + invalidate_bh_lrus(); + invalidated = true; + goto recheck_buffers; + } + + bh = head; do { lock_buffer(bh); if (!silent) @@ -427,6 +448,9 @@ void nilfs_clear_dirty_page(struct page *page, bool silent) } while (bh = bh->b_this_page, bh != head); } + ClearPageUptodate(page); + ClearPageMappedToDisk(page); + ClearPageChecked(page); __nilfs_clear_page_dirty(page); } -- 2.34.1

2 1

[PATCH OLK-6.6] ata: libata-sff: Ensure that we cannot write outside the allocated buffer
by Zheng Qixing 26 Mar '25

26 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> stable inclusion from stable-v6.6.78 commit d5e6e3000309359eae2a17117aa6e3c44897bf6c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5G CVE: CVE-2025-21738 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 6e74e53b34b6dec5a50e1404e2680852ec6768d2 upstream. reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to ATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to write outside the allocated buffer, overwriting random memory. While a ATA device is supposed to abort a ATA_NOP command, there does seem to be a bug either in libata-sff or QEMU, where either this status is not set, or the status is cleared before read by ata_sff_hsm_move(). Anyway, that is most likely a separate bug. Looking at __atapi_pio_bytes(), it already has a safety check to ensure that __atapi_pio_bytes() cannot write outside the allocated buffer. Add a similar check to ata_pio_sector(), such that also ata_pio_sector() cannot write outside the allocated buffer. Cc: stable(a)vger.kernel.org Reported-by: reveliofuzzing <reveliofuzzing(a)gmail.com> Closes: https://lore.kernel.org/linux-ide/CA+-ZZ_jTgxh3bS7m+KX07_EWckSnW3N2adX3KV63… Link: https://lore.kernel.org/r/20250127154303.15567-2-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/ata/libata-sff.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c index 8fcc622fcb3d..9b6529f2dfcb 100644 --- a/drivers/ata/libata-sff.c +++ b/drivers/ata/libata-sff.c @@ -602,7 +602,7 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) { struct ata_port *ap = qc->ap; struct page *page; - unsigned int offset; + unsigned int offset, count; if (!qc->cursg) { qc->curbytes = qc->nbytes; @@ -618,25 +618,27 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) page = nth_page(page, (offset >> PAGE_SHIFT)); offset %= PAGE_SIZE; - trace_ata_sff_pio_transfer_data(qc, offset, qc->sect_size); + /* don't overrun current sg */ + count = min(qc->cursg->length - qc->cursg_ofs, qc->sect_size); + + trace_ata_sff_pio_transfer_data(qc, offset, count); /* * Split the transfer when it splits a page boundary. Note that the * split still has to be dword aligned like all ATA data transfers. */ WARN_ON_ONCE(offset % 4); - if (offset + qc->sect_size > PAGE_SIZE) { + if (offset + count > PAGE_SIZE) { unsigned int split_len = PAGE_SIZE - offset; ata_pio_xfer(qc, page, offset, split_len); - ata_pio_xfer(qc, nth_page(page, 1), 0, - qc->sect_size - split_len); + ata_pio_xfer(qc, nth_page(page, 1), 0, count - split_len); } else { - ata_pio_xfer(qc, page, offset, qc->sect_size); + ata_pio_xfer(qc, page, offset, count); } - qc->curbytes += qc->sect_size; - qc->cursg_ofs += qc->sect_size; + qc->curbytes += count; + qc->cursg_ofs += count; if (qc->cursg_ofs == qc->cursg->length) { qc->cursg = sg_next(qc->cursg); -- 2.39.2

2 1

[PATCH OLK-5.10 0/3] Sidecarless
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[PATCH OLK-6.6] block: don't revert iter for -EIOCBQUEUED
by Zheng Qixing 26 Mar '25

26 Mar '25

From: Jens Axboe <axboe(a)kernel.dk> stable inclusion from stable-v6.6.78 commit 84671b0630ccb46ae9f1f99a45c7d63ffcd6a474 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRECT CVE: CVE-2025-21832 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit b13ee668e8280ca5b07f8ce2846b9957a8a10853 upstream. blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (where bigger than makes more sense), and not checking the return value of blkdev_direct_IO() before doing an iov_iter_revert(). The latter can lead to attempting to revert with a negative value, which when passed to iov_iter_revert() as an unsigned value will lead to throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT. Be sane and don't revert for -EIOCBQUEUED, like what is done in other spots. Cc: stable(a)vger.kernel.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/fops.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/block/fops.c b/block/fops.c index 33b724b1d963..cda9978ebf67 100644 --- a/block/fops.c +++ b/block/fops.c @@ -730,11 +730,12 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to) file_accessed(iocb->ki_filp); ret = blkdev_direct_IO(iocb, to); - if (ret >= 0) { + if (ret > 0) { iocb->ki_pos += ret; count -= ret; } - iov_iter_revert(to, count - iov_iter_count(to)); + if (ret != -EIOCBQUEUED) + iov_iter_revert(to, count - iov_iter_count(to)); if (ret < 0 || !count) goto reexpand; } -- 2.39.2

2 1

[PATCH OLK-5.10 0/3] Sidecarless
by Xiaomeng Zhang 26 Mar '25

26 Mar '25

Andrii Nakryiko (1): bpf: make uniform use of array->elem_size everywhere in arraymap.c Rhys Rustad-Elliott (2): bpf: Fix elem_size not being set for inner maps selftests/bpf: Add access_inner_map selftest kernel/bpf/arraymap.c | 14 +++--- kernel/bpf/map_in_map.c | 8 +++- .../bpf/prog_tests/inner_array_lookup.c | 31 +++++++++++++ .../selftests/bpf/progs/inner_array_lookup.c | 45 +++++++++++++++++++ 4 files changed, 90 insertions(+), 8 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/inner_array_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/inner_array_lookup.c -- 2.34.1

2 4

[openeuler:OLK-5.10 2821/2821] block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 958384da6a734ebe7a49d0fafcea86968390e9d9 [2821/2821] block: use bi_max_vecs to find the bvec pool config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260949.1ZCW1y7H-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260949.1ZCW1y7H-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260949.1ZCW1y7H-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio.o: warning: objtool: bvec_alloc()+0xf5: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49374
by Wang Liang 26 Mar '25

26 Mar '25

Hoang Le (2): tipc: add extack messages for bearer/media failure tipc: check attribute length for bearer name net/tipc/bearer.c | 53 ++++++++++++++++++++++++++++++++++++----------- 1 file changed, 41 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] net_sched: sch_sfq: don't allow 1 packet limit
by Wang Liang 26 Mar '25

26 Mar '25

From: Octavian Purdila <tavip(a)google.com> mainline inclusion from mainline-v6.14-rc1 commit 10685681bafce6febb39770f3387621bf5d67d0b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBVH45 CVE: CVE-2024-57996 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel as well. This fixes the following syzkaller reported crash: UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6 index 65535 is out of range for type 'struct sfq_head[128]' CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x125/0x19f lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:148 [inline] __ubsan_handle_out_of_bounds+0xed/0x120 lib/ubsan.c:347 sfq_link net/sched/sch_sfq.c:210 [inline] sfq_dec+0x528/0x600 net/sched/sch_sfq.c:238 sfq_dequeue+0x39b/0x9d0 net/sched/sch_sfq.c:500 sfq_reset+0x13/0x50 net/sched/sch_sfq.c:525 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 tbf_reset+0x3d/0x100 net/sched/sch_tbf.c:319 qdisc_reset+0xfe/0x510 net/sched/sch_generic.c:1026 dev_reset_queue+0x8c/0x140 net/sched/sch_generic.c:1296 netdev_for_each_tx_queue include/linux/netdevice.h:2350 [inline] dev_deactivate_many+0x6dc/0xc20 net/sched/sch_generic.c:1362 __dev_close_many+0x214/0x350 net/core/dev.c:1468 dev_close_many+0x207/0x510 net/core/dev.c:1506 unregister_netdevice_many+0x40f/0x16b0 net/core/dev.c:10738 unregister_netdevice_queue+0x2be/0x310 net/core/dev.c:10695 unregister_netdevice include/linux/netdevice.h:2893 [inline] __tun_detach+0x6b6/0x1600 drivers/net/tun.c:689 tun_detach drivers/net/tun.c:705 [inline] tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3640 __fput+0x203/0x840 fs/file_table.c:280 task_work_run+0x129/0x1b0 kernel/task_work.c:185 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x5ce/0x2200 kernel/exit.c:931 do_group_exit+0x144/0x310 kernel/exit.c:1046 __do_sys_exit_group kernel/exit.c:1057 [inline] __se_sys_exit_group kernel/exit.c:1055 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1055 do_syscall_64+0x6c/0xd0 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe5e7b52479 Code: Unable to access opcode bytes at RIP 0x7fe5e7b5244f. RSP: 002b:00007ffd3c800398 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe5e7b52479 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007fe5e7bcd2d0 R08: ffffffffffffffb8 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe5e7bcd2d0 R13: 0000000000000000 R14: 00007fe5e7bcdd20 R15: 00007fe5e7b24270 The crash can be also be reproduced with the following (with a tc recompiled to allow for sfq limits of 1): tc qdisc add dev dummy0 handle 1: root tbf rate 1Kbit burst 100b lat 1s ../iproute2-6.9.0/tc/tc qdisc add dev dummy0 handle 2: parent 1:10 sfq limit 1 ifconfig dummy0 up ping -I dummy0 -f -c2 -W0.1 8.8.8.8 sleep 1 Scenario that triggers the crash: * the first packet is sent and queued in TBF and SFQ; qdisc qlen is 1 * TBF dequeues: it peeks from SFQ which moves the packet to the gso_skb list and keeps qdisc qlen set to 1. TBF is out of tokens so it schedules itself for later. * the second packet is sent and TBF tries to queues it to SFQ. qdisc qlen is now 2 and because the SFQ limit is 1 the packet is dropped by SFQ. At this point qlen is 1, and all of the SFQ slots are empty, however q->tail is not NULL. At this point, assuming no more packets are queued, when sch_dequeue runs again it will decrement the qlen for the current empty slot causing an underflow and the subsequent out of bounds access. Reported-by: syzbot <syzkaller(a)googlegroups.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Octavian Purdila <tavip(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241204030520.2084663-2-tavip@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_sfq.c [conflicts due to not merge e4650d7ae425 ("net_sched: sch_sfq: handle bigger packets")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_sfq.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c index 74f697c4a4d3..9fb5ee64834a 100644 --- a/net/sched/sch_sfq.c +++ b/net/sched/sch_sfq.c @@ -658,6 +658,9 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt) if (!p) return -ENOMEM; } + if (ctl->limit == 1) + return -EINVAL; + sch_tree_lock(sch); if (ctl->quantum) { q->quantum = ctl->quantum; -- 2.34.1

2 1

[openeuler:OLK-5.10 2821/2821] io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 2c4dc5d73facd120aab1305ec14eef4f9a524812 [2821/2821] io_uring/tctx: work around xa_store() allocation error issue config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260613.Q2n0VF4Y-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260613.Q2n0VF4Y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260613.Q2n0VF4Y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> io_uring/io_uring.o: warning: objtool: __io_uring_free()+0x69: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2821/2821] kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction
by kernel test robot 26 Mar '25

26 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 44a47613c5cbb589453938cf7bf355d8043fa53f [2821/2821] irq_work: Cleanup config: x86_64-buildonly-randconfig-005-20250325 (https://download.01.org/0day-ci/archive/20250326/202503260202.467f83vo-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250326/202503260202.467f83vo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503260202.467f83vo-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/tree.o: warning: objtool: rcu_iw_handler()+0x9e: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1514/1514] mm/memory.c:4489:43: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a0f7a942ef42e73c8748687d469ed61f380bf0cf commit: ae0cd4d46ced733c522f2cc6da2d380d69123fc4 [1514/1514] mm: parallelize clear_gigantic_page config: x86_64-randconfig-121-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252231.BsBQmABZ-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252231.BsBQmABZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252231.BsBQmABZ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/memory.c:4489:43: sparse: sparse: Using plain integer as NULL pointer mm/memory.c:4560:22: sparse: sparse: cast removes address space '__user' of expression mm/memory.c:833:17: sparse: sparse: context imbalance in 'copy_pte_range' - different lock contexts for basic block mm/memory.c:1436:16: sparse: sparse: context imbalance in '__get_locked_pte' - different lock contexts for basic block mm/memory.c:1478:9: sparse: sparse: context imbalance in 'insert_page' - different lock contexts for basic block mm/memory.c:1579:9: sparse: sparse: context imbalance in 'insert_pfn' - different lock contexts for basic block mm/memory.c:1746:17: sparse: sparse: context imbalance in 'remap_pte_range' - different lock contexts for basic block mm/memory.c:1975:17: sparse: sparse: context imbalance in 'apply_to_pte_range' - unexpected unlock mm/memory.c:2422:17: sparse: sparse: context imbalance in 'wp_pfn_shared' - unexpected unlock mm/memory.c:2484:19: sparse: sparse: context imbalance in 'do_wp_page' - different lock contexts for basic block mm/memory.c:3055:19: sparse: sparse: context imbalance in 'pte_alloc_one_map' - different lock contexts for basic block mm/memory.c:3295:17: sparse: sparse: context imbalance in 'finish_fault' - unexpected unlock mm/memory.c:3409:9: sparse: sparse: context imbalance in 'do_fault_around' - unexpected unlock mm/memory.c:4062:12: sparse: sparse: context imbalance in '__follow_pte_pmd' - different lock contexts for basic block mm/memory.c:4146:16: sparse: sparse: context imbalance in 'follow_pte_pmd' - different lock contexts for basic block mm/memory.c:4206:9: sparse: sparse: context imbalance in 'follow_phys' - unexpected unlock In file included from mm/memory.c:72: mm/memory.c: In function 'clear_huge_page': include/linux/ktask.h:123:35: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct cgp_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] 123 | .kc_thread_func = (ktask_thread_func)(thread_func), 22- | ^ include/linux/ktask.h:139:17: note: in expansion of macro 'KTASK_CTL_INITIALIZER' 139 | KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 25- | ^~~~~~~~~~~~~~~~~~~~~ mm/memory.c:4491:17: note: in expansion of macro 'DEFINE_KTASK_CTL' 4491 | DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, | ^~~~~~~~~~~~~~~~ vim +4489 mm/memory.c 4480 4481 void clear_huge_page(struct page *page, 4482 unsigned long addr_hint, unsigned int pages_per_huge_page) 4483 { 4484 unsigned long addr = addr_hint & 4485 ~(((unsigned long)pages_per_huge_page << PAGE_SHIFT) - 1); 4486 4487 if (unlikely(pages_per_huge_page > MAX_ORDER_NR_PAGES)) { 4488 struct cgp_args args = {page, addr}; > 4489 struct ktask_node node = {0, pages_per_huge_page, 4490 page_to_nid(page)}; 4491 DEFINE_KTASK_CTL(ctl, clear_gigantic_page_chunk, &args, 4492 KTASK_MEM_CHUNK); 4493 4494 ktask_run_numa(&node, 1, &ctl); 4495 return; 4496 } 4497 4498 process_huge_page(addr_hint, pages_per_huge_page, clear_subpage, page); 4499 } 4500 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1514/1514] include/linux/bpf-cgroup.h:274:41: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a0f7a942ef42e73c8748687d469ed61f380bf0cf commit: f42ee093be2980f2689ea7a170d580364820f48b [1514/1514] bpf/test_run: support cgroup local storage config: x86_64-randconfig-122-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252213.JKA9UxCh-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252213.JKA9UxCh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252213.JKA9UxCh-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) net/bpf/test_run.c: note: in included file (through include/linux/cgroup-defs.h, include/linux/cgroup.h, include/net/netprio_cgroup.h, ...): >> include/linux/bpf-cgroup.h:274:41: sparse: sparse: Using plain integer as NULL pointer vim +274 include/linux/bpf-cgroup.h fdb5c4531c1e0e Sean Young 2018-06-19 267 aa0ad5b0391e26 Roman Gushchin 2018-08-02 268 static inline void bpf_cgroup_storage_set(struct bpf_cgroup_storage *storage) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 269 static inline int bpf_cgroup_storage_assign(struct bpf_prog *prog, de9cbbaadba5ad Roman Gushchin 2018-08-02 270 struct bpf_map *map) { return 0; } de9cbbaadba5ad Roman Gushchin 2018-08-02 271 static inline void bpf_cgroup_storage_release(struct bpf_prog *prog, de9cbbaadba5ad Roman Gushchin 2018-08-02 272 struct bpf_map *map) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 273 static inline struct bpf_cgroup_storage *bpf_cgroup_storage_alloc( de9cbbaadba5ad Roman Gushchin 2018-08-02 @274 struct bpf_prog *prog) { return 0; } de9cbbaadba5ad Roman Gushchin 2018-08-02 275 static inline void bpf_cgroup_storage_free( de9cbbaadba5ad Roman Gushchin 2018-08-02 276 struct bpf_cgroup_storage *storage) {} de9cbbaadba5ad Roman Gushchin 2018-08-02 277 :::::: The code at line 274 was first introduced by commit :::::: de9cbbaadba5adf88a19e46df61f7054000838f6 bpf: introduce cgroup storage maps :::::: TO: Roman Gushchin <guro(a)fb.com> :::::: CC: Daniel Borkmann <daniel(a)iogearbox.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2820/2820] net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static?
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 050383882de382969e4fb8362235749b232cccae [2820/2820] bpf: support BPF_PROG_QUERY for progs attached to sockmap config: x86_64-randconfig-123-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252115.VoLdAs0Z-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252115.VoLdAs0Z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252115.VoLdAs0Z-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> net/core/sock_map.c:1501:5: sparse: sparse: symbol 'sock_map_prog_lookup' was not declared. Should it be static? vim +/sock_map_prog_lookup +1501 net/core/sock_map.c 1500 > 1501 int sock_map_prog_lookup(struct bpf_map *map, struct bpf_prog ***pprog, 1502 u32 which) 1503 { 1504 struct sk_psock_progs *progs = sock_map_progs(map); 1505 1506 if (!progs) 1507 return -EOPNOTSUPP; 1508 1509 switch (which) { 1510 case BPF_SK_MSG_VERDICT: 1511 *pprog = &progs->msg_parser; 1512 break; 1513 case BPF_SK_SKB_STREAM_PARSER: 1514 *pprog = &progs->skb_parser; 1515 break; 1516 case BPF_SK_SKB_STREAM_VERDICT: 1517 *pprog = &progs->skb_verdict; 1518 break; 1519 default: 1520 return -EOPNOTSUPP; 1521 } 1522 return 0; 1523 } 1524 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2821/2821] arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 0d616a77cb5f7198cca524a24f717f59ad51b41b commit: 822da186955cbcd69b4715b8a307053e6c756f30 [2821/2821] x86/ibt,paravirt: Use text_gen_insn() for paravirt_patch() config: x86_64-buildonly-randconfig-003-20250325 (https://download.01.org/0day-ci/archive/20250325/202503252017.UYNRpRjt-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503252017.UYNRpRjt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503252017.UYNRpRjt-lkp@intel.com/ All errors (new ones prefixed by >>): arch/x86/kernel/paravirt.c: In function 'paravirt_patch_call': arch/x86/kernel/paravirt.c:65:9: error: implicit declaration of function '__text_gen_insn' [-Werror=implicit-function-declaration] 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^~~~~~~~~~~~~~~ arch/x86/kernel/paravirt.c:65:36: error: 'CALL_INSN_OPCODE' undeclared (first use in this function) 65 | __text_gen_insn(insn_buff, CALL_INSN_OPCODE, | ^~~~~~~~~~~~~~~~ arch/x86/kernel/paravirt.c:65:36: note: each undeclared identifier is reported only once for each function it appears in arch/x86/kernel/paravirt.c:66:47: error: 'CALL_INSN_SIZE' undeclared (first use in this function) 66 | (void *)addr, target, CALL_INSN_SIZE); | ^~~~~~~~~~~~~~ >> arch/x86/kernel/paravirt.c:68:1: error: control reaches end of non-void function [-Werror=return-type] 68 | } | ^ cc1: some warnings being treated as errors vim +68 arch/x86/kernel/paravirt.c 19d36ccdc34f5e arch/i386/kernel/paravirt.c Andi Kleen 2007-07-22 61 1fc654cf6e04b4 arch/x86/kernel/paravirt.c Ingo Molnar 2019-04-25 62 static unsigned paravirt_patch_call(void *insn_buff, const void *target, abc745f85c1193 arch/x86/kernel/paravirt.c Juergen Gross 2018-08-28 63 unsigned long addr, unsigned len) 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 64 { 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 65 __text_gen_insn(insn_buff, CALL_INSN_OPCODE, 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 66 (void *)addr, target, CALL_INSN_SIZE); 822da186955cbc arch/x86/kernel/paravirt.c Peter Zijlstra 2022-03-08 67 return CALL_INSN_SIZE; 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 @68 } 63f70270ccd981 arch/i386/kernel/paravirt.c Jeremy Fitzhardinge 2007-05-02 69 :::::: The code at line 68 was first introduced by commit :::::: 63f70270ccd981ce40a8ff58c03a8c2e97e368be [PATCH] i386: PARAVIRT: add common patching machinery :::::: TO: Jeremy Fitzhardinge <jeremy(a)goop.org> :::::: CC: Andi Kleen <andi(a)basil.nowhere.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 3e8e3ea77f0dd528b080f91d615144093b741003
by kernel test robot 25 Mar '25

25 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 3e8e3ea77f0dd528b080f91d615144093b741003 !15582 CVE-2022-49508 Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503251400.xG2WACIP-lkp@intel.com crypto/aegis128.o: warning: objtool: missing symbol for section .init.text mm/page_ext.o: warning: objtool: missing symbol for section .init.text Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250324 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250324 | |-- drivers-soc-qcom-llcc-slice.c:warning:ret-may-be-used-uninitialized-in-this-function | |-- include-scsi-scsi_cmnd.h:warning:scsi_cmnd-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-051-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-055-20250324 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-r111-20250325 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250324 | |-- Section-mismatch-in-reference-from-the-(unknown-reference)-(unknown)-to-the-(unknown-reference)-.irqentry.text:(unknown) | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250324 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20250324 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-005-20250324 | |-- crypto-aegis128.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_ext.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250324 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250325 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250325 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250325 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250325 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-121-20250325 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-122-20250325 | |-- block-blk-merge.c:sparse:sparse:symbol-blk_try_req_merge-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_issue-was-not-declared.-Should-it-be-static | |-- block-blk-wbt.c:sparse:sparse:symbol-wbt_requeue-was-not-declared.-Should-it-be-static | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-123-20250325 | |-- include-linux-backing-dev.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-maccess.c:sparse:sparse:symbol-__probe_user_read-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:invalid-assignment: | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-randconfig-161-20250325 |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1444m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250324 gcc-8.5.0 arm64 randconfig-002-20250324 gcc-10.5.0 arm64 randconfig-003-20250324 gcc-14.2.0 arm64 randconfig-004-20250324 gcc-6.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250324 clang-20 x86_64 buildonly-randconfig-002-20250324 gcc-12 x86_64 buildonly-randconfig-003-20250324 clang-20 x86_64 buildonly-randconfig-004-20250324 clang-20 x86_64 buildonly-randconfig-005-20250324 clang-20 x86_64 buildonly-randconfig-006-20250324 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2059/2059] drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: sparse: sparse: symbol 'tdm_service_run' was not declared. Should it be static?
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0278be80a99934144f0e708459f3475248f280c4 commit: 3ad98583441f7c8a2553e1e8d6340ed4397033e2 [2059/2059] crypto: tdm: Support dynamic protection for SCT and IDT by HYGON TDM config: x86_64-randconfig-121-20250325 (https://download.01.org/0day-ci/archive/20250325/202503251859.zDW2wWzp-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503251859.zDW2wWzp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503251859.zDW2wWzp-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:151:5: sparse: sparse: symbol 'tdm_service_run' was not declared. Should it be static? >> drivers/crypto/ccp/hygon/tdm-kernel-guard.c:212:5: sparse: sparse: symbol 'tdm_service_exit' was not declared. Should it be static? vim +/tdm_service_run +151 drivers/crypto/ccp/hygon/tdm-kernel-guard.c 150 > 151 int tdm_service_run(struct tdm_security_enhance *data) 152 { 153 int ret = 0; 154 struct addr_range_info *addr_range = NULL; 155 156 // Allocate memory for addr_range 157 addr_range = kzalloc(sizeof(struct addr_range_info) + sizeof(struct addr_info), GFP_KERNEL); 158 if (!addr_range) { 159 ret = -DYN_ERR_MEM; 160 pr_err("addr_range kzalloc memory failed\n"); 161 goto end; 162 } 163 164 // Fill in addr_range 165 addr_range->count = 1; 166 addr_range->addr[0].addr_start = data->vaddr; 167 addr_range->addr[0].length = data->size; 168 data->mem_range = addr_range; 169 170 // Context configuration 171 data->context |= TASK_CREATE_VADDR; 172 173 // Allocate memory for authcode 174 data->authcode = kzalloc(sizeof(struct authcode_2b) + AUTHCODE_MAX, GFP_KERNEL); 175 if (!data->authcode) { 176 ret = -DYN_ERR_MEM; 177 pr_err("authcode_2b kzalloc memory failed\n"); 178 goto free_addr_range_info; 179 } 180 181 data->authcode->len = AUTHCODE_MAX; 182 183 // Measurement data configuration 184 data->mdata.hash_algo = HASH_ALGO_SM3; 185 data->mdata.period_ms = 0; 186 ret = calc_expected_hash((uint8_t *)data->vaddr, data->size, 187 data->mdata.expected_measurement); 188 if (ret) { 189 pr_err("calculate expected hash failed!\n"); 190 goto free_authcode; 191 } 192 193 // Create and start tdm task 194 ret = tdm_task_create_and_run(data); 195 if (ret) { 196 pr_err("tdm_task_create_and_run failed!\n"); 197 goto free_authcode; 198 } 199 200 return ret; 201 202 free_authcode: 203 kfree(data->authcode); 204 data->authcode = NULL; 205 free_addr_range_info: 206 kfree(data->mem_range); 207 data->mem_range = NULL; 208 end: 209 return ret; 210 } 211 > 212 int tdm_service_exit(struct tdm_security_enhance *data) 213 { 214 int ret = 0; 215 int task_status = 0; 216 217 task_status = psp_startstop_measure_task(data->task_id, data->authcode, false); 218 if (task_status < 0) { 219 ret = task_status; 220 pr_err("task_id %d stop failed with 0x%x\n", data->task_id, ret); 221 goto end; 222 } 223 224 // Waiting for the task to end 225 msleep(40); 226 227 psp_destroy_measure_task(data->task_id, data->authcode); 228 229 kfree(data->authcode); 230 data->authcode = NULL; 231 kfree(data->mem_range); 232 data->mem_range = NULL; 233 end: 234 return ret; 235 } 236 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS 0278be80a99934144f0e708459f3475248f280c4
by kernel test robot 25 Mar '25

25 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 0278be80a99934144f0e708459f3475248f280c4 !15477 PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-virtcca_get_tmi_version | |-- drivers-coda-coda_pci.c:warning:Excess-function-parameter-pdev-description-in-virtcca_pci_get_rom_size | |-- drivers-coda-coda_pci.c:warning:Function-parameter-or-member-p-not-described-in-virtcca_pci_get_rom_size | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-HALTPOLL_CPUIDLE-when-selected-by-ARM64 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-defconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-001-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-002-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-003-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- arm64-randconfig-052-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250324 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allnoconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-allyesconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-defconfig | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-001-20250324 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- loongarch-randconfig-002-20250324 | |-- arch-loongarch-mm-cache.c:warning:variable-way_size-set-but-not-used | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ACPI_HOTPLUG_IGNORE_OSC-when-selected-by-X86 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-allyesconfig | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-buildonly-randconfig-006-20250324 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-101-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-102-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-103-20250325 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | `-- mm-mempolicy.c:warning:writing-byte-into-a-region-of-size |-- x86_64-randconfig-104-20250325 | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-121-20250325 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-122-20250325 | |-- include-linux-userfaultfd_k.h:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-restricted-uffd_flags_t-usertype-flags-got-unsigned-int-enum-mfill_atomic_mode-mode | |-- include-linux-userfaultfd_k.h:sparse:sparse:restricted-uffd_flags_t-degrades-to-integer | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- x86_64-randconfig-123-20250325 | |-- mm-memblock.c:sparse:sparse:symbol-memblock_alloc_range_nid_flags-was-not-declared.-Should-it-be-static | `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used `-- x86_64-randconfig-161-20250324 |-- mm-kasan-kasan_test.c-rcu_uaf_reclaim()-error:dereferencing-freed-memory-fp-(line-) `-- mm-memory.c:warning:variable-nr_pages-set-but-not-used elapsed time: 1445m configs tested: 21 configs skipped: 123 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250324 gcc-8.5.0 arm64 randconfig-002-20250324 clang-14 arm64 randconfig-003-20250324 clang-21 arm64 randconfig-004-20250324 gcc-6.5.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250324 gcc-14.2.0 loongarch randconfig-002-20250324 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250324 clang-20 x86_64 buildonly-randconfig-002-20250324 gcc-12 x86_64 buildonly-randconfig-003-20250324 clang-20 x86_64 buildonly-randconfig-004-20250324 clang-20 x86_64 buildonly-randconfig-005-20250324 clang-20 x86_64 buildonly-randconfig-006-20250324 clang-20 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ALSA: oss: Fix PCM OSS buffer allocation overflow
by Jinjiang Tu 25 Mar '25

25 Mar '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.237 commit a63af1baf0a5e11827db60e3127f87e437cab6e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1SP CVE: CVE-2022-49292 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit efb6402c3c4a7c26d97c92d70186424097b6e366 upstream. We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON(). This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes. Reported-by: syzbot+72732c532ac1454eeee9(a)syzkaller.appspotmail.com Suggested-by: Linus Torvalds <torvalds(a)linux-foundation.org> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/00000000000085b1b305da5a66f3@google.com Link: https://lore.kernel.org/r/20220318082036.29699-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- sound/core/oss/pcm_oss.c | 12 ++++++++---- sound/core/oss/pcm_plugin.c | 5 ++++- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 7f434a37d860..f22d239eebe4 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -789,6 +789,11 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, if (oss_period_size < 16) return -EINVAL; + + /* don't allocate too large period; 1MB period must be enough */ + if (oss_period_size > 1024 * 1024) + return -ENOMEM; + runtime->oss.period_bytes = oss_period_size; runtime->oss.period_frames = 1; runtime->oss.periods = oss_periods; @@ -1053,10 +1058,9 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) goto failure; } #endif - oss_period_size *= oss_frame_size; - - oss_buffer_size = oss_period_size * runtime->oss.periods; - if (oss_buffer_size < 0) { + oss_period_size = array_size(oss_period_size, oss_frame_size); + oss_buffer_size = array_size(oss_period_size, runtime->oss.periods); + if (oss_buffer_size <= 0) { err = -EINVAL; goto failure; } diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c index 31cb2acf8afc..624aca32fe69 100644 --- a/sound/core/oss/pcm_plugin.c +++ b/sound/core/oss/pcm_plugin.c @@ -61,7 +61,10 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t } if ((width = snd_pcm_format_physical_width(format->format)) < 0) return width; - size = frames * format->channels * width; + size = array3_size(frames, format->channels, width); + /* check for too large period size once again */ + if (size > 1024 * 1024) + return -ENOMEM; if (snd_BUG_ON(size % 8)) return -ENXIO; size /= 8; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
by Jinjiang Tu 25 Mar '25

25 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.238 commit b0c56a0071116a37c24df998166c22a7e4684626 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3W0 CVE: CVE-2022-49243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f590797fa3c1bccdd19e55441592a23b46aef449 ] This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. Fixes: 531f67e41dcd ("ASoC: at91sam9g20ek-wm8731: convert to dt support") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Codrin Ciubotariu <codrin.ciubotariu(a)microchip.com> Link: https://lore.kernel.org/r/20220307124539.1743-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- sound/soc/atmel/sam9g20_wm8731.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c index 98f93e79c654..5041f43ee5f7 100644 --- a/sound/soc/atmel/sam9g20_wm8731.c +++ b/sound/soc/atmel/sam9g20_wm8731.c @@ -225,6 +225,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0); if (!cpu_np) { dev_err(&pdev->dev, "dai and pcm info missing\n"); + of_node_put(codec_np); return -EINVAL; } at91sam9g20ek_dai.cpu_of_node = cpu_np; -- 2.43.0

2 1

Re: [PATCH OLK-6.6 v2 2/3] arm64: entry: Support hardware xint
by Jinjie Ruan 25 Mar '25

25 Mar '25

On 2025/3/25 15:00, Liao, Chang wrote: > > > 在 2025/3/24 21:53, Jinjie Ruan 写道: >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 >> >> -------------------------------- >> >> Support hardware xint. Hardware xint provides a separate entry for >> interrupt handling, so we can use it to customize and respond to >> interrupts relatively quickly. >> >> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> >> --- >> v2: >> - Reuse the xint set and check logic in xint 1.0. >> - Introduce fast_handle_xint(). >> - Rename enable_xint_xcall() to enable_xfunc(). >> - Rename test_has_xint_xcall() to test_has_xfunc(). >> - Fix a typo, Harware -> Hardware. >> - Add a blank line after declarations in el0t_64_xint_handler(). >> --- >> arch/arm64/Kconfig | 7 +++ >> arch/arm64/include/asm/sysreg.h | 4 ++ >> arch/arm64/kernel/cpufeature.c | 75 ++++++++++++++++++++++++- >> arch/arm64/kernel/entry-common.c | 35 +++++++++--- >> arch/arm64/kernel/entry.S | 40 +++++++++++++- >> arch/arm64/tools/cpucaps | 2 +- >> drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++++++++-- >> include/linux/irqchip/arm-gic-v3.h | 6 +- >> kernel/irq/debugfs.c | 6 +- >> kernel/irq/internals.h | 3 +- >> 10 files changed, 244 insertions(+), 23 deletions(-) >> >> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig >> index 9da9d58f1c02..57d05cfbd29e 100644 >> --- a/arch/arm64/Kconfig >> +++ b/arch/arm64/Kconfig >> @@ -1717,6 +1717,13 @@ config ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG >> config ARCH_SUPPORTS_CRASH_DUMP >> def_bool y >> >> +config ARCH_SUPPORTS_XINT >> + bool "Hardware xint support" >> + default n >> + depends on ARM64_NMI >> + depends on ARM_GIC_V3 >> + depends on !COMPAT >> + >> config TRANS_TABLE >> def_bool y >> depends on HIBERNATION || KEXEC_CORE >> diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h >> index 435634a703c6..b34e8cc4476b 100644 >> --- a/arch/arm64/include/asm/sysreg.h >> +++ b/arch/arm64/include/asm/sysreg.h >> @@ -269,6 +269,10 @@ >> #define SYS_REVIDR_EL1 sys_reg(3, 0, 0, 0, 6) >> >> #define SYS_ACTLR_EL1 sys_reg(3, 0, 1, 0, 1) >> + >> +#define ACTLR_ELx_XINT_SHIFT 21 >> +#define ACTLR_ELx_XINT (BIT(ACTLR_ELx_XINT_SHIFT)) >> + > > I don't think sysreg.h is the best place for those ACTLR_ELx bits. This header's > more about the actual uint32 upcode of system register. not the details of the fields. > And since ACTLR_ELx fields vary implementation. I think we should put them in a new > heade, actlr.h like kernel does with esr.h. > > >> #define SYS_RGSR_EL1 sys_reg(3, 0, 1, 0, 5) >> #define SYS_GCR_EL1 sys_reg(3, 0, 1, 0, 6) >> >> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c >> index a1736e9044da..b4de05241f7d 100644 >> --- a/arch/arm64/kernel/cpufeature.c >> +++ b/arch/arm64/kernel/cpufeature.c >> @@ -2406,8 +2406,12 @@ static bool has_xcall_support(const struct arm64_cpu_capabilities *entry, int __ >> } >> #endif >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> bool is_xint_support; >> +bool hw_xint_support; >> +#endif >> + >> +#ifdef CONFIG_FAST_IRQ >> static int __init xint_setup(char *str) >> { >> if (!cpus_have_cap(ARM64_HAS_GIC_CPUIF_SYSREGS)) >> @@ -2424,6 +2428,66 @@ static bool has_xint_support(const struct arm64_cpu_capabilities *entry, int __u >> } >> #endif >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +static bool test_has_xfunc(void) > > test_has_xfunc is a bit strange, could we just use has_arch_xint_support()? > >> +{ >> + u64 new, old = read_sysreg(actlr_el1); >> + >> + write_sysreg(old | ACTLR_ELx_XINT, actlr_el1); >> + isb(); >> + new = read_sysreg(actlr_el1); >> + if (new & ACTLR_ELx_XINT) { >> + write_sysreg(old, actlr_el1); >> + hw_xint_support = true; >> + return true; >> + } >> + >> + return false; >> +} >> + >> +static void enable_xfunc(void) > > Could we use cpu_enable_arch_xint()? it is not hard to find some helper functions > in this file has similar role as this. > >> +{ >> + u64 actlr_el1, actlr_el2; >> + u64 el; >> + >> + el = read_sysreg(CurrentEL); >> + if (el == CurrentEL_EL2) { >> + actlr_el2 = read_sysreg(actlr_el2); >> + actlr_el2 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el2, actlr_el2); >> + isb(); >> + actlr_el2 = read_sysreg(actlr_el2); >> + pr_info("actlr_el2: %llx, cpu:%d\n", actlr_el2, smp_processor_id()); >> + } >> + >> + actlr_el1 = read_sysreg(actlr_el1); >> + actlr_el1 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el1, actlr_el1); >> + isb(); >> + actlr_el1 = read_sysreg(actlr_el1); >> + pr_info("actlr_el1: %llx, cpu:%d\n", actlr_el1, smp_processor_id()); >> +} >> + >> +static bool test_has_xint(const struct arm64_cpu_capabilities *entry, int scope) >> +{ >> + if (!IS_ENABLED(CONFIG_ARM64_NMI)) >> + pr_info("CONFIG_ARM64_NMI disabled, using XINTs for guests only\n"); >> +#ifdef CONFIG_ARM64_PSEUDO_NMI >> + else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { >> + pr_info("Pseudo NMI enabled, not using architected XINT\n"); >> + return false; >> + } >> +#endif >> + >> + return test_has_xfunc(); >> +} > > Fold this function into has_arch_xint_support(). > >> + >> +static void xint_enable(const struct arm64_cpu_capabilities *__unused) >> +{ >> + enable_xfunc(); > > Fold this function into cpu_enable_arch_xint(). > >> +} >> +#endif >> + >> static const struct arm64_cpu_capabilities arm64_features[] = { >> { >> .capability = ARM64_ALWAYS_BOOT, >> @@ -2971,6 +3035,15 @@ static const struct arm64_cpu_capabilities arm64_features[] = { >> .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> .matches = has_xint_support, >> }, >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + { >> + .desc = "Hardware xint Support", > > Mind the ppercase for first letter. > >> + .capability = ARM64_HAS_HW_XINT, >> + .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> + .matches = test_has_xint, >> + .cpu_enable = xint_enable, >> + }, >> #endif > > I really can't recall why we add "Xint support" data into arm64_feature array before. > Just to be clear, "Xint support' is a software solution, it's about making interrupt > handler faster. It's not tied to any particular CPU feature. "Hardware Xint Support" > would means something different, like a real CPU feature. So I think we should take > it out from the arm64_feature array upon CPU can support a hardware xint entry. > >> {}, >> }; >> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c >> index 4602c107c40a..d09029dfcf02 100644 >> --- a/arch/arm64/kernel/entry-common.c >> +++ b/arch/arm64/kernel/entry-common.c >> @@ -6,6 +6,9 @@ >> */ >> >> #include <linux/context_tracking.h> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +#include <linux/irqchip/arm-gic-v3.h> >> +#endif >> #include <linux/kasan.h> >> #include <linux/linkage.h> >> #include <linux/lockdep.h> >> @@ -607,7 +610,7 @@ static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, >> } >> >> >> -asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +asmlinkage void noinstr el0t_64_sw_xint_handler(struct pt_regs *regs) >> { >> el0_xint(regs, ISR_EL1_IS, handle_arch_irq, handle_arch_nmi_irq); >> } >> @@ -966,6 +969,30 @@ asmlinkage void noinstr el0t_64_error_handler(struct pt_regs *regs) >> __el0_error_handler_common(regs); >> } >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +{ >> + u32 irqnr = read_sysreg_s(SYS_ICC_HPPIR1_EL1); >> + >> + if (gic_irqnr_is_special(irqnr)) >> + return; >> + >> + if (is_xint(irqnr)) >> + fast_handle_xint(regs, irqnr); >> + else >> + el0t_64_irq_handler(regs); >> +} > > Could we register fast_handle_xint() in gic-v3 driver, like kernel does for gic_handle_irq() > and gic_handle_nmi_irq(). By checking the return value, it still has chance to fall through > to the regular irq handler. 这里做不到，一旦ACK了，就没法回头了 > >> +#else >> +#ifdef CONFIG_AARCH32_EL0 >> +asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> +{ >> + __el0_irq_handler_common(regs); >> +} >> +#else /* CONFIG_AARCH32_EL0 */ >> +UNHANDLED(el0t, 32, irq) >> +#endif >> +#endif >> + >> #ifdef CONFIG_AARCH32_EL0 >> static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr) >> { >> @@ -1028,11 +1055,6 @@ asmlinkage void noinstr el0t_32_sync_handler(struct pt_regs *regs) >> } >> } >> >> -asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> -{ >> - __el0_irq_handler_common(regs); >> -} >> - >> asmlinkage void noinstr el0t_32_fiq_handler(struct pt_regs *regs) >> { >> __el0_fiq_handler_common(regs); >> @@ -1044,7 +1066,6 @@ asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs) >> } >> #else /* CONFIG_AARCH32_EL0 */ >> UNHANDLED(el0t, 32, sync) >> -UNHANDLED(el0t, 32, irq) >> UNHANDLED(el0t, 32, fiq) >> UNHANDLED(el0t, 32, error) >> #endif /* CONFIG_AARCH32_EL0 */ >> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S >> index da3809632f0f..046225fa2f90 100644 >> --- a/arch/arm64/kernel/entry.S >> +++ b/arch/arm64/kernel/entry.S >> @@ -565,7 +565,11 @@ SYM_CODE_START(vectors) >> kernel_ventry 0, t, 64, error // Error 64-bit EL0 >> >> kernel_ventry 0, t, 32, sync // Synchronous 32-bit EL0 >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + kernel_ventry 0, t, 64, xint // XINT 64-bit EL0 >> +#else >> kernel_ventry 0, t, 32, irq // IRQ 32-bit EL0 >> +#endif >> kernel_ventry 0, t, 32, fiq // FIQ 32-bit EL0 >> kernel_ventry 0, t, 32, error // Error 32-bit EL0 >> SYM_CODE_END(vectors) >> @@ -696,7 +700,7 @@ SYM_CODE_END(__bad_stack) >> kernel_entry 0, 64 >> #endif >> mov x0, sp >> - bl el0t_64_xint_handler >> + bl el0t_64_sw_xint_handler >> #ifdef CONFIG_SECURITY_FEATURE_BYPASS >> kernel_exit 0, xint >> #else >> @@ -729,6 +733,18 @@ SYM_CODE_START_LOCAL(el\el\ht\()_\regsize\()_\label) >> check_xint_pre_kernel_entry >> .Lskip_check_xint\@: >> .endif >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + .if \el == 0 && \regsize == 64 && \label == xint >> + alternative_if_not ARM64_HAS_HW_XINT >> + b .Lskip_hw_xint\@ >> + alternative_else_nop_endif >> + kernel_entry 0, 64, xint >> + mov x0, sp >> + bl el0t_64_xint_handler >> + kernel_exit 0, xint > > Could we fold the assembly code on else branch into its own macro？ > Let's give a the macro an name that has similar style with the ones > we uses in the code braced by CONFIG_FAST_IRQ/SYSCALL. > >> +.Lskip_hw_xint\@: >> + .endif >> #endif >> kernel_entry \el, \regsize >> mov x0, sp >> @@ -760,7 +776,11 @@ SYM_CODE_END(el\el\ht\()_\regsize\()_\label) >> entry_handler 0, t, 64, error >> >> entry_handler 0, t, 32, sync >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + entry_handler 0, t, 64, xint >> +#else >> entry_handler 0, t, 32, irq >> +#endif >> entry_handler 0, t, 32, fiq >> entry_handler 0, t, 32, error >> >> @@ -905,7 +925,14 @@ alternative_else_nop_endif >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> +#endif >> + >> + .rept 3 >> tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> .endr >> .endm >> @@ -955,7 +982,14 @@ SYM_CODE_END(tramp_exit) >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, 0, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, 0, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, 0, \bhb >> +#endif >> + >> + .rept 3 > >> tramp_ventry .Lvector_start\@, 32, 0, \bhb >> .endr >> .endm >> diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps >> index f2ddced689b5..b1f109f17e4f 100644 >> --- a/arch/arm64/tools/cpucaps >> +++ b/arch/arm64/tools/cpucaps >> @@ -110,7 +110,7 @@ WORKAROUND_HISI_HIP08_RU_PREFETCH >> WORKAROUND_HISILICON_1980005 >> HAS_XCALL >> HAS_XINT >> -KABI_RESERVE_3 >> +HAS_HW_XINT >> KABI_RESERVE_4 >> KABI_RESERVE_5 >> KABI_RESERVE_6 >> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c >> index 4cc8b95d533f..32ffdf06f61e 100644 >> --- a/drivers/irqchip/irq-gic-v3.c >> +++ b/drivers/irqchip/irq-gic-v3.c >> @@ -35,7 +35,7 @@ >> >> #include "irq-gic-common.h" >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> #include "../../../kernel/irq/internals.h" >> #endif >> >> @@ -828,7 +828,7 @@ static bool gic_rpr_is_nmi_prio(void) >> return unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI)); >> } >> >> -static bool gic_irqnr_is_special(u32 irqnr) >> +bool gic_irqnr_is_special(u32 irqnr) >> { >> return irqnr >= 1020 && irqnr <= 1023; >> } > > Please don't do this, left it static. > >> @@ -993,7 +993,11 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs >> __gic_handle_irq_from_irqson(regs); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +DECLARE_BITMAP(irqnr_nmi_map, 1024); >> +#endif >> + >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> DECLARE_BITMAP(irqnr_xint_map, 1024); >> >> static bool can_set_xint(unsigned int hwirq) >> @@ -1002,12 +1006,18 @@ static bool can_set_xint(unsigned int hwirq) >> __get_intid_range(hwirq) == SPI_RANGE) >> return true; >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (hw_xint_support && __get_intid_range(hwirq) == PPI_RANGE) >> + return true; >> +#endif >> + >> return false; >> } >> >> static bool xint_transform(int irqno, enum xint_op op) >> { >> struct irq_data *data = irq_get_irq_data(irqno); >> + struct irq_desc *desc; >> int hwirq; >> >> while (data->parent_data) >> @@ -1018,14 +1028,29 @@ static bool xint_transform(int irqno, enum xint_op op) >> if (!can_set_xint(hwirq)) >> return false; >> >> + desc = irq_data_to_desc(data); >> + >> switch (op) { >> case IRQ_TO_XINT: >> set_bit(hwirq, irqnr_xint_map); >> xint_add_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && !irq_is_nmi(desc)) { >> + gic_irq_enable_nmi(data); >> + set_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return true; >> case XINT_TO_IRQ: >> clear_bit(hwirq, irqnr_xint_map); >> xint_remove_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && irq_is_nmi(desc) && >> + test_bit(hwirq, irqnr_nmi_map)) { >> + gic_irq_disable_nmi(data); >> + clear_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return false; >> case XINT_SET_CHECK: >> return test_bit(hwirq, irqnr_xint_map); >> @@ -1096,7 +1121,7 @@ static const struct proc_ops xint_proc_ops = { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> /* create /proc/irq/<irq>/xint */ >> @@ -1105,12 +1130,63 @@ void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> >> void unregister_irqchip_proc(struct irq_desc *desc) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> remove_proc_entry("xint", desc->dir); >> } >> -#endif /* CONFIG_FAST_IRQ */ >> +#endif >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +bool is_xint(unsigned long hwirq) >> +{ >> + return test_bit(hwirq, irqnr_xint_map); >> +} >> + >> +static bool is_spi(unsigned long hwirq) >> +{ >> + if (__get_intid_range(hwirq) == SPI_RANGE || >> + __get_intid_range(hwirq) == ESPI_RANGE) >> + return true; >> + >> + return false; >> +} >> + >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr) >> +{ >> + struct pt_regs *old_regs; >> + struct irq_domain *domain; >> + struct irqaction *action; >> + struct irq_desc *desc; >> + struct irq_data *data; >> + >> + arch_nmi_enter(); >> + BUG_ON(in_nmi() == NMI_MASK); >> + __preempt_count_add(NMI_OFFSET + HARDIRQ_OFFSET); >> + old_regs = set_irq_regs(regs); >> + >> + domain = irq_get_default_host(); >> + data = radix_tree_lookup(&domain->revmap_tree, irqnr); >> + >> + desc = irq_data_to_desc(data); >> + action = desc->action; >> + >> + gic_read_nmiar(); >> + write_gicreg(irqnr, ICC_EOIR1_EL1); >> + isb(); >> + >> + if (is_spi(irqnr)) >> + action->handler(data->irq, action->dev_id); >> + else >> + action->handler(data->irq, raw_cpu_ptr(action->percpu_dev_id)); >> + gic_write_dir(irqnr); >> + >> + set_irq_regs(old_regs); >> + BUG_ON(!in_nmi()); >> + __preempt_count_sub(NMI_OFFSET + HARDIRQ_OFFSET); >> + arch_nmi_exit(); >> +} >> +#endif >> >> static u32 gic_get_pribits(void) >> { >> @@ -2358,6 +2434,7 @@ static int __init gic_init_bases(phys_addr_t dist_phys_base, >> goto out_free; >> } >> >> + irq_set_default_host(gic_data.domain); >> irq_domain_update_bus_token(gic_data.domain, DOMAIN_BUS_WIRED); >> >> gic_data.has_rss = !!(typer & GICD_TYPER_RSS); >> diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h >> index 548b8a5c46cf..3c0f04b86c15 100644 >> --- a/include/linux/irqchip/arm-gic-v3.h >> +++ b/include/linux/irqchip/arm-gic-v3.h >> @@ -721,8 +721,9 @@ static inline enum gic_intid_range __get_intid_range(irq_hw_number_t hwirq) >> } >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> enum xint_op { >> XINT_TO_IRQ, >> @@ -733,6 +734,9 @@ enum xint_op { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp); >> void unregister_irqchip_proc(struct irq_desc *desc); >> +bool gic_irqnr_is_special(u32 irqnr); >> +bool is_xint(unsigned long hwirq); >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr); >> #endif >> #endif >> >> diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c >> index dc94c360b54b..2152125f8ae2 100644 >> --- a/kernel/irq/debugfs.c >> +++ b/kernel/irq/debugfs.c >> @@ -242,7 +242,7 @@ void irq_add_debugfs_entry(unsigned int irq, struct irq_desc *desc) >> &dfs_irq_ops); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> static struct dentry *xint_dir; >> >> void xint_add_debugfs_entry(unsigned int irq) >> @@ -281,8 +281,8 @@ static int __init irq_debugfs_init(void) >> >> irq_dir = debugfs_create_dir("irqs", root_dir); >> >> -#ifdef CONFIG_FAST_IRQ >> - if (is_xint_support) >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> + if (is_xint_support || hw_xint_support) >> xint_dir = debugfs_create_dir("xints", root_dir); >> #endif >> >> diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h >> index 2fb08139a9e4..1c64854102f5 100644 >> --- a/kernel/irq/internals.h >> +++ b/kernel/irq/internals.h >> @@ -506,8 +506,9 @@ static inline void irq_remove_debugfs_entry(struct irq_desc *desc) >> kfree(desc->dev_name); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> void xint_add_debugfs_entry(unsigned int irq); >> void xint_remove_debugfs_entry(unsigned int irq); >

1 0

[PATCH openEuler-1.0-LTS] macsec: fix UAF bug for real_dev
by Wang Liang 25 Mar '25

25 Mar '25

From: Ziyang Xuan <william.xuanziyang(a)huawei.com> mainline inclusion from mainline-v5.19-rc1 commit 196a888ca6571deb344468e1d7138e3273206335 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2L3 CVE: CVE-2022-49390 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_dev as following: ================================================================== BUG: KASAN: use-after-free in macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 dev_get_iflink+0x73/0xe0 net/core/dev.c:637 default_operstate net/core/link_watch.c:42 [inline] rfc2863_policy+0x233/0x2d0 net/core/link_watch.c:54 linkwatch_do_dev+0x2a/0x150 net/core/link_watch.c:161 Allocated by task 22209: ... alloc_netdev_mqs+0x98/0x1100 net/core/dev.c:10549 rtnl_create_link+0x9d7/0xc00 net/core/rtnetlink.c:3235 veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748 Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 device_release+0x9f/0x240 drivers/base/core.c:2229 kobject_cleanup lib/kobject.c:673 [inline] kobject_release lib/kobject.c:704 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1c8/0x540 lib/kobject.c:721 netdev_run_todo+0x72e/0x10b0 net/core/dev.c:10327 After commit faab39f63c1f ("net: allow out-of-order netdev unregistration") and commit e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev"), we can add dev_hold_track() in macsec_dev_init() and dev_put_track() in macsec_free_netdev() to fix the problem. Fixes: 2bce1ebed17d ("macsec: fix refcnt leak in module exit routine") Reported-by: syzbot+d0e94b65ac259c29ce7a(a)syzkaller.appspotmail.com Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Link: https://lore.kernel.org/r/20220531074500.1272846-1-william.xuanziyang@huawe… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/macsec.c [conflicts due to not mergered 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/macsec.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c index 10a8ef2d025a..a0f565814d30 100644 --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -2783,6 +2783,9 @@ static int macsec_dev_init(struct net_device *dev) if (is_zero_ether_addr(dev->broadcast)) memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len); + /* Get macsec's reference to real_dev */ + dev_hold(real_dev); + return 0; } @@ -3009,6 +3012,8 @@ static void macsec_free_netdev(struct net_device *dev) free_percpu(macsec->stats); free_percpu(macsec->secy.tx_sc.stats); + /* Get rid of the macsec's reference to real_dev */ + dev_put(macsec->real_dev); } static void macsec_setup(struct net_device *dev) -- 2.34.1

2 1

Re: [PATCH OLK-6.6 v2 2/3] arm64: entry: Support hardware xint
by Jinjie Ruan 25 Mar '25

25 Mar '25

On 2025/3/25 15:00, Liao, Chang wrote: > > > 在 2025/3/24 21:53, Jinjie Ruan 写道: >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 >> >> -------------------------------- >> >> Support hardware xint. Hardware xint provides a separate entry for >> interrupt handling, so we can use it to customize and respond to >> interrupts relatively quickly. >> >> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> >> --- >> v2: >> - Reuse the xint set and check logic in xint 1.0. >> - Introduce fast_handle_xint(). >> - Rename enable_xint_xcall() to enable_xfunc(). >> - Rename test_has_xint_xcall() to test_has_xfunc(). >> - Fix a typo, Harware -> Hardware. >> - Add a blank line after declarations in el0t_64_xint_handler(). >> --- >> arch/arm64/Kconfig | 7 +++ >> arch/arm64/include/asm/sysreg.h | 4 ++ >> arch/arm64/kernel/cpufeature.c | 75 ++++++++++++++++++++++++- >> arch/arm64/kernel/entry-common.c | 35 +++++++++--- >> arch/arm64/kernel/entry.S | 40 +++++++++++++- >> arch/arm64/tools/cpucaps | 2 +- >> drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++++++++-- >> include/linux/irqchip/arm-gic-v3.h | 6 +- >> kernel/irq/debugfs.c | 6 +- >> kernel/irq/internals.h | 3 +- >> 10 files changed, 244 insertions(+), 23 deletions(-) >> >> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig >> index 9da9d58f1c02..57d05cfbd29e 100644 >> --- a/arch/arm64/Kconfig >> +++ b/arch/arm64/Kconfig >> @@ -1717,6 +1717,13 @@ config ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG >> config ARCH_SUPPORTS_CRASH_DUMP >> def_bool y >> >> +config ARCH_SUPPORTS_XINT >> + bool "Hardware xint support" >> + default n >> + depends on ARM64_NMI >> + depends on ARM_GIC_V3 >> + depends on !COMPAT >> + >> config TRANS_TABLE >> def_bool y >> depends on HIBERNATION || KEXEC_CORE >> diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h >> index 435634a703c6..b34e8cc4476b 100644 >> --- a/arch/arm64/include/asm/sysreg.h >> +++ b/arch/arm64/include/asm/sysreg.h >> @@ -269,6 +269,10 @@ >> #define SYS_REVIDR_EL1 sys_reg(3, 0, 0, 0, 6) >> >> #define SYS_ACTLR_EL1 sys_reg(3, 0, 1, 0, 1) >> + >> +#define ACTLR_ELx_XINT_SHIFT 21 >> +#define ACTLR_ELx_XINT (BIT(ACTLR_ELx_XINT_SHIFT)) >> + > > I don't think sysreg.h is the best place for those ACTLR_ELx bits. This header's > more about the actual uint32 upcode of system register. not the details of the fields. > And since ACTLR_ELx fields vary implementation. I think we should put them in a new > heade, actlr.h like kernel does with esr.h. > > >> #define SYS_RGSR_EL1 sys_reg(3, 0, 1, 0, 5) >> #define SYS_GCR_EL1 sys_reg(3, 0, 1, 0, 6) >> >> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c >> index a1736e9044da..b4de05241f7d 100644 >> --- a/arch/arm64/kernel/cpufeature.c >> +++ b/arch/arm64/kernel/cpufeature.c >> @@ -2406,8 +2406,12 @@ static bool has_xcall_support(const struct arm64_cpu_capabilities *entry, int __ >> } >> #endif >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> bool is_xint_support; >> +bool hw_xint_support; >> +#endif >> + >> +#ifdef CONFIG_FAST_IRQ >> static int __init xint_setup(char *str) >> { >> if (!cpus_have_cap(ARM64_HAS_GIC_CPUIF_SYSREGS)) >> @@ -2424,6 +2428,66 @@ static bool has_xint_support(const struct arm64_cpu_capabilities *entry, int __u >> } >> #endif >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +static bool test_has_xfunc(void) > > test_has_xfunc is a bit strange, could we just use has_arch_xint_support()? > >> +{ >> + u64 new, old = read_sysreg(actlr_el1); >> + >> + write_sysreg(old | ACTLR_ELx_XINT, actlr_el1); >> + isb(); >> + new = read_sysreg(actlr_el1); >> + if (new & ACTLR_ELx_XINT) { >> + write_sysreg(old, actlr_el1); >> + hw_xint_support = true; >> + return true; >> + } >> + >> + return false; >> +} >> + >> +static void enable_xfunc(void) > > Could we use cpu_enable_arch_xint()? it is not hard to find some helper functions > in this file has similar role as this. > >> +{ >> + u64 actlr_el1, actlr_el2; >> + u64 el; >> + >> + el = read_sysreg(CurrentEL); >> + if (el == CurrentEL_EL2) { >> + actlr_el2 = read_sysreg(actlr_el2); >> + actlr_el2 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el2, actlr_el2); >> + isb(); >> + actlr_el2 = read_sysreg(actlr_el2); >> + pr_info("actlr_el2: %llx, cpu:%d\n", actlr_el2, smp_processor_id()); >> + } >> + >> + actlr_el1 = read_sysreg(actlr_el1); >> + actlr_el1 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el1, actlr_el1); >> + isb(); >> + actlr_el1 = read_sysreg(actlr_el1); >> + pr_info("actlr_el1: %llx, cpu:%d\n", actlr_el1, smp_processor_id()); >> +} >> + >> +static bool test_has_xint(const struct arm64_cpu_capabilities *entry, int scope) >> +{ >> + if (!IS_ENABLED(CONFIG_ARM64_NMI)) >> + pr_info("CONFIG_ARM64_NMI disabled, using XINTs for guests only\n"); >> +#ifdef CONFIG_ARM64_PSEUDO_NMI >> + else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { >> + pr_info("Pseudo NMI enabled, not using architected XINT\n"); >> + return false; >> + } >> +#endif >> + >> + return test_has_xfunc(); >> +} > > Fold this function into has_arch_xint_support(). > >> + >> +static void xint_enable(const struct arm64_cpu_capabilities *__unused) >> +{ >> + enable_xfunc(); > > Fold this function into cpu_enable_arch_xint(). > >> +} >> +#endif >> + >> static const struct arm64_cpu_capabilities arm64_features[] = { >> { >> .capability = ARM64_ALWAYS_BOOT, >> @@ -2971,6 +3035,15 @@ static const struct arm64_cpu_capabilities arm64_features[] = { >> .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> .matches = has_xint_support, >> }, >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + { >> + .desc = "Hardware xint Support", > > Mind the ppercase for first letter. > >> + .capability = ARM64_HAS_HW_XINT, >> + .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> + .matches = test_has_xint, >> + .cpu_enable = xint_enable, >> + }, >> #endif > > I really can't recall why we add "Xint support" data into arm64_feature array before. > Just to be clear, "Xint support' is a software solution, it's about making interrupt > handler faster. It's not tied to any particular CPU feature. "Hardware Xint Support" > would means something different, like a real CPU feature. So I think we should take > it out from the arm64_feature array upon CPU can support a hardware xint entry. > >> {}, >> }; >> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c >> index 4602c107c40a..d09029dfcf02 100644 >> --- a/arch/arm64/kernel/entry-common.c >> +++ b/arch/arm64/kernel/entry-common.c >> @@ -6,6 +6,9 @@ >> */ >> >> #include <linux/context_tracking.h> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +#include <linux/irqchip/arm-gic-v3.h> >> +#endif >> #include <linux/kasan.h> >> #include <linux/linkage.h> >> #include <linux/lockdep.h> >> @@ -607,7 +610,7 @@ static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, >> } >> >> >> -asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +asmlinkage void noinstr el0t_64_sw_xint_handler(struct pt_regs *regs) >> { >> el0_xint(regs, ISR_EL1_IS, handle_arch_irq, handle_arch_nmi_irq); >> } >> @@ -966,6 +969,30 @@ asmlinkage void noinstr el0t_64_error_handler(struct pt_regs *regs) >> __el0_error_handler_common(regs); >> } >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +{ >> + u32 irqnr = read_sysreg_s(SYS_ICC_HPPIR1_EL1); >> + >> + if (gic_irqnr_is_special(irqnr)) >> + return; >> + >> + if (is_xint(irqnr)) >> + fast_handle_xint(regs, irqnr); >> + else >> + el0t_64_irq_handler(regs); >> +} > > Could we register fast_handle_xint() in gic-v3 driver, like kernel does for gic_handle_irq() > and gic_handle_nmi_irq(). By checking the return value, it still has chance to fall through > to the regular irq handler. > >> +#else >> +#ifdef CONFIG_AARCH32_EL0 >> +asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> +{ >> + __el0_irq_handler_common(regs); >> +} >> +#else /* CONFIG_AARCH32_EL0 */ >> +UNHANDLED(el0t, 32, irq) >> +#endif >> +#endif >> + >> #ifdef CONFIG_AARCH32_EL0 >> static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr) >> { >> @@ -1028,11 +1055,6 @@ asmlinkage void noinstr el0t_32_sync_handler(struct pt_regs *regs) >> } >> } >> >> -asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> -{ >> - __el0_irq_handler_common(regs); >> -} >> - >> asmlinkage void noinstr el0t_32_fiq_handler(struct pt_regs *regs) >> { >> __el0_fiq_handler_common(regs); >> @@ -1044,7 +1066,6 @@ asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs) >> } >> #else /* CONFIG_AARCH32_EL0 */ >> UNHANDLED(el0t, 32, sync) >> -UNHANDLED(el0t, 32, irq) >> UNHANDLED(el0t, 32, fiq) >> UNHANDLED(el0t, 32, error) >> #endif /* CONFIG_AARCH32_EL0 */ >> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S >> index da3809632f0f..046225fa2f90 100644 >> --- a/arch/arm64/kernel/entry.S >> +++ b/arch/arm64/kernel/entry.S >> @@ -565,7 +565,11 @@ SYM_CODE_START(vectors) >> kernel_ventry 0, t, 64, error // Error 64-bit EL0 >> >> kernel_ventry 0, t, 32, sync // Synchronous 32-bit EL0 >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + kernel_ventry 0, t, 64, xint // XINT 64-bit EL0 >> +#else >> kernel_ventry 0, t, 32, irq // IRQ 32-bit EL0 >> +#endif >> kernel_ventry 0, t, 32, fiq // FIQ 32-bit EL0 >> kernel_ventry 0, t, 32, error // Error 32-bit EL0 >> SYM_CODE_END(vectors) >> @@ -696,7 +700,7 @@ SYM_CODE_END(__bad_stack) >> kernel_entry 0, 64 >> #endif >> mov x0, sp >> - bl el0t_64_xint_handler >> + bl el0t_64_sw_xint_handler >> #ifdef CONFIG_SECURITY_FEATURE_BYPASS >> kernel_exit 0, xint >> #else >> @@ -729,6 +733,18 @@ SYM_CODE_START_LOCAL(el\el\ht\()_\regsize\()_\label) >> check_xint_pre_kernel_entry >> .Lskip_check_xint\@: >> .endif >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + .if \el == 0 && \regsize == 64 && \label == xint >> + alternative_if_not ARM64_HAS_HW_XINT >> + b .Lskip_hw_xint\@ >> + alternative_else_nop_endif >> + kernel_entry 0, 64, xint >> + mov x0, sp >> + bl el0t_64_xint_handler >> + kernel_exit 0, xint > > Could we fold the assembly code on else branch into its own macro？ > Let's give a the macro an name that has similar style with the ones > we uses in the code braced by CONFIG_FAST_IRQ/SYSCALL. 软件方案需要检查，硬件方案不需要这些检查逻辑，从xcall/xint这个入口进来就确定了是xcall/xint > >> +.Lskip_hw_xint\@: >> + .endif >> #endif >> kernel_entry \el, \regsize >> mov x0, sp >> @@ -760,7 +776,11 @@ SYM_CODE_END(el\el\ht\()_\regsize\()_\label) >> entry_handler 0, t, 64, error >> >> entry_handler 0, t, 32, sync >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + entry_handler 0, t, 64, xint >> +#else >> entry_handler 0, t, 32, irq >> +#endif >> entry_handler 0, t, 32, fiq >> entry_handler 0, t, 32, error >> >> @@ -905,7 +925,14 @@ alternative_else_nop_endif >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> +#endif >> + >> + .rept 3 >> tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> .endr >> .endm >> @@ -955,7 +982,14 @@ SYM_CODE_END(tramp_exit) >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, 0, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, 0, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, 0, \bhb >> +#endif >> + >> + .rept 3 > >> tramp_ventry .Lvector_start\@, 32, 0, \bhb >> .endr >> .endm >> diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps >> index f2ddced689b5..b1f109f17e4f 100644 >> --- a/arch/arm64/tools/cpucaps >> +++ b/arch/arm64/tools/cpucaps >> @@ -110,7 +110,7 @@ WORKAROUND_HISI_HIP08_RU_PREFETCH >> WORKAROUND_HISILICON_1980005 >> HAS_XCALL >> HAS_XINT >> -KABI_RESERVE_3 >> +HAS_HW_XINT >> KABI_RESERVE_4 >> KABI_RESERVE_5 >> KABI_RESERVE_6 >> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c >> index 4cc8b95d533f..32ffdf06f61e 100644 >> --- a/drivers/irqchip/irq-gic-v3.c >> +++ b/drivers/irqchip/irq-gic-v3.c >> @@ -35,7 +35,7 @@ >> >> #include "irq-gic-common.h" >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> #include "../../../kernel/irq/internals.h" >> #endif >> >> @@ -828,7 +828,7 @@ static bool gic_rpr_is_nmi_prio(void) >> return unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI)); >> } >> >> -static bool gic_irqnr_is_special(u32 irqnr) >> +bool gic_irqnr_is_special(u32 irqnr) >> { >> return irqnr >= 1020 && irqnr <= 1023; >> } > > Please don't do this, left it static. > >> @@ -993,7 +993,11 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs >> __gic_handle_irq_from_irqson(regs); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +DECLARE_BITMAP(irqnr_nmi_map, 1024); >> +#endif >> + >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> DECLARE_BITMAP(irqnr_xint_map, 1024); >> >> static bool can_set_xint(unsigned int hwirq) >> @@ -1002,12 +1006,18 @@ static bool can_set_xint(unsigned int hwirq) >> __get_intid_range(hwirq) == SPI_RANGE) >> return true; >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (hw_xint_support && __get_intid_range(hwirq) == PPI_RANGE) >> + return true; >> +#endif >> + >> return false; >> } >> >> static bool xint_transform(int irqno, enum xint_op op) >> { >> struct irq_data *data = irq_get_irq_data(irqno); >> + struct irq_desc *desc; >> int hwirq; >> >> while (data->parent_data) >> @@ -1018,14 +1028,29 @@ static bool xint_transform(int irqno, enum xint_op op) >> if (!can_set_xint(hwirq)) >> return false; >> >> + desc = irq_data_to_desc(data); >> + >> switch (op) { >> case IRQ_TO_XINT: >> set_bit(hwirq, irqnr_xint_map); >> xint_add_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && !irq_is_nmi(desc)) { >> + gic_irq_enable_nmi(data); >> + set_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return true; >> case XINT_TO_IRQ: >> clear_bit(hwirq, irqnr_xint_map); >> xint_remove_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && irq_is_nmi(desc) && >> + test_bit(hwirq, irqnr_nmi_map)) { >> + gic_irq_disable_nmi(data); >> + clear_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return false; >> case XINT_SET_CHECK: >> return test_bit(hwirq, irqnr_xint_map); >> @@ -1096,7 +1121,7 @@ static const struct proc_ops xint_proc_ops = { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> /* create /proc/irq/<irq>/xint */ >> @@ -1105,12 +1130,63 @@ void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> >> void unregister_irqchip_proc(struct irq_desc *desc) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> remove_proc_entry("xint", desc->dir); >> } >> -#endif /* CONFIG_FAST_IRQ */ >> +#endif >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +bool is_xint(unsigned long hwirq) >> +{ >> + return test_bit(hwirq, irqnr_xint_map); >> +} >> + >> +static bool is_spi(unsigned long hwirq) >> +{ >> + if (__get_intid_range(hwirq) == SPI_RANGE || >> + __get_intid_range(hwirq) == ESPI_RANGE) >> + return true; >> + >> + return false; >> +} >> + >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr) >> +{ >> + struct pt_regs *old_regs; >> + struct irq_domain *domain; >> + struct irqaction *action; >> + struct irq_desc *desc; >> + struct irq_data *data; >> + >> + arch_nmi_enter(); >> + BUG_ON(in_nmi() == NMI_MASK); >> + __preempt_count_add(NMI_OFFSET + HARDIRQ_OFFSET); >> + old_regs = set_irq_regs(regs); >> + >> + domain = irq_get_default_host(); >> + data = radix_tree_lookup(&domain->revmap_tree, irqnr); >> + >> + desc = irq_data_to_desc(data); >> + action = desc->action; >> + >> + gic_read_nmiar(); >> + write_gicreg(irqnr, ICC_EOIR1_EL1); >> + isb(); >> + >> + if (is_spi(irqnr)) >> + action->handler(data->irq, action->dev_id); >> + else >> + action->handler(data->irq, raw_cpu_ptr(action->percpu_dev_id)); >> + gic_write_dir(irqnr); >> + >> + set_irq_regs(old_regs); >> + BUG_ON(!in_nmi()); >> + __preempt_count_sub(NMI_OFFSET + HARDIRQ_OFFSET); >> + arch_nmi_exit(); >> +} >> +#endif >> >> static u32 gic_get_pribits(void) >> { >> @@ -2358,6 +2434,7 @@ static int __init gic_init_bases(phys_addr_t dist_phys_base, >> goto out_free; >> } >> >> + irq_set_default_host(gic_data.domain); >> irq_domain_update_bus_token(gic_data.domain, DOMAIN_BUS_WIRED); >> >> gic_data.has_rss = !!(typer & GICD_TYPER_RSS); >> diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h >> index 548b8a5c46cf..3c0f04b86c15 100644 >> --- a/include/linux/irqchip/arm-gic-v3.h >> +++ b/include/linux/irqchip/arm-gic-v3.h >> @@ -721,8 +721,9 @@ static inline enum gic_intid_range __get_intid_range(irq_hw_number_t hwirq) >> } >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> enum xint_op { >> XINT_TO_IRQ, >> @@ -733,6 +734,9 @@ enum xint_op { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp); >> void unregister_irqchip_proc(struct irq_desc *desc); >> +bool gic_irqnr_is_special(u32 irqnr); >> +bool is_xint(unsigned long hwirq); >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr); >> #endif >> #endif >> >> diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c >> index dc94c360b54b..2152125f8ae2 100644 >> --- a/kernel/irq/debugfs.c >> +++ b/kernel/irq/debugfs.c >> @@ -242,7 +242,7 @@ void irq_add_debugfs_entry(unsigned int irq, struct irq_desc *desc) >> &dfs_irq_ops); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> static struct dentry *xint_dir; >> >> void xint_add_debugfs_entry(unsigned int irq) >> @@ -281,8 +281,8 @@ static int __init irq_debugfs_init(void) >> >> irq_dir = debugfs_create_dir("irqs", root_dir); >> >> -#ifdef CONFIG_FAST_IRQ >> - if (is_xint_support) >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> + if (is_xint_support || hw_xint_support) >> xint_dir = debugfs_create_dir("xints", root_dir); >> #endif >> >> diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h >> index 2fb08139a9e4..1c64854102f5 100644 >> --- a/kernel/irq/internals.h >> +++ b/kernel/irq/internals.h >> @@ -506,8 +506,9 @@ static inline void irq_remove_debugfs_entry(struct irq_desc *desc) >> kfree(desc->dev_name); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> void xint_add_debugfs_entry(unsigned int irq); >> void xint_remove_debugfs_entry(unsigned int irq); >

1 0

Re: [PATCH OLK-6.6 v2 2/3] arm64: entry: Support hardware xint
by Jinjie Ruan 25 Mar '25

25 Mar '25

On 2025/3/25 15:00, Liao, Chang wrote: > > > 在 2025/3/24 21:53, Jinjie Ruan 写道: >> hulk inclusion >> category: feature >> bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 >> >> -------------------------------- >> >> Support hardware xint. Hardware xint provides a separate entry for >> interrupt handling, so we can use it to customize and respond to >> interrupts relatively quickly. >> >> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> >> --- >> v2: >> - Reuse the xint set and check logic in xint 1.0. >> - Introduce fast_handle_xint(). >> - Rename enable_xint_xcall() to enable_xfunc(). >> - Rename test_has_xint_xcall() to test_has_xfunc(). >> - Fix a typo, Harware -> Hardware. >> - Add a blank line after declarations in el0t_64_xint_handler(). >> --- >> arch/arm64/Kconfig | 7 +++ >> arch/arm64/include/asm/sysreg.h | 4 ++ >> arch/arm64/kernel/cpufeature.c | 75 ++++++++++++++++++++++++- >> arch/arm64/kernel/entry-common.c | 35 +++++++++--- >> arch/arm64/kernel/entry.S | 40 +++++++++++++- >> arch/arm64/tools/cpucaps | 2 +- >> drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++++++++-- >> include/linux/irqchip/arm-gic-v3.h | 6 +- >> kernel/irq/debugfs.c | 6 +- >> kernel/irq/internals.h | 3 +- >> 10 files changed, 244 insertions(+), 23 deletions(-) >> >> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig >> index 9da9d58f1c02..57d05cfbd29e 100644 >> --- a/arch/arm64/Kconfig >> +++ b/arch/arm64/Kconfig >> @@ -1717,6 +1717,13 @@ config ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG >> config ARCH_SUPPORTS_CRASH_DUMP >> def_bool y >> >> +config ARCH_SUPPORTS_XINT >> + bool "Hardware xint support" >> + default n >> + depends on ARM64_NMI >> + depends on ARM_GIC_V3 >> + depends on !COMPAT >> + >> config TRANS_TABLE >> def_bool y >> depends on HIBERNATION || KEXEC_CORE >> diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h >> index 435634a703c6..b34e8cc4476b 100644 >> --- a/arch/arm64/include/asm/sysreg.h >> +++ b/arch/arm64/include/asm/sysreg.h >> @@ -269,6 +269,10 @@ >> #define SYS_REVIDR_EL1 sys_reg(3, 0, 0, 0, 6) >> >> #define SYS_ACTLR_EL1 sys_reg(3, 0, 1, 0, 1) >> + >> +#define ACTLR_ELx_XINT_SHIFT 21 >> +#define ACTLR_ELx_XINT (BIT(ACTLR_ELx_XINT_SHIFT)) >> + > > I don't think sysreg.h is the best place for those ACTLR_ELx bits. This header's > more about the actual uint32 upcode of system register. not the details of the fields. > And since ACTLR_ELx fields vary implementation. I think we should put them in a new > heade, actlr.h like kernel does with esr.h. > > >> #define SYS_RGSR_EL1 sys_reg(3, 0, 1, 0, 5) >> #define SYS_GCR_EL1 sys_reg(3, 0, 1, 0, 6) >> >> diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c >> index a1736e9044da..b4de05241f7d 100644 >> --- a/arch/arm64/kernel/cpufeature.c >> +++ b/arch/arm64/kernel/cpufeature.c >> @@ -2406,8 +2406,12 @@ static bool has_xcall_support(const struct arm64_cpu_capabilities *entry, int __ >> } >> #endif >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> bool is_xint_support; >> +bool hw_xint_support; >> +#endif >> + >> +#ifdef CONFIG_FAST_IRQ >> static int __init xint_setup(char *str) >> { >> if (!cpus_have_cap(ARM64_HAS_GIC_CPUIF_SYSREGS)) >> @@ -2424,6 +2428,66 @@ static bool has_xint_support(const struct arm64_cpu_capabilities *entry, int __u >> } >> #endif >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +static bool test_has_xfunc(void) > > test_has_xfunc is a bit strange, could we just use has_arch_xint_support()? > >> +{ >> + u64 new, old = read_sysreg(actlr_el1); >> + >> + write_sysreg(old | ACTLR_ELx_XINT, actlr_el1); >> + isb(); >> + new = read_sysreg(actlr_el1); >> + if (new & ACTLR_ELx_XINT) { >> + write_sysreg(old, actlr_el1); >> + hw_xint_support = true; >> + return true; >> + } >> + >> + return false; >> +} >> + >> +static void enable_xfunc(void) > > Could we use cpu_enable_arch_xint()? it is not hard to find some helper functions > in this file has similar role as this. > >> +{ >> + u64 actlr_el1, actlr_el2; >> + u64 el; >> + >> + el = read_sysreg(CurrentEL); >> + if (el == CurrentEL_EL2) { >> + actlr_el2 = read_sysreg(actlr_el2); >> + actlr_el2 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el2, actlr_el2); >> + isb(); >> + actlr_el2 = read_sysreg(actlr_el2); >> + pr_info("actlr_el2: %llx, cpu:%d\n", actlr_el2, smp_processor_id()); >> + } >> + >> + actlr_el1 = read_sysreg(actlr_el1); >> + actlr_el1 |= ACTLR_ELx_XINT; >> + write_sysreg(actlr_el1, actlr_el1); >> + isb(); >> + actlr_el1 = read_sysreg(actlr_el1); >> + pr_info("actlr_el1: %llx, cpu:%d\n", actlr_el1, smp_processor_id()); >> +} >> + >> +static bool test_has_xint(const struct arm64_cpu_capabilities *entry, int scope) >> +{ >> + if (!IS_ENABLED(CONFIG_ARM64_NMI)) >> + pr_info("CONFIG_ARM64_NMI disabled, using XINTs for guests only\n"); >> +#ifdef CONFIG_ARM64_PSEUDO_NMI >> + else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { >> + pr_info("Pseudo NMI enabled, not using architected XINT\n"); >> + return false; >> + } >> +#endif >> + >> + return test_has_xfunc(); >> +} > > Fold this function into has_arch_xint_support(). > >> + >> +static void xint_enable(const struct arm64_cpu_capabilities *__unused) >> +{ >> + enable_xfunc(); > > Fold this function into cpu_enable_arch_xint(). > >> +} >> +#endif >> + >> static const struct arm64_cpu_capabilities arm64_features[] = { >> { >> .capability = ARM64_ALWAYS_BOOT, >> @@ -2971,6 +3035,15 @@ static const struct arm64_cpu_capabilities arm64_features[] = { >> .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> .matches = has_xint_support, >> }, >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + { >> + .desc = "Hardware xint Support", > > Mind the ppercase for first letter. > >> + .capability = ARM64_HAS_HW_XINT, >> + .type = ARM64_CPUCAP_SYSTEM_FEATURE, >> + .matches = test_has_xint, >> + .cpu_enable = xint_enable, >> + }, >> #endif > > I really can't recall why we add "Xint support" data into arm64_feature array before. > Just to be clear, "Xint support' is a software solution, it's about making interrupt > handler faster. It's not tied to any particular CPU feature. "Hardware Xint Support" > would means something different, like a real CPU feature. So I think we should take > it out from the arm64_feature array upon CPU can support a hardware xint entry. 这个在实现xcall/xint 1.0代码的时候，是为了和后面硬件xcall/xint的检测代码兼容吧，当时检视意见是统一和xcall一样这样做 @邹贻鹏 > >> {}, >> }; >> diff --git a/arch/arm64/kernel/entry-common.c b/arch/arm64/kernel/entry-common.c >> index 4602c107c40a..d09029dfcf02 100644 >> --- a/arch/arm64/kernel/entry-common.c >> +++ b/arch/arm64/kernel/entry-common.c >> @@ -6,6 +6,9 @@ >> */ >> >> #include <linux/context_tracking.h> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +#include <linux/irqchip/arm-gic-v3.h> >> +#endif >> #include <linux/kasan.h> >> #include <linux/linkage.h> >> #include <linux/lockdep.h> >> @@ -607,7 +610,7 @@ static void noinstr el0_xint(struct pt_regs *regs, u64 nmi_flag, >> } >> >> >> -asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +asmlinkage void noinstr el0t_64_sw_xint_handler(struct pt_regs *regs) >> { >> el0_xint(regs, ISR_EL1_IS, handle_arch_irq, handle_arch_nmi_irq); >> } >> @@ -966,6 +969,30 @@ asmlinkage void noinstr el0t_64_error_handler(struct pt_regs *regs) >> __el0_error_handler_common(regs); >> } >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +asmlinkage void noinstr el0t_64_xint_handler(struct pt_regs *regs) >> +{ >> + u32 irqnr = read_sysreg_s(SYS_ICC_HPPIR1_EL1); >> + >> + if (gic_irqnr_is_special(irqnr)) >> + return; >> + >> + if (is_xint(irqnr)) >> + fast_handle_xint(regs, irqnr); >> + else >> + el0t_64_irq_handler(regs); >> +} > > Could we register fast_handle_xint() in gic-v3 driver, like kernel does for gic_handle_irq() > and gic_handle_nmi_irq(). By checking the return value, it still has chance to fall through > to the regular irq handler. > >> +#else >> +#ifdef CONFIG_AARCH32_EL0 >> +asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> +{ >> + __el0_irq_handler_common(regs); >> +} >> +#else /* CONFIG_AARCH32_EL0 */ >> +UNHANDLED(el0t, 32, irq) >> +#endif >> +#endif >> + >> #ifdef CONFIG_AARCH32_EL0 >> static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr) >> { >> @@ -1028,11 +1055,6 @@ asmlinkage void noinstr el0t_32_sync_handler(struct pt_regs *regs) >> } >> } >> >> -asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs) >> -{ >> - __el0_irq_handler_common(regs); >> -} >> - >> asmlinkage void noinstr el0t_32_fiq_handler(struct pt_regs *regs) >> { >> __el0_fiq_handler_common(regs); >> @@ -1044,7 +1066,6 @@ asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs) >> } >> #else /* CONFIG_AARCH32_EL0 */ >> UNHANDLED(el0t, 32, sync) >> -UNHANDLED(el0t, 32, irq) >> UNHANDLED(el0t, 32, fiq) >> UNHANDLED(el0t, 32, error) >> #endif /* CONFIG_AARCH32_EL0 */ >> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S >> index da3809632f0f..046225fa2f90 100644 >> --- a/arch/arm64/kernel/entry.S >> +++ b/arch/arm64/kernel/entry.S >> @@ -565,7 +565,11 @@ SYM_CODE_START(vectors) >> kernel_ventry 0, t, 64, error // Error 64-bit EL0 >> >> kernel_ventry 0, t, 32, sync // Synchronous 32-bit EL0 >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + kernel_ventry 0, t, 64, xint // XINT 64-bit EL0 >> +#else >> kernel_ventry 0, t, 32, irq // IRQ 32-bit EL0 >> +#endif >> kernel_ventry 0, t, 32, fiq // FIQ 32-bit EL0 >> kernel_ventry 0, t, 32, error // Error 32-bit EL0 >> SYM_CODE_END(vectors) >> @@ -696,7 +700,7 @@ SYM_CODE_END(__bad_stack) >> kernel_entry 0, 64 >> #endif >> mov x0, sp >> - bl el0t_64_xint_handler >> + bl el0t_64_sw_xint_handler >> #ifdef CONFIG_SECURITY_FEATURE_BYPASS >> kernel_exit 0, xint >> #else >> @@ -729,6 +733,18 @@ SYM_CODE_START_LOCAL(el\el\ht\()_\regsize\()_\label) >> check_xint_pre_kernel_entry >> .Lskip_check_xint\@: >> .endif >> +#endif >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + .if \el == 0 && \regsize == 64 && \label == xint >> + alternative_if_not ARM64_HAS_HW_XINT >> + b .Lskip_hw_xint\@ >> + alternative_else_nop_endif >> + kernel_entry 0, 64, xint >> + mov x0, sp >> + bl el0t_64_xint_handler >> + kernel_exit 0, xint > > Could we fold the assembly code on else branch into its own macro？ > Let's give a the macro an name that has similar style with the ones > we uses in the code braced by CONFIG_FAST_IRQ/SYSCALL. > >> +.Lskip_hw_xint\@: >> + .endif >> #endif >> kernel_entry \el, \regsize >> mov x0, sp >> @@ -760,7 +776,11 @@ SYM_CODE_END(el\el\ht\()_\regsize\()_\label) >> entry_handler 0, t, 64, error >> >> entry_handler 0, t, 32, sync >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + entry_handler 0, t, 64, xint >> +#else >> entry_handler 0, t, 32, irq >> +#endif >> entry_handler 0, t, 32, fiq >> entry_handler 0, t, 32, error >> >> @@ -905,7 +925,14 @@ alternative_else_nop_endif >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, \kpti, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> +#endif >> + >> + .rept 3 >> tramp_ventry .Lvector_start\@, 32, \kpti, \bhb >> .endr >> .endm >> @@ -955,7 +982,14 @@ SYM_CODE_END(tramp_exit) >> .rept 4 >> tramp_ventry .Lvector_start\@, 64, 0, \bhb >> .endr >> - .rept 4 >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + tramp_ventry .Lvector_start\@, 64, 0, \bhb >> +#else >> + tramp_ventry .Lvector_start\@, 32, 0, \bhb >> +#endif >> + >> + .rept 3 > >> tramp_ventry .Lvector_start\@, 32, 0, \bhb >> .endr >> .endm >> diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps >> index f2ddced689b5..b1f109f17e4f 100644 >> --- a/arch/arm64/tools/cpucaps >> +++ b/arch/arm64/tools/cpucaps >> @@ -110,7 +110,7 @@ WORKAROUND_HISI_HIP08_RU_PREFETCH >> WORKAROUND_HISILICON_1980005 >> HAS_XCALL >> HAS_XINT >> -KABI_RESERVE_3 >> +HAS_HW_XINT >> KABI_RESERVE_4 >> KABI_RESERVE_5 >> KABI_RESERVE_6 >> diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c >> index 4cc8b95d533f..32ffdf06f61e 100644 >> --- a/drivers/irqchip/irq-gic-v3.c >> +++ b/drivers/irqchip/irq-gic-v3.c >> @@ -35,7 +35,7 @@ >> >> #include "irq-gic-common.h" >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> #include "../../../kernel/irq/internals.h" >> #endif >> >> @@ -828,7 +828,7 @@ static bool gic_rpr_is_nmi_prio(void) >> return unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI)); >> } >> >> -static bool gic_irqnr_is_special(u32 irqnr) >> +bool gic_irqnr_is_special(u32 irqnr) >> { >> return irqnr >= 1020 && irqnr <= 1023; >> } > > Please don't do this, left it static. > >> @@ -993,7 +993,11 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs >> __gic_handle_irq_from_irqson(regs); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +DECLARE_BITMAP(irqnr_nmi_map, 1024); >> +#endif >> + >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> DECLARE_BITMAP(irqnr_xint_map, 1024); >> >> static bool can_set_xint(unsigned int hwirq) >> @@ -1002,12 +1006,18 @@ static bool can_set_xint(unsigned int hwirq) >> __get_intid_range(hwirq) == SPI_RANGE) >> return true; >> >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (hw_xint_support && __get_intid_range(hwirq) == PPI_RANGE) >> + return true; >> +#endif >> + >> return false; >> } >> >> static bool xint_transform(int irqno, enum xint_op op) >> { >> struct irq_data *data = irq_get_irq_data(irqno); >> + struct irq_desc *desc; >> int hwirq; >> >> while (data->parent_data) >> @@ -1018,14 +1028,29 @@ static bool xint_transform(int irqno, enum xint_op op) >> if (!can_set_xint(hwirq)) >> return false; >> >> + desc = irq_data_to_desc(data); >> + >> switch (op) { >> case IRQ_TO_XINT: >> set_bit(hwirq, irqnr_xint_map); >> xint_add_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && !irq_is_nmi(desc)) { >> + gic_irq_enable_nmi(data); >> + set_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return true; >> case XINT_TO_IRQ: >> clear_bit(hwirq, irqnr_xint_map); >> xint_remove_debugfs_entry(irqno); >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> + if (has_v3_3_nmi() && hw_xint_support && irq_is_nmi(desc) && >> + test_bit(hwirq, irqnr_nmi_map)) { >> + gic_irq_disable_nmi(data); >> + clear_bit(hwirq, irqnr_nmi_map); >> + } >> +#endif >> return false; >> case XINT_SET_CHECK: >> return test_bit(hwirq, irqnr_xint_map); >> @@ -1096,7 +1121,7 @@ static const struct proc_ops xint_proc_ops = { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> /* create /proc/irq/<irq>/xint */ >> @@ -1105,12 +1130,63 @@ void register_irqchip_proc(struct irq_desc *desc, void *irqp) >> >> void unregister_irqchip_proc(struct irq_desc *desc) >> { >> - if (!is_xint_support) >> + if (!is_xint_support && !hw_xint_support) >> return; >> >> remove_proc_entry("xint", desc->dir); >> } >> -#endif /* CONFIG_FAST_IRQ */ >> +#endif >> + >> +#ifdef CONFIG_ARCH_SUPPORTS_XINT >> +bool is_xint(unsigned long hwirq) >> +{ >> + return test_bit(hwirq, irqnr_xint_map); >> +} >> + >> +static bool is_spi(unsigned long hwirq) >> +{ >> + if (__get_intid_range(hwirq) == SPI_RANGE || >> + __get_intid_range(hwirq) == ESPI_RANGE) >> + return true; >> + >> + return false; >> +} >> + >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr) >> +{ >> + struct pt_regs *old_regs; >> + struct irq_domain *domain; >> + struct irqaction *action; >> + struct irq_desc *desc; >> + struct irq_data *data; >> + >> + arch_nmi_enter(); >> + BUG_ON(in_nmi() == NMI_MASK); >> + __preempt_count_add(NMI_OFFSET + HARDIRQ_OFFSET); >> + old_regs = set_irq_regs(regs); >> + >> + domain = irq_get_default_host(); >> + data = radix_tree_lookup(&domain->revmap_tree, irqnr); >> + >> + desc = irq_data_to_desc(data); >> + action = desc->action; >> + >> + gic_read_nmiar(); >> + write_gicreg(irqnr, ICC_EOIR1_EL1); >> + isb(); >> + >> + if (is_spi(irqnr)) >> + action->handler(data->irq, action->dev_id); >> + else >> + action->handler(data->irq, raw_cpu_ptr(action->percpu_dev_id)); >> + gic_write_dir(irqnr); >> + >> + set_irq_regs(old_regs); >> + BUG_ON(!in_nmi()); >> + __preempt_count_sub(NMI_OFFSET + HARDIRQ_OFFSET); >> + arch_nmi_exit(); >> +} >> +#endif >> >> static u32 gic_get_pribits(void) >> { >> @@ -2358,6 +2434,7 @@ static int __init gic_init_bases(phys_addr_t dist_phys_base, >> goto out_free; >> } >> >> + irq_set_default_host(gic_data.domain); >> irq_domain_update_bus_token(gic_data.domain, DOMAIN_BUS_WIRED); >> >> gic_data.has_rss = !!(typer & GICD_TYPER_RSS); >> diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h >> index 548b8a5c46cf..3c0f04b86c15 100644 >> --- a/include/linux/irqchip/arm-gic-v3.h >> +++ b/include/linux/irqchip/arm-gic-v3.h >> @@ -721,8 +721,9 @@ static inline enum gic_intid_range __get_intid_range(irq_hw_number_t hwirq) >> } >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> enum xint_op { >> XINT_TO_IRQ, >> @@ -733,6 +734,9 @@ enum xint_op { >> >> void register_irqchip_proc(struct irq_desc *desc, void *irqp); >> void unregister_irqchip_proc(struct irq_desc *desc); >> +bool gic_irqnr_is_special(u32 irqnr); >> +bool is_xint(unsigned long hwirq); >> +void fast_handle_xint(struct pt_regs *regs, u32 irqnr); >> #endif >> #endif >> >> diff --git a/kernel/irq/debugfs.c b/kernel/irq/debugfs.c >> index dc94c360b54b..2152125f8ae2 100644 >> --- a/kernel/irq/debugfs.c >> +++ b/kernel/irq/debugfs.c >> @@ -242,7 +242,7 @@ void irq_add_debugfs_entry(unsigned int irq, struct irq_desc *desc) >> &dfs_irq_ops); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> static struct dentry *xint_dir; >> >> void xint_add_debugfs_entry(unsigned int irq) >> @@ -281,8 +281,8 @@ static int __init irq_debugfs_init(void) >> >> irq_dir = debugfs_create_dir("irqs", root_dir); >> >> -#ifdef CONFIG_FAST_IRQ >> - if (is_xint_support) >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> + if (is_xint_support || hw_xint_support) >> xint_dir = debugfs_create_dir("xints", root_dir); >> #endif >> >> diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h >> index 2fb08139a9e4..1c64854102f5 100644 >> --- a/kernel/irq/internals.h >> +++ b/kernel/irq/internals.h >> @@ -506,8 +506,9 @@ static inline void irq_remove_debugfs_entry(struct irq_desc *desc) >> kfree(desc->dev_name); >> } >> >> -#ifdef CONFIG_FAST_IRQ >> +#if defined(CONFIG_FAST_IRQ) || defined(CONFIG_ARCH_SUPPORTS_XINT) >> extern bool is_xint_support; >> +extern bool hw_xint_support; >> >> void xint_add_debugfs_entry(unsigned int irq); >> void xint_remove_debugfs_entry(unsigned int irq); >

1 0

[openeuler:openEuler-1.0-LTS 1513/1513] mm/page_ext.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 25 Mar '25

25 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3e8e3ea77f0dd528b080f91d615144093b741003 commit: 5f0e34d2aceec67c169be7599d82f0e8519c37f7 [1513/1513] mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning config: x86_64-buildonly-randconfig-005-20250324 (https://download.01.org/0day-ci/archive/20250325/202503251400.xG2WACIP-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250325/202503251400.xG2WACIP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503251400.xG2WACIP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/page_ext.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] btrfs: do proper folio cleanup when cow_file_range() failed
by Zizhi Wo 25 Mar '25

25 Mar '25

From: Qu Wenruo <wqu(a)suse.com> stable inclusion from stable-v6.13.2 commit 692cf71173bb41395c855acbbbe197d3aedfa5d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBJV CVE: CVE-2024-57976 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 06f364284794f149d2abc167c11d556cf20c954b upstream. [BUG] When testing with COW fixup marked as BUG_ON() (this is involved with the new pin_user_pages*() change, which should not result new out-of-band dirty pages), I hit a crash triggered by the BUG_ON() from hitting COW fixup path. This BUG_ON() happens just after a failed btrfs_run_delalloc_range(): BTRFS error (device dm-2): failed to run delalloc range, root 348 ino 405 folio 65536 submit_bitmap 6-15 start 90112 len 106496: -28 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1444! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 0 UID: 0 PID: 434621 Comm: kworker/u24:8 Tainted: G OE 6.12.0-rc7-custom+ #86 Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : extent_writepage_io+0x2d4/0x308 [btrfs] lr : extent_writepage_io+0x2d4/0x308 [btrfs] Call trace: extent_writepage_io+0x2d4/0x308 [btrfs] extent_writepage+0x218/0x330 [btrfs] extent_write_cache_pages+0x1d4/0x4b0 [btrfs] btrfs_writepages+0x94/0x150 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x88/0xc8 start_delalloc_inodes+0x180/0x3b0 [btrfs] btrfs_start_delalloc_roots+0x174/0x280 [btrfs] shrink_delalloc+0x114/0x280 [btrfs] flush_space+0x250/0x2f8 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x164/0x408 worker_thread+0x25c/0x388 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: aa1403e1 9402f3ef aa1403e0 9402f36f (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] That failure is mostly from cow_file_range(), where we can hit -ENOSPC. Although the -ENOSPC is already a bug related to our space reservation code, let's just focus on the error handling. For example, we have the following dirty range [0, 64K) of an inode, with 4K sector size and 4K page size: 0 16K 32K 48K 64K |///////////////////////////////////////| |#######################################| Where |///| means page are still dirty, and |###| means the extent io tree has EXTENT_DELALLOC flag. - Enter extent_writepage() for page 0 - Enter btrfs_run_delalloc_range() for range [0, 64K) - Enter cow_file_range() for range [0, 64K) - Function btrfs_reserve_extent() only reserved one 16K extent So we created extent map and ordered extent for range [0, 16K) 0 16K 32K 48K 64K |////////|//////////////////////////////| |<- OE ->|##############################| And range [0, 16K) has its delalloc flag cleared. But since we haven't yet submit any bio, involved 4 pages are still dirty. - Function btrfs_reserve_extent() returns with -ENOSPC Now we have to run error cleanup, which will clear all EXTENT_DELALLOC* flags and clear the dirty flags for the remaining ranges: 0 16K 32K 48K 64K |////////| | | | | Note that range [0, 16K) still has its pages dirty. - Some time later, writeback is triggered again for the range [0, 16K) since the page range still has dirty flags. - btrfs_run_delalloc_range() will do nothing because there is no EXTENT_DELALLOC flag. - extent_writepage_io() finds page 0 has no ordered flag Which falls into the COW fixup path, triggering the BUG_ON(). Unfortunately this error handling bug dates back to the introduction of btrfs. Thankfully with the abuse of COW fixup, at least it won't crash the kernel. [FIX] Instead of immediately unlocking the extent and folios, we keep the extent and folios locked until either erroring out or the whole delalloc range finished. When the whole delalloc range finished without error, we just unlock the whole range with PAGE_SET_ORDERED (and PAGE_UNLOCK for !keep_locked cases), with EXTENT_DELALLOC and EXTENT_LOCKED cleared. And the involved folios will be properly submitted, with their dirty flags cleared during submission. For the error path, it will be a little more complex: - The range with ordered extent allocated (range (1)) We only clear the EXTENT_DELALLOC and EXTENT_LOCKED, as the remaining flags are cleaned up by btrfs_mark_ordered_io_finished()->btrfs_finish_one_ordered(). For folios we finish the IO (clear dirty, start writeback and immediately finish the writeback) and unlock the folios. - The range with reserved extent but no ordered extent (range(2)) - The range we never touched (range(3)) For both range (2) and range(3) the behavior is not changed. Now even if cow_file_range() failed halfway with some successfully reserved extents/ordered extents, we will keep all folios clean, so there will be no future writeback triggered on them. CC: stable(a)vger.kernel.org Fixes: 524272607e88 ("btrfs: Handle delalloc error correctly to avoid ordered extent hang") Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/btrfs/inode.c [Some context conflicts are encountered when adapting: 1. ram_size -> cur_size: 5599f39356c6 ("btrfs: simplify range tracking in cow_file_range()"), just simplify the process and do not affect the logic. 2. There is no lock_extent related code: 0ab540995ae0 ("btrfs: push lock_extent into cow_file_range_inline")\a0766d8f35d8 ("btrfs: push extent lock into cow_file_range"), this is to narrow the scope of lock, but does not affect this patch. 3. extent_clear_unlock_delalloc() missed a parameter named "cached": 6b0a63a4fa31 ("btrfs: add a cached state to extent_clear_unlock_delalloc"), does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/btrfs/inode.c | 54 ++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 71902110c2fe..862cc8703bf0 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1356,6 +1356,17 @@ static noinline int cow_file_range(struct btrfs_inode *inode, alloc_hint = get_extent_allocation_hint(inode, start, num_bytes); + /* + * We're not doing compressed IO, don't unlock the first page (which + * the caller expects to stay locked), don't clear any dirty bits and + * don't set any writeback bits. + * + * Do set the Ordered (Private2) bit so we know this page was properly + * setup for writepage. + */ + page_ops = (keep_locked ? 0 : PAGE_UNLOCK); + page_ops |= PAGE_SET_ORDERED; + /* * Relocation relies on the relocated extents to have exactly the same * size as the original extents. Normally writeback for relocation data @@ -1456,21 +1467,6 @@ static noinline int cow_file_range(struct btrfs_inode *inode, btrfs_dec_block_group_reservations(fs_info, ins.objectid); - /* - * We're not doing compressed IO, don't unlock the first page - * (which the caller expects to stay locked), don't clear any - * dirty bits and don't set any writeback bits - * - * Do set the Ordered (Private2) bit so we know this page was - * properly setup for writepage. - */ - page_ops = (keep_locked ? 0 : PAGE_UNLOCK); - page_ops |= PAGE_SET_ORDERED; - - extent_clear_unlock_delalloc(inode, start, start + ram_size - 1, - locked_page, - EXTENT_LOCKED | EXTENT_DELALLOC, - page_ops); if (num_bytes < cur_alloc_size) num_bytes = 0; else @@ -1487,6 +1483,8 @@ static noinline int cow_file_range(struct btrfs_inode *inode, if (ret) goto out_unlock; } + extent_clear_unlock_delalloc(inode, orig_start, end, locked_page, + EXTENT_LOCKED | EXTENT_DELALLOC, page_ops); done: if (done_offset) *done_offset = end; @@ -1507,29 +1505,31 @@ static noinline int cow_file_range(struct btrfs_inode *inode, * We process each region below. */ - clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | - EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; - page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; - /* * For the range (1). We have already instantiated the ordered extents * for this region. They are cleaned up by * btrfs_cleanup_ordered_extents() in e.g, - * btrfs_run_delalloc_range(). EXTENT_LOCKED | EXTENT_DELALLOC are - * already cleared in the above loop. And, EXTENT_DELALLOC_NEW | - * EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV are handled by the cleanup - * function. + * btrfs_run_delalloc_range(). + * EXTENT_DELALLOC_NEW | EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV + * are also handled by the cleanup function. * - * However, in case of @keep_locked, we still need to unlock the pages - * (except @locked_page) to ensure all the pages are unlocked. + * So here we only clear EXTENT_LOCKED and EXTENT_DELALLOC flag, and + * finish the writeback of the involved folios, which will be never submitted. */ - if (keep_locked && orig_start < start) { + if (orig_start < start) { + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + if (!locked_page) mapping_set_error(inode->vfs_inode.i_mapping, ret); extent_clear_unlock_delalloc(inode, orig_start, start - 1, - locked_page, 0, page_ops); + locked_page, clear_bits, page_ops); } + clear_bits = EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_DELALLOC_NEW | + EXTENT_DEFRAG | EXTENT_CLEAR_META_RESV; + page_ops = PAGE_UNLOCK | PAGE_START_WRITEBACK | PAGE_END_WRITEBACK; + /* * For the range (2). If we reserved an extent for our delalloc range * (or a subrange) and failed to create the respective ordered extent, -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2022-49553
by Zizhi Wo 25 Mar '25

25 Mar '25

Randy Dunlap (1): fs/ntfs3: validate BOOT sectors_per_clusters Shigeru Yoshida (1): fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() fs/ntfs3/super.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) -- 2.39.2

2 3