- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION d54ba3f54612a8622df13d42bc1870048cb63d20
by kernel test robot 21 Mar '25

21 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: d54ba3f54612a8622df13d42bc1870048cb63d20 !15586 scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503201721.gZeymcpc-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503201839.XDDCG7DI-lkp@intel.com drivers/dma/pl330.c:2598:15: warning: 'dst' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/dma/pl330.c:2599:15: warning: 'src' may be used uninitialized in this function [-Wmaybe-uninitialized] drivers/mtd/nand/onenand/onenand_bbt.o: warning: objtool: onenand_isbad_bbt()+0xe7: can't find switch jump table drivers/scsi/qla1280.o: warning: objtool: qla1280_error_action()+0x3ab: can't find switch jump table net/netfilter/ipvs/ip_vs_ctl.c:2480:9: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/i915/i915_gem.o: warning: objtool: i915_gem_fault() falls through to next function i915_gem_object_ggtt_pin() drivers/gpu/drm/i915/intel_display.o: warning: objtool: _intel_adjust_tile_offset() falls through to next function rcu_lock_acquire() drivers/gpu/drm/i915/intel_display.o: warning: objtool: _intel_compute_tile_offset() falls through to next function skl_format_to_fourcc() drivers/gpu/drm/i915/intel_display.o: warning: objtool: skl_plane_stride() falls through to next function skl_plane_ctl() drivers/gpu/drm/i915/vlv_dsi_pll.o: warning: objtool: bxt_dsi_pll_enable() falls through to next function bxt_dsi_reset_clocks() fs/ext4/extents.c:3626:9: warning: 'zero_ex1.ee_start_hi' may be used uninitialized in this function [-Wmaybe-uninitialized] fs/ext4/extents.c:3626:9: warning: 'zero_ex1.ee_start_lo' may be used uninitialized in this function [-Wmaybe-uninitialized] fs/ext4/extents.c:3628:10: warning: 'zero_ex2.ee_start_hi' may be used uninitialized in this function [-Wmaybe-uninitialized] fs/ext4/extents.c:3628:10: warning: 'zero_ex2.ee_start_lo' may be used uninitialized in this function [-Wmaybe-uninitialized] net/netfilter/ipvs/ip_vs_core.c:2092:11: warning: 'iphdr.protocol' may be used uninitialized in this function [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250320 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250320 | |-- fs-ext4-extents.c:warning:zero_ex1.ee_start_hi-may-be-used-uninitialized-in-this-function | |-- fs-ext4-extents.c:warning:zero_ex1.ee_start_lo-may-be-used-uninitialized-in-this-function | |-- fs-ext4-extents.c:warning:zero_ex2.ee_start_hi-may-be-used-uninitialized-in-this-function | |-- fs-ext4-extents.c:warning:zero_ex2.ee_start_lo-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- net-netfilter-ipvs-ip_vs_core.c:warning:iphdr.protocol-may-be-used-uninitialized-in-this-function | `-- net-netfilter-ipvs-ip_vs_ctl.c:warning:ret-may-be-used-uninitialized-in-this-function |-- arm64-randconfig-003-20250320 | |-- drivers-dma-pl330.c:warning:dst-may-be-used-uninitialized-in-this-function | |-- drivers-dma-pl330.c:warning:src-may-be-used-uninitialized-in-this-function | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250320 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-lo | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-int-(-const)(struct-bpf_map-void-void-u64)-aka-int-(-const)(struct-bpf_map-void-void-long-long-unsigned-int)-to-u64-(-)(u64 | |-- include-linux-filter.h:warning:cast-between-incompatible-function-types-from-void-(-const)(struct-bpf_map-void-)-to-u64-(-)(u64-u64-u64-u64-u64)-aka-long-long-unsigned-int-(-)(long-long-unsigned-int-l | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-052-20250320 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-054-20250320 | `-- init-Kconfig:syntax-error |-- arm64-randconfig-r061-20250321 | `-- init-Kconfig:syntax-error |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250320 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250320 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250320 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250320 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-005-20250320 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250320 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20250321 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-102-20250321 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20250321 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250320 | |-- drivers-mtd-nand-onenand-onenand_bbt.o:warning:objtool:onenand_isbad_bbt:can-t-find-switch-jump-table | `-- drivers-scsi-qla1280.o:warning:objtool:qla1280_error_action:can-t-find-switch-jump-table |-- x86_64-randconfig-104-20250321 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-121-20250320 | |-- drivers-gpu-drm-i915-i915_gem.o:warning:objtool:i915_gem_fault-falls-through-to-next-function-i915_gem_object_ggtt_pin() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_adjust_tile_offset-falls-through-to-next-function-rcu_lock_acquire() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:_intel_compute_tile_offset-falls-through-to-next-function-skl_format_to_fourcc() | |-- drivers-gpu-drm-i915-intel_display.o:warning:objtool:skl_plane_stride-falls-through-to-next-function-skl_plane_ctl() | `-- drivers-gpu-drm-i915-vlv_dsi_pll.o:warning:objtool:bxt_dsi_pll_enable-falls-through-to-next-function-bxt_dsi_reset_clocks() `-- x86_64-randconfig-161-20250320 |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 1451m configs tested: 16 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250320 gcc-10.5.0 arm64 randconfig-002-20250320 gcc-10.5.0 arm64 randconfig-003-20250320 gcc-10.5.0 arm64 randconfig-004-20250320 gcc-8.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250320 clang-20 x86_64 buildonly-randconfig-002-20250320 gcc-12 x86_64 buildonly-randconfig-003-20250320 clang-20 x86_64 buildonly-randconfig-004-20250320 clang-20 x86_64 buildonly-randconfig-005-20250320 clang-20 x86_64 buildonly-randconfig-006-20250320 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] Mainline patch merged into OLK-6.6
by Junxian Huang 21 Mar '25

21 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Mainline patch merged into OLK-6.6: Junxian Huang (6): RDMA/hns: Fix soft lockup during bt pages loop RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() RDMA/hns: Fix invalid sq params not being blocked RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common() RDMA/hns: Fix wrong value of max_sge_rd RDMA/hns: Fix missing xa_destroy() drivers/infiniband/hw/hns/hns_roce_alloc.c | 4 +++- drivers/infiniband/hw/hns/hns_roce_cq.c | 1 + drivers/infiniband/hw/hns/hns_roce_hem.c | 16 +++++++++++++++- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 20 +++++++++++--------- 5 files changed, 31 insertions(+), 12 deletions(-) -- 2.33.0

2 7

[PATCH openEuler-1.0-LTS v2 0/2] Fix race when disable/enable UIE in rtc_set_time()
by Xiongfeng Wang 21 Mar '25

21 Mar '25

Yu Liao (2): rtc: Cleanup for UIE timer/polling emulation support rtc: Fix race when disable/enable UIE in rtc_set_time() drivers/rtc/interface.c | 58 +++++++++++++++++++++++------------------ include/linux/rtc.h | 1 + 2 files changed, 33 insertions(+), 26 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix race when disable/enable UIE in rtc_set_time()
by Xiongfeng Wang 21 Mar '25

21 Mar '25

Yu Liao (2): rtc: Cleanup for UIE timer/polling emulation support rtc: Fix race when disable/enable UIE in rtc_set_time() drivers/rtc/interface.c | 58 +++++++++++++++++++++++------------------ include/linux/rtc.h | 1 + 2 files changed, 33 insertions(+), 26 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-1.0-LTS] vfio/platform: check the bounds of read/write syscalls
by Tong Tiangen 21 Mar '25

21 Mar '25

From: Alex Williamson <alex.williamson(a)redhat.com> stable inclusion from stable-v5.10.234 commit d19a8650fd3d7aed8d1af1d9a77f979a8430eba1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLDIK CVE: CVE-2025-21687 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream. count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device. Fixes: 6e3f26456009 (“vfio/platform: read and write support for the device fd”) Cc: stable(a)vger.kernel.org Reported-by: Mostafa Saleh <smostafa(a)google.com> Reviewed-by: Eric Auger <eric.auger(a)redhat.com> Reviewed-by: Mostafa Saleh <smostafa(a)google.com> Tested-by: Mostafa Saleh <smostafa(a)google.com> Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/vfio/platform/vfio_platform_common.c [context conflict] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/vfio/platform/vfio_platform_common.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c index bf06825d977e..f719185f83c0 100644 --- a/drivers/vfio/platform/vfio_platform_common.c +++ b/drivers/vfio/platform/vfio_platform_common.c @@ -413,6 +413,11 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region *reg, { unsigned int done = 0; + if (off >= reg->size) + return -EINVAL; + + count = min_t(size_t, count, reg->size - off); + if (!reg->ioaddr) { reg->ioaddr = ioremap_nocache(reg->addr, reg->size); @@ -490,6 +495,11 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region *reg, { unsigned int done = 0; + if (off >= reg->size) + return -EINVAL; + + count = min_t(size_t, count, reg->size - off); + if (!reg->ioaddr) { reg->ioaddr = ioremap_nocache(reg->addr, reg->size); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
by Jinjiang Tu 21 Mar '25

21 Mar '25

mainline inclusion from mainline-v6.14-rc6 commit cb402bbdabcaa5a765068c5b8673bbfc1c264242 category: bugfix bugzilla: 190517 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- In dissolve_free_huge_page(), free huge pages are dissolved without adjusting surplus count. However, free huge pages may be accounted as surplus pages, and will lead to wrong surplus count. I reproduce this issue on qemu. The steps are: 1) Node1 is memory-less at first. Hot-add memory to node1 by executing the two commands in qemu monitor: object_add memory-backend-ram,id=mem1,size=1G device_add pc-dimm,id=dimm1,memdev=mem1,node=1 2) online one memory block of Node1 with： echo online_movable > /sys/devices/system/node/node1/memoryX/state 3) create 64 huge pages for node1 4) run a program to reserve (don't consume) all the huge pages 5) echo 0 > nr_huge_pages for node1. After this step, free huge pages in Node1 are surplus. 6) create 80 huge pages for node0 7) offline memory of node1, The memory range to offline contains the free surplus huge pages created in step3) ~ step5) echo offline > /sys/devices/system/node/node1/memoryX/state 8) kill the program in step 4) The result: Node0 Node1 total 80 0 free 80 0 surplus 0 61 To fix it, adjust surplus when destroying huge pages if the node has surplus pages in dissolve_free_hugetlb_folio(). The result with this patch: Node0 Node1 total 80 0 free 80 0 surplus 0 0 Link: https://lkml.kernel.org/r/20250304132106.2872754-1-tujinjiang@huawei.com Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Cc: Jinjiang Tu <tujinjiang(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts, and HVO isn't introduced, so don't need to handle HVO err case.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 69dd1e096a48..ac6f18afdf76 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -1823,6 +1823,7 @@ int dissolve_free_huge_page(struct page *page) if (!page_count(page)) { struct page *head = compound_head(page); struct hstate *h = page_hstate(head); + bool adjust_surplus = false; if (h->free_huge_pages - h->resv_huge_pages == 0) goto out; @@ -1853,7 +1854,9 @@ int dissolve_free_huge_page(struct page *page) SetPageHWPoison(page); ClearPageHWPoison(head); } - remove_hugetlb_page(h, head, false); + if (h->surplus_huge_pages_node[page_to_nid(head)]) + adjust_surplus = true; + remove_hugetlb_page(h, head, adjust_surplus); h->max_huge_pages--; spin_unlock_irq(&hugetlb_lock); update_and_free_page(h, head); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix race when disable/enable UIE in rtc_set_time()
by Xiongfeng Wang 21 Mar '25

21 Mar '25

Yu Liao (2): rtc: Cleanup for UIE timer/polling emulation support rtc: Fix race when disable/enable UIE in rtc_set_time() drivers/rtc/interface.c | 58 +++++++++++++++++++++++------------------ include/linux/rtc.h | 1 + 2 files changed, 33 insertions(+), 26 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-21853
by Pu Lehui 21 Mar '25

21 Mar '25

Andrii Nakryiko (2): bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic bpf: avoid holding freeze_mutex during mmap operation kernel/bpf/ringbuf.c | 4 ---- kernel/bpf/syscall.c | 25 +++++++++++++++++-------- 2 files changed, 17 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] io_uring/kbuf: reallocate buf lists on upgrade
by Long Li 21 Mar '25

21 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.78 commit 146a185f6c05ee263db715f860620606303c4633 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRNOR CVE: CVE-2025-21836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8802766324e1f5d414a81ac43365c20142e85603 upstream. IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy selected buffer and has been emptied. It violates the requirement that most of the field should stay stable after publish. Always reallocate it instead. Cc: stable(a)vger.kernel.org Reported-by: Pumpkin Chang <pumpkin(a)devco.re> Fixes: 2fcabce2d7d34 ("io_uring: disallow mixed provided buffer group registrations") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/kbuf.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 702c08c26cd4..b6fbae874f27 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -301,6 +301,12 @@ void io_destroy_buffers(struct io_ring_ctx *ctx) } } +static void io_destroy_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl) +{ + xa_erase(&ctx->io_bl_xa, bl->bgid); + io_put_bl(ctx, bl); +} + int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf); @@ -642,12 +648,13 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) /* if mapped buffer ring OR classic exists, don't allow */ if (bl->is_mapped || !list_empty(&bl->buf_list)) return -EEXIST; - } else { - free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); - if (!bl) - return -ENOMEM; + io_destroy_bl(ctx, bl); } + free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); + if (!bl) + return -ENOMEM; + if (!(reg.flags & IOU_PBUF_RING_MMAP)) ret = io_pin_pbuf_ring(&reg, bl); else -- 2.39.2

2 1

[PATCH OLK-5.10] io_uring: prevent opcode speculation
by Long Li 21 Mar '25

21 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 1e988c3fe1264708f4f92109203ac5b1d65de50b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU CVE: CVE-2025-21863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable(a)vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.17395684… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c [Context conflict] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 17a4e37a177f..883e2b74f82e 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -7196,6 +7196,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, if (!io_check_restriction(ctx, req, sqe_flags)) return -EACCES; + req->opcode = array_index_nospec(req->opcode, IORING_OP_LAST); + if ((sqe_flags & IOSQE_BUFFER_SELECT) && !io_op_defs[req->opcode].buffer_select) return -EOPNOTSUPP; -- 2.39.2

2 1

[openeuler:OLK-5.10 2816/2816] drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1
by kernel test robot 21 Mar '25

21 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 762816c3c07e052877c68911685e3700fe073298 commit: a0c5bfdbc099daf30cbadb9657803f0cb3f89d0b [2816/2816] drivers: support for rnpm drivers from Mucse Technology N10/N400 config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250321/202503210356.tFg9vkJQ-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250321/202503210356.tFg9vkJQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503210356.tFg9vkJQ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnpm/rnpm_common.c:12: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ 2 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:20: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:7: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:32: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2029:6: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2029 | u32 dma_ch; | ^ 5 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_main.c:32: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:6: warning: no previous prototype for function 'rnpm_pf_service_event_schedule' [-Wmissing-prototypes] 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:5: warning: no previous prototype for function 'rnpm_rx_ring_reinit' [-Wmissing-prototypes] 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1957:7: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1957 | bool xdp_xmit = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:6: warning: no previous prototype for function 'rnpm_write_eitr' [-Wmissing-prototypes] 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:6: warning: variable 'packets' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2387:7: note: uninitialized use occurs here 2387 | if (!packets) | ^~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:2: note: remove the 'if' if its condition is always true 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 2382 | 2383 | packets = ring_container->total_packets; drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2374:37: note: initialize the variable 'packets' to silence this warning 2374 | unsigned int avg_wire_size, packets, bytes; | ^ | = 0 drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring' [-Wmissing-prototypes] 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring_temp' [-Wmissing-prototypes] 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:6: warning: no previous prototype for function 'rnpm_vlan_stags_flag' [-Wmissing-prototypes] 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:6: warning: no previous prototype for function 'control_mac_rx' [-Wmissing-prototypes] 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:6: warning: no previous prototype for function 'rnpm_pf_service_timer' [-Wmissing-prototypes] 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:6: warning: no previous prototype for function 'rnpm_service_timer' [-Wmissing-prototypes] 5707 | void rnpm_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5707 | void rnpm_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:21: warning: no previous prototype for function 'wait_all_port_resetting' [-Wmissing-prototypes] 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:21: warning: no previous prototype for function 'clean_all_port_resetting' [-Wmissing-prototypes] 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:11: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:5: warning: no previous prototype for function 'rnpm_reset_pipeline_n10' [-Wmissing-prototypes] 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:503:6: warning: variable 'status' set but not used [-Wunused-but-set-variable] 503 | s32 status = 0; | ^ 4 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:10: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:24: warning: no previous prototype for function 'mbx_cookie_zalloc' [-Wmissing-prototypes] 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:5: warning: no previous prototype for function 'rnpm_mbx_write_posted_locked' [-Wmissing-prototypes] 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:6: warning: no previous prototype for function 'rnpm_link_stat_mark_disable' [-Wmissing-prototypes] 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:5: warning: no previous prototype for function 'rnpm_mbx_fw_post_req' [-Wmissing-prototypes] 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:5: warning: no previous prototype for function 'rnpm_fw_send_cmd_wait' [-Wmissing-prototypes] 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:5: warning: no previous prototype for function 'rnpm_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:5: warning: no previous prototype for function 'rnpm_mbx_pluginout_evt_en' [-Wmissing-prototypes] 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:5: warning: no previous prototype for function 'rnpm_fw_get_capablity' [-Wmissing-prototypes] 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1153:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1153 | int err; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1188:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1188 | int value; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:5: warning: no previous prototype for function 'rnpm_fw_reg_read' [-Wmissing-prototypes] 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1255:18: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 1255 | struct rnpm_hw *hw; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:5: warning: no previous prototype for function 'rnpm_get_port_stats2' [-Wmissing-prototypes] 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1528:9: warning: variable 'err' is uninitialized when used here [-Wuninitialized] 1528 | return err ? -err : 0; | ^~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1509:9: note: initialize the variable 'err' to silence this warning 1509 | int err; | ^ | = 0 16 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:17: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:5: warning: no previous prototype for function 'rnpm_mbx_get_pn_sn' [-Wmissing-prototypes] 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ | static 3 warnings generated. vim +/int +1137 drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h 1119 1120 static inline void 1121 build_link_set_loopback_req(struct mbx_fw_cmd_req *req, 1122 void *cookie, 1123 enum LOOPBACK_LEVEL level, 1124 enum LOOPBACK_FORCE_SPEED force_speed) 1125 { 1126 req->flags = 0; 1127 req->opcode = SET_LOOPBACK_MODE; 1128 req->datalen = sizeof(req->loopback); 1129 req->cookie = cookie; 1130 req->reply_lo = 0; 1131 req->reply_hi = 0; 1132 1133 req->loopback.loopback_level = level; 1134 req->loopback.loopback_type = LOOPBACK_TYPE_LOCAL; 1135 if (force_speed != LOOPBACK_FORCE_SPEED_NONE) { 1136 req->loopback.loopback_force_speed = force_speed; > 1137 req->loopback.loopback_force_speed_enable = 1; 1138 } 1139 } 1140 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] arm64: entry: Support hardware xint and xcall
by Jinjie Ruan 20 Mar '25

20 Mar '25

Support hardware xint and xcall. Jinjie Ruan (2): arm64: entry: Support hardware xint arm64: entry: Support hardware xcall arch/Kconfig | 14 ++--- arch/arm64/Kconfig | 12 ++++ arch/arm64/include/asm/sysreg.h | 7 +++ arch/arm64/kernel/cpufeature.c | 100 +++++++++++++++++++++++++++++++ arch/arm64/kernel/entry-common.c | 75 ++++++++++++++++++++--- arch/arm64/kernel/entry.S | 74 +++++++++++++++++++++-- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 36 ++++++++++- 8 files changed, 298 insertions(+), 24 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] io_uring: prevent opcode speculation
by Long Li 20 Mar '25

20 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 1e988c3fe1264708f4f92109203ac5b1d65de50b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU CVE: CVE-2025-21863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable(a)vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.17395684… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 833fd9b6a1f3..3aaac1023efb 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2173,6 +2173,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, req->opcode = 0; return io_init_fail_req(req, -EINVAL); } + opcode = array_index_nospec(opcode, IORING_OP_LAST); + def = &io_issue_defs[opcode]; if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { /* enforce forwards compatibility on users */ -- 2.39.2

2 1

[openeuler:OLK-5.10 2816/2816] kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_rude()+0xe0: unreachable instruction
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 762816c3c07e052877c68911685e3700fe073298 commit: 2509f2079e7247ed0d695bdb69c3d019a700a4b8 [2816/2816] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug config: x86_64-buildonly-randconfig-003-20250320 (https://download.01.org/0day-ci/archive/20250320/202503202016.ACG7odcD-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503202016.ACG7odcD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503202016.ACG7odcD-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_rude()+0xe0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2816/2816] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 762816c3c07e052877c68911685e3700fe073298 commit: e53494b741272933726616122ea77143d9742631 [2816/2816] drivers: initial support for rnp drivers from Mucse Technology config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250320/202503201925.S7VuFUSk-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503201925.S7VuFUSk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503201925.S7VuFUSk-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnp/rnp_main.c:34: In file included from drivers/net/ethernet/mucse/rnp/rnp_tc_u32_parse.h:6: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_main.c:34: In file included from drivers/net/ethernet/mucse/rnp/rnp_tc_u32_parse.h:6: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:174:6: warning: no previous prototype for function 'rnp_unmap_and_free_tx_resource' [-Wmissing-prototypes] 174 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:174:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 174 | void rnp_unmap_and_free_tx_resource(struct rnp_ring *ring, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:669:5: warning: no previous prototype for function 'rnp_rx_ring_reinit' [-Wmissing-prototypes] 669 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:669:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 669 | int rnp_rx_ring_reinit(struct rnp_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:1777:7: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1777 | bool xdp_xmit = false; | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:6: warning: no previous prototype for function 'rnp_write_eitr_rx' [-Wmissing-prototypes] 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:2012:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2012 | void rnp_write_eitr_rx(struct rnp_q_vector *q_vector) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:2818:6: warning: variable 'rxctrl' set but not used [-Wunused-but-set-variable] 2818 | u32 rxctrl = 0, dma_axi_ctl; | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3152:6: warning: no previous prototype for function 'rnp_vlan_stags_flag' [-Wmissing-prototypes] 3152 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3152:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3152 | void rnp_vlan_stags_flag(struct rnp_adapter *adapter) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:3558:5: warning: no previous prototype for function 'rnp_xmit_nop_frame_ring' [-Wmissing-prototypes] 3558 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:3558:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3558 | int rnp_xmit_nop_frame_ring(struct rnp_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:4811:6: warning: no previous prototype for function 'rnp_service_timer' [-Wmissing-prototypes] 4811 | void rnp_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:4811:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4811 | void rnp_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:4919:6: warning: no previous prototype for function 'rnp_service_task' [-Wmissing-prototypes] 4919 | void rnp_service_task(struct work_struct *work) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:4919:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4919 | void rnp_service_task(struct work_struct *work) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:5941:5: warning: no previous prototype for function 'rnp_delete_knode' [-Wmissing-prototypes] 5941 | int rnp_delete_knode(struct net_device *dev, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:5941:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5941 | int rnp_delete_knode(struct net_device *dev, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6030:5: warning: no previous prototype for function 'rnp_config_knode' [-Wmissing-prototypes] 6030 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6030:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6030 | int rnp_config_knode(struct net_device *dev, __be16 protocol, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6089:5: warning: no previous prototype for function 'rnp_setup_tc_cls_u32' [-Wmissing-prototypes] 6089 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6089:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6089 | int rnp_setup_tc_cls_u32(struct net_device *dev, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_main.c:6166:6: warning: no previous prototype for function 'rnp_do_reset' [-Wmissing-prototypes] 6166 | void rnp_do_reset(struct net_device *netdev) | ^ drivers/net/ethernet/mucse/rnp/rnp_main.c:6166:1: note: declare 'static' if the function is not intended to be used outside of this translation unit -- In file included from drivers/net/ethernet/mucse/rnp/rnp_common.c:10: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_common.c:10: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ 6 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnp/rnp_lib.c:4: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_lib.c:4: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_lib.c:439:5: warning: no previous prototype for function 'rnp_acquire_msix_vectors' [-Wmissing-prototypes] 439 | int rnp_acquire_msix_vectors(struct rnp_adapter *adapter, int vectors) | ^ drivers/net/ethernet/mucse/rnp/rnp_lib.c:439:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 439 | int rnp_acquire_msix_vectors(struct rnp_adapter *adapter, int vectors) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_lib.c:985:6: warning: no previous prototype for function 'rnp_print_ring_info' [-Wmissing-prototypes] 985 | void rnp_print_ring_info(struct rnp_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnp/rnp_lib.c:985:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 985 | void rnp_print_ring_info(struct rnp_adapter *adapter) | ^ | static 8 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnp/rnp_n10.c:8: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_n10.c:8: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:122:5: warning: no previous prototype for function 'rnp_eth_set_rar_n10' [-Wmissing-prototypes] 122 | s32 rnp_eth_set_rar_n10(struct rnp_eth_info *eth, u32 index, u8 *addr, | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:122:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 122 | s32 rnp_eth_set_rar_n10(struct rnp_eth_info *eth, u32 index, u8 *addr, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:179:5: warning: no previous prototype for function 'rnp_eth_clear_rar_n10' [-Wmissing-prototypes] 179 | s32 rnp_eth_clear_rar_n10(struct rnp_eth_info *eth, u32 index) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:179:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 179 | s32 rnp_eth_clear_rar_n10(struct rnp_eth_info *eth, u32 index) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:214:5: warning: no previous prototype for function 'rnp_eth_set_vmdq_n10' [-Wmissing-prototypes] 214 | s32 rnp_eth_set_vmdq_n10(struct rnp_eth_info *eth, u32 rar, u32 vmdq) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:214:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 214 | s32 rnp_eth_set_vmdq_n10(struct rnp_eth_info *eth, u32 rar, u32 vmdq) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:244:5: warning: no previous prototype for function 'rnp_eth_clear_vmdq_n10' [-Wmissing-prototypes] 244 | s32 rnp_eth_clear_vmdq_n10(struct rnp_eth_info *eth, u32 rar, u32 vmdq) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:244:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 244 | s32 rnp_eth_clear_vmdq_n10(struct rnp_eth_info *eth, u32 rar, u32 vmdq) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:328:5: warning: no previous prototype for function 'rnp_addr_list_itr' [-Wmissing-prototypes] 328 | u8 *rnp_addr_list_itr(struct rnp_hw __maybe_unused *hw, u8 **mc_addr_ptr) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:328:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 328 | u8 *rnp_addr_list_itr(struct rnp_hw __maybe_unused *hw, u8 **mc_addr_ptr) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:359:5: warning: no previous prototype for function 'rnp_eth_update_mc_addr_list_n10' [-Wmissing-prototypes] 359 | s32 rnp_eth_update_mc_addr_list_n10(struct rnp_eth_info *eth, | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:359:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 359 | s32 rnp_eth_update_mc_addr_list_n10(struct rnp_eth_info *eth, | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:442:6: warning: no previous prototype for function 'rnp_eth_clr_mc_addr_n10' [-Wmissing-prototypes] 442 | void rnp_eth_clr_mc_addr_n10(struct rnp_eth_info *eth) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:442:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 442 | void rnp_eth_clr_mc_addr_n10(struct rnp_eth_info *eth) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:457:6: warning: no previous prototype for function 'rnp_eth_update_rss_key_n10' [-Wmissing-prototypes] 457 | void rnp_eth_update_rss_key_n10(struct rnp_eth_info *eth, bool sriov_flag) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:457:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 457 | void rnp_eth_update_rss_key_n10(struct rnp_eth_info *eth, bool sriov_flag) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:486:6: warning: no previous prototype for function 'rnp_eth_update_rss_table_n10' [-Wmissing-prototypes] 486 | void rnp_eth_update_rss_table_n10(struct rnp_eth_info *eth) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:486:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 486 | void rnp_eth_update_rss_table_n10(struct rnp_eth_info *eth) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:511:5: warning: no previous prototype for function 'rnp_eth_set_vfta_n10' [-Wmissing-prototypes] 511 | s32 rnp_eth_set_vfta_n10(struct rnp_eth_info *eth, u32 vlan, bool vlan_on) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:511:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 511 | s32 rnp_eth_set_vfta_n10(struct rnp_eth_info *eth, u32 vlan, bool vlan_on) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:551:6: warning: no previous prototype for function 'rnp_eth_clr_vfta_n10' [-Wmissing-prototypes] 551 | void rnp_eth_clr_vfta_n10(struct rnp_eth_info *eth) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:551:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 551 | void rnp_eth_clr_vfta_n10(struct rnp_eth_info *eth) | ^ | static drivers/net/ethernet/mucse/rnp/rnp_n10.c:577:5: warning: no previous prototype for function 'rnp_layer2_pritologic_n10' [-Wmissing-prototypes] 577 | u16 rnp_layer2_pritologic_n10(u16 hw_id) | ^ drivers/net/ethernet/mucse/rnp/rnp_n10.c:577:1: note: declare 'static' if the function is not intended to be used outside of this translation unit -- In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:20: In file included from drivers/net/ethernet/mucse/rnp/rnp_type.h:960: >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:898:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 898 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h:1068:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1068 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ In file included from drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:9: In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21: drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1100:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1100 | int err; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1140:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1140 | int value; | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1136:5: warning: no previous prototype for function 'rnp_fw_reg_read' [-Wmissing-prototypes] 1136 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:1136:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1136 | int rnp_fw_reg_read(struct rnp_hw *hw, int addr, int sz) | ^ | static 9 warnings generated. .. vim +/int +898 drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.h 879 880 static inline void build_set_phy_reg(struct mbx_fw_cmd_req *req, 881 void *cookie, 882 enum PHY_INTERFACE phy_inf, 883 char nr_lane, int reg, int w_data, 884 int recall_qsfp_page) 885 { 886 req->flags = 0; 887 req->opcode = SET_PHY_REG; 888 req->datalen = sizeof(req->set_phy_reg); 889 req->cookie = cookie; 890 req->reply_lo = 0; 891 req->reply_hi = 0; 892 req->set_phy_reg.phy_interface = phy_inf; 893 req->set_phy_reg.nr_lane = nr_lane; 894 req->set_phy_reg.phy_reg_addr = reg; 895 req->set_phy_reg.phy_w_data = w_data; 896 897 if (recall_qsfp_page) > 898 req->set_phy_reg.recall_qsfp_page = 1; 899 else 900 req->set_phy_reg.recall_qsfp_page = 0; 901 } 902 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1509/1509] net/netfilter/ipvs/ip_vs_ctl.c:2480:9: warning: 'ret' may be used uninitialized in this function
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d54ba3f54612a8622df13d42bc1870048cb63d20 commit: 56ee6566622b8a8f58ec8d99e403d4ba9f29e693 [1509/1509] ipvs: Fix uninit-value in do_ip_vs_set_ctl() config: arm64-randconfig-002-20250320 (https://download.01.org/0day-ci/archive/20250320/202503201839.XDDCG7DI-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503201839.XDDCG7DI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503201839.XDDCG7DI-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): net/netfilter/ipvs/ip_vs_ctl.c: In function 'do_ip_vs_set_ctl': >> net/netfilter/ipvs/ip_vs_ctl.c:2480:9: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized] 2480 | return ret; | ^~~ vim +/ret +2480 net/netfilter/ipvs/ip_vs_ctl.c c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2337 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2338 static int ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2339 do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2340 { fc723250c9cb04 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-01-03 2341 struct net *net = sock_net(sk); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2342 int ret; 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2343 unsigned char arg[MAX_SET_ARGLEN]; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2344 struct ip_vs_service_user *usvc_compat; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2345 struct ip_vs_service_user_kern usvc; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2346 struct ip_vs_service *svc; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2347 struct ip_vs_dest_user *udest_compat; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2348 struct ip_vs_dest_user_kern udest; ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2349 struct netns_ipvs *ipvs = net_ipvs(net); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2350 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2351 BUILD_BUG_ON(sizeof(arg) > 255); df008c91f83583 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2012-11-16 2352 if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2353 return -EPERM; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2354 04bcef2a83f40c net/netfilter/ipvs/ip_vs_ctl.c Arjan van de Ven 2010-01-04 2355 if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX) 04bcef2a83f40c net/netfilter/ipvs/ip_vs_ctl.c Arjan van de Ven 2010-01-04 2356 return -EINVAL; 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2357 if (len != set_arglen[CMDID(cmd)]) { 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2358 IP_VS_DBG(1, "set_ctl: len %u != %u\n", 5fcf0cf6073d4a net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2014-09-03 2359 len, set_arglen[CMDID(cmd)]); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2360 return -EINVAL; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2361 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2362 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2363 if (copy_from_user(arg, user, len) != 0) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2364 return -EFAULT; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2365 ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2366 /* Handle daemons since they have another lock */ ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2367 if (cmd == IP_VS_SO_SET_STARTDAEMON || ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2368 cmd == IP_VS_SO_SET_STOPDAEMON) { ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2369 struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg; ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2370 e0b26cc997d573 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2371 if (cmd == IP_VS_SO_SET_STARTDAEMON) { e4ff67513096e6 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2372 struct ipvs_sync_daemon_cfg cfg; e4ff67513096e6 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2373 e4ff67513096e6 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2374 memset(&cfg, 0, sizeof(cfg)); 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2375 ret = -EINVAL; 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2376 if (strscpy(cfg.mcast_ifn, dm->mcast_ifn, 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2377 sizeof(cfg.mcast_ifn)) <= 0) e2eda307807970 net/netfilter/ipvs/ip_vs_ctl.c Davide Caratti 2019-11-13 2378 return ret; e4ff67513096e6 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2379 cfg.syncid = dm->syncid; 6ac121d710697c net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2380 ret = start_sync_thread(ipvs, &cfg, dm->state); e0b26cc997d573 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2381 } else { b3cf3cbfb57c27 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2382 ret = stop_sync_thread(ipvs, dm->state); e0b26cc997d573 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2015-07-26 2383 } e2eda307807970 net/netfilter/ipvs/ip_vs_ctl.c Davide Caratti 2019-11-13 2384 return ret; ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2385 } ae1d48b23d5e79 net/netfilter/ipvs/ip_vs_ctl.c Hans Schillstrom 2011-10-11 2386 7926dbfa4bc14e net/netfilter/ipvs/ip_vs_ctl.c Pablo Neira Ayuso 2014-07-31 2387 mutex_lock(&__ip_vs_mutex); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2388 if (cmd == IP_VS_SO_SET_FLUSH) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2389 /* Flush the virtual service */ ef7c599d91172d net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2390 ret = ip_vs_flush(ipvs, false); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2391 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2392 } else if (cmd == IP_VS_SO_SET_TIMEOUT) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2393 /* Set timeout values for (tcp tcpfin udp) */ f1faa1e7495445 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2394 ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2395 goto out_unlock; 56ee6566622b8a net/netfilter/ipvs/ip_vs_ctl.c Peilin Ye 2020-11-04 2396 } else if (!len) { 56ee6566622b8a net/netfilter/ipvs/ip_vs_ctl.c Peilin Ye 2020-11-04 2397 /* No more commands with len == 0 below */ 56ee6566622b8a net/netfilter/ipvs/ip_vs_ctl.c Peilin Ye 2020-11-04 2398 ret = -EINVAL; 56ee6566622b8a net/netfilter/ipvs/ip_vs_ctl.c Peilin Ye 2020-11-04 2399 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2400 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2401 c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2402 usvc_compat = (struct ip_vs_service_user *)arg; c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2403 udest_compat = (struct ip_vs_dest_user *)(usvc_compat + 1); c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2404 c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2405 /* We only use the new structs internally, so copy userspace compat c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2406 * structs to extended internal versions */ c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2407 ip_vs_copy_usvc_compat(&usvc, usvc_compat); c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2408 ip_vs_copy_udest_compat(&udest, udest_compat); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2409 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2410 if (cmd == IP_VS_SO_SET_ZERO) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2411 /* if no service address is set, zero counters in all */ c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2412 if (!usvc.fwmark && !usvc.addr.ip && !usvc.port) { c60856c687d601 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2413 ret = ip_vs_zero_all(ipvs); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2414 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2415 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2416 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2417 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2418 if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) && 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2419 strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) == 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2420 IP_VS_SCHEDNAME_MAXLEN) { 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2421 ret = -EINVAL; 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2422 goto out_unlock; 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2423 } 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2424 2906f66a5682e5 net/netfilter/ipvs/ip_vs_ctl.c Venkata Mohan Reddy 2010-02-18 2425 /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */ 2906f66a5682e5 net/netfilter/ipvs/ip_vs_ctl.c Venkata Mohan Reddy 2010-02-18 2426 if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP && 2906f66a5682e5 net/netfilter/ipvs/ip_vs_ctl.c Venkata Mohan Reddy 2010-02-18 2427 usvc.protocol != IPPROTO_SCTP) { 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2428 pr_err("set_ctl: invalid protocol: %d %pI4:%d\n", 14d5e834f6b366 net/netfilter/ipvs/ip_vs_ctl.c Harvey Harrison 2008-10-31 2429 usvc.protocol, &usvc.addr.ip, 52f96757905bbf net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2018-05-19 2430 ntohs(usvc.port)); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2431 ret = -EFAULT; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2432 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2433 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2434 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2435 /* Lookup the exact service by <protocol, addr, port> or fwmark */ ceec4c38168184 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2013-03-22 2436 rcu_read_lock(); c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2437 if (usvc.fwmark == 0) bb2e2a8c957fd1 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2438 svc = __ip_vs_service_find(ipvs, usvc.af, usvc.protocol, b18610de9ec272 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2439 &usvc.addr, usvc.port); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2440 else 1ed8b947806155 net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2441 svc = __ip_vs_svc_fwm_find(ipvs, usvc.af, usvc.fwmark); ceec4c38168184 net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2013-03-22 2442 rcu_read_unlock(); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2443 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2444 if (cmd != IP_VS_SO_SET_ADD c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2445 && (svc == NULL || svc->protocol != usvc.protocol)) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2446 ret = -ESRCH; 26c15cfd291f8b net/netfilter/ipvs/ip_vs_ctl.c Julian Anastasov 2010-09-21 2447 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2448 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2449 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2450 switch (cmd) { ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2451 case IP_VS_SO_SET_ADD: ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2452 if (svc != NULL) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2453 ret = -EEXIST; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2454 else 5060bd8307fcfb net/netfilter/ipvs/ip_vs_ctl.c Eric W. Biederman 2015-09-21 2455 ret = ip_vs_add_service(ipvs, &usvc, &svc); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2456 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2457 case IP_VS_SO_SET_EDIT: c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2458 ret = ip_vs_edit_service(svc, &usvc); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2459 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2460 case IP_VS_SO_SET_DEL: ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2461 ret = ip_vs_del_service(svc); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2462 if (!ret) ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2463 goto out_unlock; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2464 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2465 case IP_VS_SO_SET_ZERO: ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2466 ret = ip_vs_zero_service(svc); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2467 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2468 case IP_VS_SO_SET_ADDDEST: c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2469 ret = ip_vs_add_dest(svc, &udest); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2470 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2471 case IP_VS_SO_SET_EDITDEST: c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2472 ret = ip_vs_edit_dest(svc, &udest); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2473 break; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2474 case IP_VS_SO_SET_DELDEST: c860c6b1479992 net/ipv4/ipvs/ip_vs_ctl.c Julius Volz 2008-09-02 2475 ret = ip_vs_del_dest(svc, &udest); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2476 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2477 ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2478 out_unlock: 14cc3e2b633bb6 net/ipv4/ipvs/ip_vs_ctl.c Ingo Molnar 2006-03-26 2479 mutex_unlock(&__ip_vs_mutex); ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 @2480 return ret; ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2481 } ^1da177e4c3f41 net/ipv4/ipvs/ip_vs_ctl.c Linus Torvalds 2005-04-16 2482 :::::: The code at line 2480 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <torvalds(a)ppc970.osdl.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1509/1509] drivers/dma/pl330.c:2599:15: warning: 'src' may be used uninitialized in this function
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d54ba3f54612a8622df13d42bc1870048cb63d20 commit: 0299853c014aa0eecf7fb85ac2f1ebd0a9a6ba73 [1509/1509] dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV config: arm64-randconfig-003-20250320 (https://download.01.org/0day-ci/archive/20250320/202503201721.gZeymcpc-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503201721.gZeymcpc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503201721.gZeymcpc-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): drivers/dma/pl330.c: In function 'pl330_prep_dma_cyclic': >> drivers/dma/pl330.c:2599:15: warning: 'src' may be used uninitialized in this function [-Wmaybe-uninitialized] 2599 | px->src_addr = src; | ~~~~~~~~~~~~~^~~~~ drivers/dma/pl330.c:2657:13: note: 'src' was declared here 2657 | dma_addr_t src; | ^~~ >> drivers/dma/pl330.c:2598:15: warning: 'dst' may be used uninitialized in this function [-Wmaybe-uninitialized] 2598 | px->dst_addr = dst; | ~~~~~~~~~~~~~^~~~~ drivers/dma/pl330.c:2656:13: note: 'dst' was declared here 2656 | dma_addr_t dst; | ^~~ drivers/dma/pl330.c:297: warning: cannot understand function prototype: 'struct pl330_reqcfg ' vim +/src +2599 drivers/dma/pl330.c b3040e40675ec2c Jassi Brar 2010-05-23 2593 b3040e40675ec2c Jassi Brar 2010-05-23 2594 static inline void fill_px(struct pl330_xfer *px, b3040e40675ec2c Jassi Brar 2010-05-23 2595 dma_addr_t dst, dma_addr_t src, size_t len) b3040e40675ec2c Jassi Brar 2010-05-23 2596 { b3040e40675ec2c Jassi Brar 2010-05-23 2597 px->bytes = len; b3040e40675ec2c Jassi Brar 2010-05-23 @2598 px->dst_addr = dst; b3040e40675ec2c Jassi Brar 2010-05-23 @2599 px->src_addr = src; b3040e40675ec2c Jassi Brar 2010-05-23 2600 } b3040e40675ec2c Jassi Brar 2010-05-23 2601 :::::: The code at line 2599 was first introduced by commit :::::: b3040e40675ec2c43542331cd30d4ee3dae797e8 DMA: PL330: Add dma api driver :::::: TO: Jassi Brar <jassi.brar(a)samsung.com> :::::: CC: Dan Williams <dan.j.williams(a)intel.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2045/2045] arch/arm64/kvm/virtcca_cvm.c:810:5: warning: no previous prototype for function 'virtcca_get_tmi_version'
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 961f596cd0017f5f254fb4b0ab9f5b9975177b84 commit: 86b9cab8c4752eb46e3ec038325aee5686805c69 [2045/2045] VirtCCA: an interface to retrieve the TMI version is added config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250320/202503201027.i8HE43EJ-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503201027.i8HE43EJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503201027.i8HE43EJ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kvm/virtcca_cvm.c:5: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kvm/virtcca_cvm.c:810:5: warning: no previous prototype for function 'virtcca_get_tmi_version' [-Wmissing-prototypes] 810 | u64 virtcca_get_tmi_version(void) | ^ arch/arm64/kvm/virtcca_cvm.c:810:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 810 | u64 virtcca_get_tmi_version(void) | ^ | static arch/arm64/kvm/virtcca_cvm.c:1274:5: warning: no previous prototype for function 'cvm_arm_smmu_domain_set_kvm' [-Wmissing-prototypes] 1274 | int cvm_arm_smmu_domain_set_kvm(struct device *dev, void *data) | ^ arch/arm64/kvm/virtcca_cvm.c:1274:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1274 | int cvm_arm_smmu_domain_set_kvm(struct device *dev, void *data) | ^ | static 7 warnings generated. vim +/virtcca_get_tmi_version +810 arch/arm64/kvm/virtcca_cvm.c 809 > 810 u64 virtcca_get_tmi_version(void) 811 { 812 u64 res = tmi_version(); 813 814 if (res == SMCCC_RET_NOT_SUPPORTED) 815 return 0; 816 return res; 817 } 818 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2045/2045] drivers/coda/coda_pci.c:228: warning: Function parameter or member 'p' not described in 'virtcca_pci_get_rom_size'
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 961f596cd0017f5f254fb4b0ab9f5b9975177b84 commit: 67773feaf933058b9e64a9089345b3c64f823acd [2045/2045] VirtCCA: cvm support UEFI boot config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250320/202503200858.XSvAPfQM-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503200858.XSvAPfQM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503200858.XSvAPfQM-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/coda/coda_pci.c:36: warning: expecting prototype for virtcca_pci_write_msi_msg(). Prototype was for virtcca_pci_write_msg_msi() instead >> drivers/coda/coda_pci.c:228: warning: Function parameter or member 'p' not described in 'virtcca_pci_get_rom_size' >> drivers/coda/coda_pci.c:228: warning: Excess function parameter 'pdev' description in 'virtcca_pci_get_rom_size' vim +228 drivers/coda/coda_pci.c 28 29 /** 30 * virtcca_pci_write_msi_msg - secure dev write msi msg 31 * @desc: MSI-X description 32 * @msg: Msg information 33 * 34 **/ 35 bool virtcca_pci_write_msg_msi(struct msi_desc *desc, struct msi_msg *msg) > 36 { 37 if (!is_virtcca_cvm_enable()) 38 return false; 39 40 void __iomem *base = pci_msix_desc_addr(desc); 41 u32 ctrl = desc->pci.msix_ctrl; 42 bool unmasked = !(ctrl & PCI_MSIX_ENTRY_CTRL_MASKBIT); 43 u64 pbase = mmio_va_to_pa(base); 44 struct pci_dev *pdev = (desc->dev != NULL && 45 dev_is_pci(desc->dev)) ? to_pci_dev(desc->dev) : NULL; 46 47 if (!is_cc_dev(pci_dev_id(pdev))) 48 return false; 49 50 u64 addr = (u64)msg->address_lo | ((u64)msg->address_hi << 32); 51 52 if (addr) { 53 /* Get the offset of the its register of a specific device */ 54 u64 offset = addr - CVM_MSI_ORIG_IOVA; 55 56 addr = get_g_cc_dev_msi_addr(pci_dev_id(pdev)); 57 addr += offset; 58 if (!addr) 59 return true; 60 } 61 tmi_mmio_write(pbase + PCI_MSIX_ENTRY_LOWER_ADDR, 62 lower_32_bits(addr), CVM_RW_32_BIT, pci_dev_id(pdev)); 63 tmi_mmio_write(pbase + PCI_MSIX_ENTRY_UPPER_ADDR, 64 upper_32_bits(addr), CVM_RW_32_BIT, pci_dev_id(pdev)); 65 tmi_mmio_write(pbase + PCI_MSIX_ENTRY_DATA, 66 msg->data, CVM_RW_32_BIT, pci_dev_id(pdev)); 67 68 if (unmasked) 69 pci_msix_write_vector_ctrl(desc, ctrl); 70 tmi_mmio_read(pbase + PCI_MSIX_ENTRY_DATA, 71 CVM_RW_32_BIT, pci_dev_id(pdev)); 72 73 return true; 74 } 75 76 void virtcca_msix_prepare_msi_desc(struct pci_dev *dev, 77 struct msi_desc *desc, void __iomem *addr) 78 { 79 desc->pci.msix_ctrl = tmi_mmio_read(mmio_va_to_pa(addr + PCI_MSIX_ENTRY_VECTOR_CTRL), 80 CVM_RW_32_BIT, pci_dev_id(dev)); 81 } 82 83 /* 84 * If it is a safety device, write vector ctrl need 85 * use tmi interface 86 */ 87 bool virtcca_pci_msix_write_vector_ctrl(struct msi_desc *desc, u32 ctrl) 88 { 89 if (!is_virtcca_cvm_enable()) 90 return false; 91 92 void __iomem *desc_addr = pci_msix_desc_addr(desc); 93 struct pci_dev *pdev = (desc->dev != NULL && 94 dev_is_pci(desc->dev)) ? to_pci_dev(desc->dev) : NULL; 95 96 if (pdev == NULL || !is_cc_dev(pci_dev_id(pdev))) 97 return false; 98 99 if (desc->pci.msi_attrib.can_mask) 100 tmi_mmio_write(mmio_va_to_pa(desc_addr + PCI_MSIX_ENTRY_VECTOR_CTRL), 101 ctrl, CVM_RW_32_BIT, pci_dev_id(pdev)); 102 return true; 103 } 104 105 /* 106 * If it is a safety device, read msix need 107 * use tmi interface 108 */ 109 bool virtcca_pci_msix_mask(struct msi_desc *desc) 110 { 111 if (!is_virtcca_cvm_enable()) 112 return false; 113 114 struct pci_dev *pdev = (desc->dev != NULL && 115 dev_is_pci(desc->dev)) ? to_pci_dev(desc->dev) : NULL; 116 117 if (pdev == NULL || !is_cc_dev(pci_dev_id(pdev))) 118 return false; 119 120 /* Flush write to device */ 121 tmi_mmio_read(mmio_va_to_pa(desc->pci.mask_base), CVM_RW_32_BIT, pci_dev_id(pdev)); 122 return true; 123 } 124 125 /** 126 * virtcca_msix_mask_all_cc - mask all secure dev msix c 127 * @dev: Pointer to the pci_dev data structure of MSI-X device function 128 * @base: Io address 129 * @tsize: Number of entry 130 * @dev_num: Dev number 131 * 132 * Returns: 133 * %0 if msix mask all cc device success 134 **/ 135 int virtcca_msix_mask_all_cc(struct pci_dev *dev, void __iomem *base, int tsize, u64 dev_num) 136 { 137 int i; 138 u16 rw_ctrl; 139 u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT; 140 u64 pbase = mmio_va_to_pa(base); 141 142 if (pci_msi_ignore_mask) 143 goto out; 144 145 for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE) { 146 tmi_mmio_write(pbase + PCI_MSIX_ENTRY_VECTOR_CTRL, 147 ctrl, CVM_RW_32_BIT, dev_num); 148 } 149 150 out: 151 pci_read_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, &rw_ctrl); 152 rw_ctrl &= ~PCI_MSIX_FLAGS_MASKALL; 153 rw_ctrl |= 0; 154 pci_write_config_word(dev, dev->msix_cap + PCI_MSIX_FLAGS, rw_ctrl); 155 156 pcibios_free_irq(dev); 157 return 0; 158 } 159 160 /* If device is secure dev, read config need transfer to tmm module */ 161 int virtcca_pci_generic_config_read(void __iomem *addr, unsigned char bus_num, 162 unsigned int devfn, int size, u32 *val) 163 { 164 u32 cvm_bit = size == 1 ? CVM_RW_8_BIT : size == 2 ? CVM_RW_16_BIT : CVM_RW_32_BIT; 165 166 *val = tmi_mmio_read(mmio_va_to_pa(addr), cvm_bit, PCI_DEVID(bus_num, devfn)); 167 return 0; 168 } 169 170 /* If device is secure dev, write config need transfer to tmm module */ 171 int virtcca_pci_generic_config_write(void __iomem *addr, unsigned char bus_num, 172 unsigned int devfn, int size, u32 val) 173 { 174 u32 cvm_bit = size == 1 ? CVM_RW_8_BIT : size == 2 ? CVM_RW_16_BIT : CVM_RW_32_BIT; 175 176 tmi_mmio_write(mmio_va_to_pa(addr), val, cvm_bit, PCI_DEVID(bus_num, devfn)); 177 return 0; 178 } 179 180 /* Judge startup virtcca_cvm_host is enable and device is secure or not */ 181 bool is_virtcca_pci_io_rw(struct vfio_pci_core_device *vdev) 182 { 183 if (!is_virtcca_cvm_enable()) 184 return false; 185 186 struct pci_dev *pdev = vdev->pdev; 187 bool cc_dev = pdev == NULL ? false : is_cc_dev(pci_dev_id(pdev)); 188 189 if (cc_dev) 190 return true; 191 192 return false; 193 } 194 EXPORT_SYMBOL_GPL(is_virtcca_pci_io_rw); 195 196 /* Transfer to tmm write io value */ 197 void virtcca_pci_io_write(struct vfio_pci_core_device *vdev, u64 val, 198 u64 size, void __iomem *io) 199 { 200 struct pci_dev *pdev = vdev->pdev; 201 202 WARN_ON(tmi_mmio_write(mmio_va_to_pa(io), val, size, pci_dev_id(pdev))); 203 } 204 EXPORT_SYMBOL_GPL(virtcca_pci_io_write); 205 206 /* Transfer to tmm read io value */ 207 u64 virtcca_pci_io_read(struct vfio_pci_core_device *vdev, 208 u64 size, void __iomem *io) 209 { 210 struct pci_dev *pdev = vdev->pdev; 211 212 return tmi_mmio_read(mmio_va_to_pa(io), size, pci_dev_id(pdev)); 213 } 214 EXPORT_SYMBOL_GPL(virtcca_pci_io_read); 215 216 /** 217 * virtcca_pci_get_rom_size - obtain the actual size of the ROM image 218 * @pdev: target PCI device 219 * @rom: kernel virtual pointer to image of ROM 220 * @size: size of PCI window 221 * return: size of actual ROM image 222 * 223 * Determine the actual length of the ROM image. 224 * The PCI window size could be much larger than the 225 * actual image size. 226 */ 227 size_t virtcca_pci_get_rom_size(void *p, void __iomem *rom, size_t size) > 228 { -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 19 Mar '25

19 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index a6eae7c31bf3..fa1936ed3915 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1408,10 +1408,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1455,10 +1457,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

2 1

[openEuler-1.0-LTS] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 19 Mar '25

19 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index a6eae7c31bf3..fa1936ed3915 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1408,10 +1408,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1455,10 +1457,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

1 0

[openeuler:openEuler-1.0-LTS 1504/1504] drivers/tee/optee/core.c:618:10: warning: return makes integer from pointer without a cast
by kernel test robot 19 Mar '25

19 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5624ca70f4eb787c54115bc1e1eb09ea582fd9a4 commit: 595311cf7e49c781dd26782e4b45fd54bbfb3e40 [1504/1504] optee: model OP-TEE as a platform device/driver config: arm64-randconfig-002-20250319 (https://download.01.org/0day-ci/archive/20250319/202503191516.fZeE5He3-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250319/202503191516.fZeE5He3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503191516.fZeE5He3-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/tee/optee/core.c: In function 'optee_probe': >> drivers/tee/optee/core.c:618:10: warning: return makes integer from pointer without a cast [-Wint-conversion] return ERR_PTR(-EINVAL); ^~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for UACCE Depends on [n]: IOMMU_API [=n] Selected by [m]: - CRYPTO_DEV_HISI_QM [=m] && CRYPTO [=y] && CRYPTO_HW [=y] && ARM64 [=y] && PCI [=y] vim +618 drivers/tee/optee/core.c 595311cf7e49c7 Ard Biesheuvel 2019-12-09 581 595311cf7e49c7 Ard Biesheuvel 2019-12-09 582 static int optee_probe(struct platform_device *pdev) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 583 { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 584 optee_invoke_fn *invoke_fn; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 585 struct tee_shm_pool *pool; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 586 struct optee *optee = NULL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 587 void *memremaped_shm = NULL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 588 struct tee_device *teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 589 u32 sec_caps; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 590 int rc; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 591 595311cf7e49c7 Ard Biesheuvel 2019-12-09 592 invoke_fn = get_invoke_func(&pdev->dev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 593 if (IS_ERR(invoke_fn)) 595311cf7e49c7 Ard Biesheuvel 2019-12-09 594 return PTR_ERR(invoke_fn); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 595 4fb0a5eb364d23 Jens Wiklander 2015-04-14 596 if (!optee_msg_api_uid_is_optee_api(invoke_fn)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 597 pr_warn("api uid mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 598 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 599 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 600 5c5f80307ab27c Jérôme Forissier 2017-11-24 601 optee_msg_get_os_revision(invoke_fn); 5c5f80307ab27c Jérôme Forissier 2017-11-24 602 4fb0a5eb364d23 Jens Wiklander 2015-04-14 603 if (!optee_msg_api_revision_is_compatible(invoke_fn)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 604 pr_warn("api revision mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 605 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 606 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 607 4fb0a5eb364d23 Jens Wiklander 2015-04-14 608 if (!optee_msg_exchange_capabilities(invoke_fn, &sec_caps)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 609 pr_warn("capabilities mismatch\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 610 return -EINVAL; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 611 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 612 4fb0a5eb364d23 Jens Wiklander 2015-04-14 613 /* 4fb0a5eb364d23 Jens Wiklander 2015-04-14 614 * We have no other option for shared memory, if secure world 4fb0a5eb364d23 Jens Wiklander 2015-04-14 615 * doesn't have any reserved memory we can use we can't continue. 4fb0a5eb364d23 Jens Wiklander 2015-04-14 616 */ 4fb0a5eb364d23 Jens Wiklander 2015-04-14 617 if (!(sec_caps & OPTEE_SMC_SEC_CAP_HAVE_RESERVED_SHM)) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 @618 return ERR_PTR(-EINVAL); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 619 f58e236c9d665a Volodymyr Babchuk 2017-11-29 620 pool = optee_config_shm_memremap(invoke_fn, &memremaped_shm, sec_caps); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 621 if (IS_ERR(pool)) 595311cf7e49c7 Ard Biesheuvel 2019-12-09 622 return PTR_ERR(pool); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 623 4fb0a5eb364d23 Jens Wiklander 2015-04-14 624 optee = kzalloc(sizeof(*optee), GFP_KERNEL); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 625 if (!optee) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 626 rc = -ENOMEM; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 627 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 628 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 629 4fb0a5eb364d23 Jens Wiklander 2015-04-14 630 optee->invoke_fn = invoke_fn; d885cc5e0759fc Volodymyr Babchuk 2017-11-29 631 optee->sec_caps = sec_caps; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 632 4fb0a5eb364d23 Jens Wiklander 2015-04-14 633 teedev = tee_device_alloc(&optee_desc, NULL, pool, optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 634 if (IS_ERR(teedev)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 635 rc = PTR_ERR(teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 636 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 637 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 638 optee->teedev = teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 639 4fb0a5eb364d23 Jens Wiklander 2015-04-14 640 teedev = tee_device_alloc(&optee_supp_desc, NULL, pool, optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 641 if (IS_ERR(teedev)) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 642 rc = PTR_ERR(teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 643 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 644 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 645 optee->supp_teedev = teedev; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 646 4fb0a5eb364d23 Jens Wiklander 2015-04-14 647 rc = tee_device_register(optee->teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 648 if (rc) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 649 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 650 4fb0a5eb364d23 Jens Wiklander 2015-04-14 651 rc = tee_device_register(optee->supp_teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 652 if (rc) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 653 goto err; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 654 4fb0a5eb364d23 Jens Wiklander 2015-04-14 655 mutex_init(&optee->call_queue.mutex); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 656 INIT_LIST_HEAD(&optee->call_queue.waiters); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 657 optee_wait_queue_init(&optee->wait_queue); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 658 optee_supp_init(&optee->supp); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 659 optee->memremaped_shm = memremaped_shm; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 660 optee->pool = pool; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 661 4fb0a5eb364d23 Jens Wiklander 2015-04-14 662 optee_enable_shm_cache(optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 663 595311cf7e49c7 Ard Biesheuvel 2019-12-09 664 platform_set_drvdata(pdev, optee); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 665 4fb0a5eb364d23 Jens Wiklander 2015-04-14 666 pr_info("initialized driver\n"); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 667 return 0; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 668 err: 4fb0a5eb364d23 Jens Wiklander 2015-04-14 669 if (optee) { 4fb0a5eb364d23 Jens Wiklander 2015-04-14 670 /* 4fb0a5eb364d23 Jens Wiklander 2015-04-14 671 * tee_device_unregister() is safe to call even if the 4fb0a5eb364d23 Jens Wiklander 2015-04-14 672 * devices hasn't been registered with 4fb0a5eb364d23 Jens Wiklander 2015-04-14 673 * tee_device_register() yet. 4fb0a5eb364d23 Jens Wiklander 2015-04-14 674 */ 4fb0a5eb364d23 Jens Wiklander 2015-04-14 675 tee_device_unregister(optee->supp_teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 676 tee_device_unregister(optee->teedev); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 677 kfree(optee); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 678 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 679 if (pool) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 680 tee_shm_pool_free(pool); 4fb0a5eb364d23 Jens Wiklander 2015-04-14 681 if (memremaped_shm) 4fb0a5eb364d23 Jens Wiklander 2015-04-14 682 memunmap(memremaped_shm); 595311cf7e49c7 Ard Biesheuvel 2019-12-09 683 return rc; 4fb0a5eb364d23 Jens Wiklander 2015-04-14 684 } 4fb0a5eb364d23 Jens Wiklander 2015-04-14 685 :::::: The code at line 618 was first introduced by commit :::::: 4fb0a5eb364d239722e745c02aef0dbd4e0f1ad2 tee: add OP-TEE driver :::::: TO: Jens Wiklander <jens.wiklander(a)linaro.org> :::::: CC: Jens Wiklander <jens.wiklander(a)linaro.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 1/2] bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic
by Pu Lehui 19 Mar '25

19 Mar '25

From: Andrii Nakryiko <andrii(a)kernel.org> stable inclusion from stable-v6.6.80 commit fc01ba097319ae2033f118da3075bd783f4a08e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSW0M CVE: CVE-2025-21853 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 98671a0fd1f14e4a518ee06b19037c20014900eb ] For all BPF maps we ensure that VM_MAYWRITE is cleared when memory-mapping BPF map contents as initially read-only VMA. This is because in some cases BPF verifier relies on the underlying data to not be modified afterwards by user space, so once something is mapped read-only, it shouldn't be re-mmap'ed as read-write. As such, it's not necessary to check VM_MAYWRITE in bpf_map_mmap() and map->ops->map_mmap() callbacks: VM_WRITE should be consistently set for read-write mappings, and if VM_WRITE is not set, there is no way for user space to upgrade read-only mapping to read-write one. This patch cleans up this VM_WRITE vs VM_MAYWRITE handling within bpf_map_mmap(), which is an entry point for any BPF map mmap()-ing logic. We also drop unnecessary sanitization of VM_MAYWRITE in BPF ringbuf's map_mmap() callback implementation, as it is already performed by common code in bpf_map_mmap(). Note, though, that in bpf_map_mmap_{open,close}() callbacks we can't drop VM_MAYWRITE use, because it's possible (and is outside of subsystem's control) to have initially read-write memory mapping, which is subsequently dropped to read-only by user space through mprotect(). In such case, from BPF verifier POV it's read-write data throughout the lifetime of BPF map, and is counted as "active writer". But its VMAs will start out as VM_WRITE|VM_MAYWRITE, then mprotect() can change it to just VM_MAYWRITE (and no VM_WRITE), so when its finally munmap()'ed and bpf_map_mmap_close() is called, vm_flags will be just VM_MAYWRITE, but we still need to decrement active writer count with bpf_map_write_active_dec() as it's still considered to be a read-write mapping by the rest of BPF subsystem. Similar reasoning applies to bpf_map_mmap_open(), which is called whenever mmap(), munmap(), and/or mprotect() forces mm subsystem to split original VMA into multiple discontiguous VMAs. Memory-mapping handling is a bit tricky, yes. Cc: Jann Horn <jannh(a)google.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Shakeel Butt <shakeel.butt(a)linux.dev> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/r/20250129012246.1515826-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Stable-dep-of: bc27c52eea18 ("bpf: avoid holding freeze_mutex during mmap operation") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/ringbuf.c | 4 ---- kernel/bpf/syscall.c | 10 ++++++++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 00688545742f..6aff5ee483b6 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -268,8 +268,6 @@ static int ringbuf_map_mmap_kern(struct bpf_map *map, struct vm_area_struct *vma /* allow writable mapping for the consumer_pos only */ if (vma->vm_pgoff != 0 || vma->vm_end - vma->vm_start != PAGE_SIZE) return -EPERM; - } else { - vm_flags_clear(vma, VM_MAYWRITE); } /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, @@ -289,8 +287,6 @@ static int ringbuf_map_mmap_user(struct bpf_map *map, struct vm_area_struct *vma * position, and the ring buffer data itself. */ return -EPERM; - } else { - vm_flags_clear(vma, VM_MAYWRITE); } /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, vma->vm_pgoff + RINGBUF_PGOFF); diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index f8edda3bf396..f79b8915d8c8 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -913,15 +913,21 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) vma->vm_ops = &bpf_map_default_vmops; vma->vm_private_data = map; vm_flags_clear(vma, VM_MAYEXEC); + /* If mapping is read-only, then disallow potentially re-mapping with + * PROT_WRITE by dropping VM_MAYWRITE flag. This VM_MAYWRITE clearing + * means that as far as BPF map's memory-mapped VMAs are concerned, + * VM_WRITE and VM_MAYWRITE and equivalent, if one of them is set, + * both should be set, so we can forget about VM_MAYWRITE and always + * check just VM_WRITE + */ if (!(vma->vm_flags & VM_WRITE)) - /* disallow re-mapping with PROT_WRITE */ vm_flags_clear(vma, VM_MAYWRITE); err = map->ops->map_mmap(map, vma); if (err) goto out; - if (vma->vm_flags & VM_MAYWRITE) + if (vma->vm_flags & VM_WRITE) bpf_map_write_active_inc(map); out: mutex_unlock(&map->freeze_mutex); -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS] block: fix error unwinding in blk_register_queue
by Zheng Qixing 19 Mar '25

19 Mar '25

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.2-rc1 commit 40602997be26887bdfa3d58659c3acb4579099e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSG04 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ blk_register_queue fails to handle errors from blk_mq_sysfs_register, leaks various resources on errors and accidentally sets queue refs percpu refcount to percpu mode on kobject_add failure. Fix all that by properly unwinding on errors. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20221114042637.1009333-4-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-sysfs.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-sysfs.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index b23d82fbe736..05d8a5b236f5 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -961,15 +961,21 @@ int blk_register_queue(struct gendisk *disk) return ret; mutex_lock(&queue_to_wrapper(q)->sysfs_dir_lock); - ret = kobject_add(&q->kobj, kobject_get(&dev->kobj), "%s", "queue"); if (ret < 0) { blk_trace_remove_sysfs(dev); goto unlock; } - if (q->mq_ops) - __blk_mq_register_dev(dev, q); + if (q->mq_ops) { + ret = __blk_mq_register_dev(dev, q); + if (ret) { + blk_trace_remove_sysfs(dev); + kobject_del(&q->kobj); + kobject_put(&dev->kobj); + goto unlock; + } + } mutex_lock(&q->sysfs_lock); mutex_lock(&q->debugfs_mutex); -- 2.39.2

2 1

[openeuler:OLK-6.6 2041/2041] arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used
by kernel test robot 18 Mar '25

18 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 010e974aad58e203f1e68707107db00593fcf851 commit: 7bd845b17aab36ac5d381557b797845404aaeb57 [2041/2041] LoongArch: Update the flush cache policy config: loongarch-randconfig-001-20250318 (https://download.01.org/0day-ci/archive/20250318/202503182233.88LCSaAj-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250318/202503182233.88LCSaAj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503182233.88LCSaAj-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/loongarch/mm/cache.c: In function 'flush_cache_last_level': >> arch/loongarch/mm/cache.c:69:29: warning: variable 'way_size' set but not used [-Wunused-but-set-variable] 69 | int i, j, nr_nodes, way_size; | ^~~~~~~~ vim +/way_size +69 arch/loongarch/mm/cache.c 65 66 static void flush_cache_last_level(unsigned int leaf) 67 { 68 u64 addr; > 69 int i, j, nr_nodes, way_size; 70 struct cache_desc *cdesc = current_cpu_data.cache_leaves + leaf; 71 72 nr_nodes = loongson_sysconf.nr_nodes; 73 74 addr = CSR_DMW1_BASE; 75 iocsr_write8(0x1, 0x280); 76 way_size = cdesc->sets * cdesc->linesz; 77 do { 78 for (i = 0; i < (cdesc->ways * 3); i++) { 79 for (j = 0; j < (cdesc->sets); j++) { 80 READ_ONCE(*(u32 *)addr); 81 addr += cdesc->linesz; 82 } 83 } 84 addr += 0x100000000000; 85 } while (--nr_nodes > 0); 86 } 87 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49508
by Chen Ridong 18 Mar '25

18 Mar '25

CVE-2022-49508 Dinghao Liu (1): HID: elan: Fix memleak in elan_input_configured Miaoqian Lin (1): HID: elan: Fix potential double free in elan_input_configured drivers/hid/hid-elan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] smb: client: Add check for next_buffer in receive_encrypted_standard()
by Li Lingfeng 18 Mar '25

18 Mar '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.80 commit 9e5d99a4cf2e23c716b44862975548415fae5391 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZD CVE: CVE-2025-21844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 860ca5e50f73c2a1cef7eefc9d39d04e275417f7 upstream. Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent null pointer dereference. Fixes: eec04ea11969 ("smb: client: fix OOB in receive_encrypted_standard()") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index fc6d00344c50..55269d3a8278 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4904,6 +4904,10 @@ receive_encrypted_standard(struct TCP_Server_Info *server, next_buffer = (char *)cifs_buf_get(); else next_buffer = (char *)cifs_small_buf_get(); + if (!next_buffer) { + cifs_server_dbg(VFS, "No memory for (large) SMB response\n"); + return -1; + } memcpy(next_buffer, buf + next_cmd, pdu_length - next_cmd); } -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] two bugfixs
by Tong Tiangen 18 Mar '25

18 Mar '25

Brian Geffon (1): mm: fix finish_fault() handling for large folios Zi Yan (1): mm/migrate: fix shmem xarray update during migration mm/memory.c | 15 ++++++++++----- mm/migrate.c | 10 ++++------ 2 files changed, 14 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH olk-6.6 0/2] two bugfixs
by Tong Tiangen 18 Mar '25

18 Mar '25

Brian Geffon (1): mm: fix finish_fault() handling for large folios Zi Yan (1): mm/migrate: fix shmem xarray update during migration mm/memory.c | 15 ++++++++++----- mm/migrate.c | 10 ++++------ 2 files changed, 14 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
by Zheng Qixing 18 Mar '25

18 Mar '25

From: Bart Van Assche <bvanassche(a)acm.org> mainline inclusion from mainline-v5.19-rc3 commit 14dc7a18abbe4176f5626c13c333670da8e06aa1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1ZW CVE: CVE-2022-49720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ This patch prevents that test nvme/004 triggers the following: UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9 index 512 is out of range for type 'long unsigned int [512]' Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x3b __ubsan_handle_out_of_bounds.cold+0x44/0x49 blk_mq_alloc_request_hctx+0x304/0x310 __nvme_submit_sync_cmd+0x70/0x200 [nvme_core] nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics] nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop] nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop] nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics] nvmf_dev_write+0xae/0x111 [nvme_fabrics] vfs_write+0x144/0x560 ksys_write+0xb7/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Cc: Christoph Hellwig <hch(a)lst.de> Cc: Ming Lei <ming.lei(a)redhat.com> Fixes: 20e4d8139319 ("blk-mq: simplify queue mapping & schedule with each possisble CPU") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20220615210004.1031820-1-bvanassche@acm.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/blk-mq.c [Due to not merging commit a5ea5811058d ("blk-mq: move the call to blk_queue_enter_live out of blk_mq_get_request").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- block/blk-mq.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index 0392b014ac89..e1253b18516b 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -515,6 +515,10 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, return ERR_PTR(-EXDEV); } cpu = cpumask_first_and(alloc_data.hctx->cpumask, cpu_online_mask); + if (cpu >= nr_cpu_ids) { + blk_queue_exit(q); + return ERR_PTR(-EXDEV); + } alloc_data.ctx = __blk_mq_get_ctx(q, cpu); rq = blk_mq_get_request(q, NULL, op, &alloc_data); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] scsi: target: tcmu: Fix possible page UAF
by Zheng Qixing 18 Mar '25

18 Mar '25

From: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> stable inclusion from stable-v4.19.239 commit e3e0e067d5b34e4a68e3cc55f8eebc413f56f8ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6TV CVE: CVE-2022-49053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit a6968f7a367f128d120447360734344d5a3d5336 ] tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release(). Link: https://lore.kernel.org/r/20220311132206.24515-1-xiaoguang.wang@linux.aliba… Reviewed-by: Bodo Stroesser <bostroesser(a)gmail.com> Signed-off-by: Xiaoguang Wang <xiaoguang.wang(a)linux.alibaba.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/target/target_core_user.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c index de27014685ac..eed2d8e1c92f 100644 --- a/drivers/target/target_core_user.c +++ b/drivers/target/target_core_user.c @@ -1528,6 +1528,7 @@ static struct page *tcmu_try_get_block_page(struct tcmu_dev *udev, uint32_t dbi) mutex_lock(&udev->cmdr_lock); page = tcmu_get_block_page(udev, dbi); if (likely(page)) { + get_page(page); mutex_unlock(&udev->cmdr_lock); return page; } @@ -1566,6 +1567,7 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) /* For the vmalloc()ed cmd area pages */ addr = (void *)(unsigned long)info->mem[mi].addr + offset; page = vmalloc_to_page(addr); + get_page(page); } else { uint32_t dbi; @@ -1576,7 +1578,6 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) return VM_FAULT_SIGBUS; } - get_page(page); vmf->page = page; return 0; } -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1501/1501] lib/ubsan.c:195:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_add_overflow'; expected 'void *'
by kernel test robot 18 Mar '25

18 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a304375c0bb304fd38fa85987919aff3d831cf9b commit: d2e5767132d657577127f1d35764bb4721dd3cc5 [1501/1501] ubsan: Fix nasty -Wbuiltin-declaration-mismatch GCC-9 warnings config: arm64-randconfig-001-20250318 (https://download.01.org/0day-ci/archive/20250318/202503181741.vcHyKenV-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250318/202503181741.vcHyKenV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503181741.vcHyKenV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> lib/ubsan.c:195:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_add_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 195 | void __ubsan_handle_add_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:203:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_sub_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 203 | void __ubsan_handle_sub_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:210:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_mul_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 210 | void __ubsan_handle_mul_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:217:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_negate_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 217 | void __ubsan_handle_negate_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:238:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_divrem_overflow'; expected 'void *' [-Wbuiltin-declaration-mismatch] 238 | void __ubsan_handle_divrem_overflow(struct overflow_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/ubsan.c:323:6: warning: no previous prototype for '__ubsan_handle_type_mismatch' [-Wmissing-prototypes] 323 | void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:337:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_type_mismatch_v1'; expected 'void *' [-Wbuiltin-declaration-mismatch] 337 | void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:352:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_vla_bound_not_positive'; expected 'void *' [-Wbuiltin-declaration-mismatch] 352 | void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:370:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_out_of_bounds'; expected 'void *' [-Wbuiltin-declaration-mismatch] 370 | void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:387:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_shift_out_of_bounds'; expected 'void *' [-Wbuiltin-declaration-mismatch] 387 | void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/ubsan.c:427:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_builtin_unreachable'; expected 'void *' [-Wbuiltin-declaration-mismatch] 427 | void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> lib/ubsan.c:438:6: warning: mismatch in argument 1 type of built-in function '__ubsan_handle_load_invalid_value'; expected 'void *' [-Wbuiltin-declaration-mismatch] 438 | void __ubsan_handle_load_invalid_value(struct invalid_value_data *data, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +195 lib/ubsan.c c6d308534aef6c Andrey Ryabinin 2016-01-20 194 c6d308534aef6c Andrey Ryabinin 2016-01-20 @195 void __ubsan_handle_add_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 196 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 197 { c6d308534aef6c Andrey Ryabinin 2016-01-20 198 c6d308534aef6c Andrey Ryabinin 2016-01-20 199 handle_overflow(data, lhs, rhs, '+'); c6d308534aef6c Andrey Ryabinin 2016-01-20 200 } c6d308534aef6c Andrey Ryabinin 2016-01-20 201 EXPORT_SYMBOL(__ubsan_handle_add_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 202 c6d308534aef6c Andrey Ryabinin 2016-01-20 @203 void __ubsan_handle_sub_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 204 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 205 { c6d308534aef6c Andrey Ryabinin 2016-01-20 206 handle_overflow(data, lhs, rhs, '-'); c6d308534aef6c Andrey Ryabinin 2016-01-20 207 } c6d308534aef6c Andrey Ryabinin 2016-01-20 208 EXPORT_SYMBOL(__ubsan_handle_sub_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 209 c6d308534aef6c Andrey Ryabinin 2016-01-20 @210 void __ubsan_handle_mul_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 211 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 212 { c6d308534aef6c Andrey Ryabinin 2016-01-20 213 handle_overflow(data, lhs, rhs, '*'); c6d308534aef6c Andrey Ryabinin 2016-01-20 214 } c6d308534aef6c Andrey Ryabinin 2016-01-20 215 EXPORT_SYMBOL(__ubsan_handle_mul_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 216 c6d308534aef6c Andrey Ryabinin 2016-01-20 @217 void __ubsan_handle_negate_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 218 void *old_val) c6d308534aef6c Andrey Ryabinin 2016-01-20 219 { c6d308534aef6c Andrey Ryabinin 2016-01-20 220 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 221 char old_val_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 222 c6d308534aef6c Andrey Ryabinin 2016-01-20 223 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 224 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 225 c6d308534aef6c Andrey Ryabinin 2016-01-20 226 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 227 c6d308534aef6c Andrey Ryabinin 2016-01-20 228 val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val); c6d308534aef6c Andrey Ryabinin 2016-01-20 229 c6d308534aef6c Andrey Ryabinin 2016-01-20 230 pr_err("negation of %s cannot be represented in type %s:\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 231 old_val_str, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 232 c6d308534aef6c Andrey Ryabinin 2016-01-20 233 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 234 } c6d308534aef6c Andrey Ryabinin 2016-01-20 235 EXPORT_SYMBOL(__ubsan_handle_negate_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 236 c6d308534aef6c Andrey Ryabinin 2016-01-20 237 c6d308534aef6c Andrey Ryabinin 2016-01-20 @238 void __ubsan_handle_divrem_overflow(struct overflow_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 239 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 240 { c6d308534aef6c Andrey Ryabinin 2016-01-20 241 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 242 char rhs_val_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 243 c6d308534aef6c Andrey Ryabinin 2016-01-20 244 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 245 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 246 c6d308534aef6c Andrey Ryabinin 2016-01-20 247 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 248 c6d308534aef6c Andrey Ryabinin 2016-01-20 249 val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 250 c6d308534aef6c Andrey Ryabinin 2016-01-20 251 if (type_is_signed(data->type) && get_signed_val(data->type, rhs) == -1) c6d308534aef6c Andrey Ryabinin 2016-01-20 252 pr_err("division of %s by -1 cannot be represented in type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 253 rhs_val_str, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 254 else c6d308534aef6c Andrey Ryabinin 2016-01-20 255 pr_err("division by zero\n"); c6d308534aef6c Andrey Ryabinin 2016-01-20 256 c6d308534aef6c Andrey Ryabinin 2016-01-20 257 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 258 } c6d308534aef6c Andrey Ryabinin 2016-01-20 259 EXPORT_SYMBOL(__ubsan_handle_divrem_overflow); c6d308534aef6c Andrey Ryabinin 2016-01-20 260 42440c1f9911b4 Andrey Ryabinin 2018-02-06 261 static void handle_null_ptr_deref(struct type_mismatch_data_common *data) c6d308534aef6c Andrey Ryabinin 2016-01-20 262 { c6d308534aef6c Andrey Ryabinin 2016-01-20 263 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 264 42440c1f9911b4 Andrey Ryabinin 2018-02-06 265 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 266 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 267 42440c1f9911b4 Andrey Ryabinin 2018-02-06 268 ubsan_prologue(data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 269 c6d308534aef6c Andrey Ryabinin 2016-01-20 270 pr_err("%s null pointer of type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 271 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 272 data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 273 c6d308534aef6c Andrey Ryabinin 2016-01-20 274 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 275 } c6d308534aef6c Andrey Ryabinin 2016-01-20 276 42440c1f9911b4 Andrey Ryabinin 2018-02-06 277 static void handle_misaligned_access(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 278 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 279 { c6d308534aef6c Andrey Ryabinin 2016-01-20 280 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 281 42440c1f9911b4 Andrey Ryabinin 2018-02-06 282 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 283 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 284 42440c1f9911b4 Andrey Ryabinin 2018-02-06 285 ubsan_prologue(data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 286 c6d308534aef6c Andrey Ryabinin 2016-01-20 287 pr_err("%s misaligned address %p for type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 288 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 289 (void *)ptr, data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 290 pr_err("which requires %ld byte alignment\n", data->alignment); c6d308534aef6c Andrey Ryabinin 2016-01-20 291 c6d308534aef6c Andrey Ryabinin 2016-01-20 292 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 293 } c6d308534aef6c Andrey Ryabinin 2016-01-20 294 42440c1f9911b4 Andrey Ryabinin 2018-02-06 295 static void handle_object_size_mismatch(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 296 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 297 { c6d308534aef6c Andrey Ryabinin 2016-01-20 298 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 299 42440c1f9911b4 Andrey Ryabinin 2018-02-06 300 if (suppress_report(data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 301 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 302 42440c1f9911b4 Andrey Ryabinin 2018-02-06 303 ubsan_prologue(data->location, &flags); 901d805c33fc4c Nicolas Iooss 2016-08-02 304 pr_err("%s address %p with insufficient space\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 305 type_check_kinds[data->type_check_kind], c6d308534aef6c Andrey Ryabinin 2016-01-20 306 (void *) ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 307 pr_err("for an object of type %s\n", data->type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 308 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 309 } c6d308534aef6c Andrey Ryabinin 2016-01-20 310 42440c1f9911b4 Andrey Ryabinin 2018-02-06 311 static void ubsan_type_mismatch_common(struct type_mismatch_data_common *data, c6d308534aef6c Andrey Ryabinin 2016-01-20 312 unsigned long ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 313 { c6d308534aef6c Andrey Ryabinin 2016-01-20 314 c6d308534aef6c Andrey Ryabinin 2016-01-20 315 if (!ptr) c6d308534aef6c Andrey Ryabinin 2016-01-20 316 handle_null_ptr_deref(data); c6d308534aef6c Andrey Ryabinin 2016-01-20 317 else if (data->alignment && !IS_ALIGNED(ptr, data->alignment)) b8fe1120b4ba34 Andrew Morton 2018-02-06 318 handle_misaligned_access(data, ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 319 else c6d308534aef6c Andrey Ryabinin 2016-01-20 320 handle_object_size_mismatch(data, ptr); c6d308534aef6c Andrey Ryabinin 2016-01-20 321 } 42440c1f9911b4 Andrey Ryabinin 2018-02-06 322 42440c1f9911b4 Andrey Ryabinin 2018-02-06 323 void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 324 void *ptr) 42440c1f9911b4 Andrey Ryabinin 2018-02-06 325 { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 326 struct type_mismatch_data_common common_data = { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 327 .location = &data->location, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 328 .type = data->type, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 329 .alignment = data->alignment, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 330 .type_check_kind = data->type_check_kind 42440c1f9911b4 Andrey Ryabinin 2018-02-06 331 }; 42440c1f9911b4 Andrey Ryabinin 2018-02-06 332 d2e5767132d657 Andrey Ryabinin 2019-05-13 333 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 334 } c6d308534aef6c Andrey Ryabinin 2016-01-20 335 EXPORT_SYMBOL(__ubsan_handle_type_mismatch); c6d308534aef6c Andrey Ryabinin 2016-01-20 336 42440c1f9911b4 Andrey Ryabinin 2018-02-06 @337 void __ubsan_handle_type_mismatch_v1(struct type_mismatch_data_v1 *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 338 void *ptr) 42440c1f9911b4 Andrey Ryabinin 2018-02-06 339 { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 340 42440c1f9911b4 Andrey Ryabinin 2018-02-06 341 struct type_mismatch_data_common common_data = { 42440c1f9911b4 Andrey Ryabinin 2018-02-06 342 .location = &data->location, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 343 .type = data->type, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 344 .alignment = 1UL << data->log_alignment, 42440c1f9911b4 Andrey Ryabinin 2018-02-06 345 .type_check_kind = data->type_check_kind 42440c1f9911b4 Andrey Ryabinin 2018-02-06 346 }; 42440c1f9911b4 Andrey Ryabinin 2018-02-06 347 d2e5767132d657 Andrey Ryabinin 2019-05-13 348 ubsan_type_mismatch_common(&common_data, (unsigned long)ptr); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 349 } 42440c1f9911b4 Andrey Ryabinin 2018-02-06 350 EXPORT_SYMBOL(__ubsan_handle_type_mismatch_v1); 42440c1f9911b4 Andrey Ryabinin 2018-02-06 351 c6d308534aef6c Andrey Ryabinin 2016-01-20 @352 void __ubsan_handle_vla_bound_not_positive(struct vla_bound_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 353 void *bound) c6d308534aef6c Andrey Ryabinin 2016-01-20 354 { c6d308534aef6c Andrey Ryabinin 2016-01-20 355 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 356 char bound_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 357 c6d308534aef6c Andrey Ryabinin 2016-01-20 358 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 359 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 360 c6d308534aef6c Andrey Ryabinin 2016-01-20 361 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 362 c6d308534aef6c Andrey Ryabinin 2016-01-20 363 val_to_string(bound_str, sizeof(bound_str), data->type, bound); c6d308534aef6c Andrey Ryabinin 2016-01-20 364 pr_err("variable length array bound value %s <= 0\n", bound_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 365 c6d308534aef6c Andrey Ryabinin 2016-01-20 366 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 367 } c6d308534aef6c Andrey Ryabinin 2016-01-20 368 EXPORT_SYMBOL(__ubsan_handle_vla_bound_not_positive); c6d308534aef6c Andrey Ryabinin 2016-01-20 369 d2e5767132d657 Andrey Ryabinin 2019-05-13 @370 void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) c6d308534aef6c Andrey Ryabinin 2016-01-20 371 { c6d308534aef6c Andrey Ryabinin 2016-01-20 372 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 373 char index_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 374 c6d308534aef6c Andrey Ryabinin 2016-01-20 375 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 376 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 377 c6d308534aef6c Andrey Ryabinin 2016-01-20 378 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 379 c6d308534aef6c Andrey Ryabinin 2016-01-20 380 val_to_string(index_str, sizeof(index_str), data->index_type, index); c6d308534aef6c Andrey Ryabinin 2016-01-20 381 pr_err("index %s is out of range for type %s\n", index_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 382 data->array_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 383 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 384 } c6d308534aef6c Andrey Ryabinin 2016-01-20 385 EXPORT_SYMBOL(__ubsan_handle_out_of_bounds); c6d308534aef6c Andrey Ryabinin 2016-01-20 386 c6d308534aef6c Andrey Ryabinin 2016-01-20 @387 void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, d2e5767132d657 Andrey Ryabinin 2019-05-13 388 void *lhs, void *rhs) c6d308534aef6c Andrey Ryabinin 2016-01-20 389 { c6d308534aef6c Andrey Ryabinin 2016-01-20 390 unsigned long flags; c6d308534aef6c Andrey Ryabinin 2016-01-20 391 struct type_descriptor *rhs_type = data->rhs_type; c6d308534aef6c Andrey Ryabinin 2016-01-20 392 struct type_descriptor *lhs_type = data->lhs_type; c6d308534aef6c Andrey Ryabinin 2016-01-20 393 char rhs_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 394 char lhs_str[VALUE_LENGTH]; c6d308534aef6c Andrey Ryabinin 2016-01-20 395 c6d308534aef6c Andrey Ryabinin 2016-01-20 396 if (suppress_report(&data->location)) c6d308534aef6c Andrey Ryabinin 2016-01-20 397 return; c6d308534aef6c Andrey Ryabinin 2016-01-20 398 c6d308534aef6c Andrey Ryabinin 2016-01-20 399 ubsan_prologue(&data->location, &flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 400 c6d308534aef6c Andrey Ryabinin 2016-01-20 401 val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 402 val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs); c6d308534aef6c Andrey Ryabinin 2016-01-20 403 c6d308534aef6c Andrey Ryabinin 2016-01-20 404 if (val_is_negative(rhs_type, rhs)) c6d308534aef6c Andrey Ryabinin 2016-01-20 405 pr_err("shift exponent %s is negative\n", rhs_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 406 c6d308534aef6c Andrey Ryabinin 2016-01-20 407 else if (get_unsigned_val(rhs_type, rhs) >= c6d308534aef6c Andrey Ryabinin 2016-01-20 408 type_bit_width(lhs_type)) c6d308534aef6c Andrey Ryabinin 2016-01-20 409 pr_err("shift exponent %s is too large for %u-bit type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 410 rhs_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 411 type_bit_width(lhs_type), c6d308534aef6c Andrey Ryabinin 2016-01-20 412 lhs_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 413 else if (val_is_negative(lhs_type, lhs)) c6d308534aef6c Andrey Ryabinin 2016-01-20 414 pr_err("left shift of negative value %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 415 lhs_str); c6d308534aef6c Andrey Ryabinin 2016-01-20 416 else c6d308534aef6c Andrey Ryabinin 2016-01-20 417 pr_err("left shift of %s by %s places cannot be" c6d308534aef6c Andrey Ryabinin 2016-01-20 418 " represented in type %s\n", c6d308534aef6c Andrey Ryabinin 2016-01-20 419 lhs_str, rhs_str, c6d308534aef6c Andrey Ryabinin 2016-01-20 420 lhs_type->type_name); c6d308534aef6c Andrey Ryabinin 2016-01-20 421 c6d308534aef6c Andrey Ryabinin 2016-01-20 422 ubsan_epilogue(&flags); c6d308534aef6c Andrey Ryabinin 2016-01-20 423 } c6d308534aef6c Andrey Ryabinin 2016-01-20 424 EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); c6d308534aef6c Andrey Ryabinin 2016-01-20 425 c6d308534aef6c Andrey Ryabinin 2016-01-20 426 :::::: The code at line 195 was first introduced by commit :::::: c6d308534aef6c99904bf5862066360ae067abc4 UBSAN: run-time undefined behavior sanity checker :::::: TO: Andrey Ryabinin <aryabinin(a)virtuozzo.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drm/plane: Move range check for format_count earlier
by Wang Wensheng 18 Mar '25

18 Mar '25

From: Steven Price <steven.price(a)arm.com> stable inclusion from stable-v4.19.247 commit 4ab7e453a3ee88c274cf97bee9487ab92a66d313 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6CD CVE: CVE-2021-47659 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4b674dd69701c2e22e8e7770c1706a69f3b17269 ] While the check for format_count > 64 in __drm_universal_plane_init() shouldn't be hit (it's a WARN_ON), in its current position it will then leak the plane->format_types array and fail to call drm_mode_object_unregister() leaking the modeset identifier. Move it to the start of the function to avoid allocating those resources in the first place. Signed-off-by: Steven Price <steven.price(a)arm.com> Signed-off-by: Liviu Dudau <liviu.dudau(a)arm.com> Link: https://lore.kernel.org/dri-devel/20211203102815.38624-1-steven.price@arm.c… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/gpu/drm/drm_plane.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c index 4c530900a208..35df2fac5c29 100644 --- a/drivers/gpu/drm/drm_plane.c +++ b/drivers/gpu/drm/drm_plane.c @@ -177,6 +177,13 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, if (WARN_ON(config->num_total_plane >= 32)) return -EINVAL; + /* + * First driver to need more than 64 formats needs to fix this. Each + * format is encoded as a bit and the current code only supports a u64. + */ + if (WARN_ON(format_count > 64)) + return -EINVAL; + WARN_ON(drm_drv_uses_atomic_modeset(dev) && (!funcs->atomic_destroy_state || !funcs->atomic_duplicate_state)); @@ -198,13 +205,6 @@ int drm_universal_plane_init(struct drm_device *dev, struct drm_plane *plane, return -ENOMEM; } - /* - * First driver to need more than 64 formats needs to fix this. Each - * format is encoded as a bit and the current code only supports a u64. - */ - if (WARN_ON(format_count > 64)) - return -EINVAL; - if (format_modifiers) { const uint64_t *temp_modifiers = format_modifiers; while (*temp_modifiers++ != DRM_FORMAT_MOD_INVALID) -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
by Wang Wensheng 18 Mar '25

18 Mar '25

From: Dave Airlie <airlied(a)redhat.com> stable inclusion from stable-v4.19.247 commit 15c3bcc9b5349d40207e5f8d4d799b8b4b7d13b8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2QX CVE: CVE-2022-49335 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 31ab27b14daaa75541a415c6794d6f3567fea44a upstream. Submitting a cs with 0 chunks, causes an oops later, found trying to execute the wrong userspace driver. MESA_LOADER_DRIVER_OVERRIDE=v3d glxinfo [172536.665184] BUG: kernel NULL pointer dereference, address: 00000000000001d8 [172536.665188] #PF: supervisor read access in kernel mode [172536.665189] #PF: error_code(0x0000) - not-present page [172536.665191] PGD 6712a0067 P4D 6712a0067 PUD 5af9ff067 PMD 0 [172536.665195] Oops: 0000 [#1] SMP NOPTI [172536.665197] CPU: 7 PID: 2769838 Comm: glxinfo Tainted: P O 5.10.81 #1-NixOS [172536.665199] Hardware name: To be filled by O.E.M. To be filled by O.E.M./CROSSHAIR V FORMULA-Z, BIOS 2201 03/23/2015 [172536.665272] RIP: 0010:amdgpu_cs_ioctl+0x96/0x1ce0 [amdgpu] [172536.665274] Code: 75 18 00 00 4c 8b b2 88 00 00 00 8b 46 08 48 89 54 24 68 49 89 f7 4c 89 5c 24 60 31 d2 4c 89 74 24 30 85 c0 0f 85 c0 01 00 00 <48> 83 ba d8 01 00 00 00 48 8b b4 24 90 00 00 00 74 16 48 8b 46 10 [172536.665276] RSP: 0018:ffffb47c0e81bbe0 EFLAGS: 00010246 [172536.665277] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [172536.665278] RDX: 0000000000000000 RSI: ffffb47c0e81be28 RDI: ffffb47c0e81bd68 [172536.665279] RBP: ffff936524080010 R08: 0000000000000000 R09: ffffb47c0e81be38 [172536.665281] R10: ffff936524080010 R11: ffff936524080000 R12: ffffb47c0e81bc40 [172536.665282] R13: ffffb47c0e81be28 R14: ffff9367bc410000 R15: ffffb47c0e81be28 [172536.665283] FS: 00007fe35e05d740(0000) GS:ffff936c1edc0000(0000) knlGS:0000000000000000 [172536.665284] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [172536.665286] CR2: 00000000000001d8 CR3: 0000000532e46000 CR4: 00000000000406e0 [172536.665287] Call Trace: [172536.665322] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] [172536.665332] drm_ioctl_kernel+0xaa/0xf0 [drm] [172536.665338] drm_ioctl+0x201/0x3b0 [drm] [172536.665369] ? amdgpu_cs_find_mapping+0x110/0x110 [amdgpu] [172536.665372] ? selinux_file_ioctl+0x135/0x230 [172536.665399] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] [172536.665403] __x64_sys_ioctl+0x83/0xb0 [172536.665406] do_syscall_64+0x33/0x40 [172536.665409] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2018 Signed-off-by: Dave Airlie <airlied(a)redhat.com> Cc: stable(a)vger.kernel.org Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c index d1554485f8e5..70e446c2acf8 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -110,7 +110,7 @@ static int amdgpu_cs_parser_init(struct amdgpu_cs_parser *p, union drm_amdgpu_cs int ret; if (cs->in.num_chunks == 0) - return 0; + return -EINVAL; chunk_array = kmalloc_array(cs->in.num_chunks, sizeof(uint64_t), GFP_KERNEL); if (!chunk_array) -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS 0/3]some CVE fixes
by Tong Tiangen 18 Mar '25

18 Mar '25

Duoming Zhou (1): drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() Martin Faltesek (1): nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling Yang Yingliang (1): rtc: mt6397: check return value after calling platform_get_resource() drivers/nfc/st21nfca/se.c | 13 ++++++++++--- drivers/rtc/rtc-mt6397.c | 2 ++ drivers/staging/rtl8192e/rtllib_softmac.c | 2 +- 3 files changed, 13 insertions(+), 4 deletions(-) -- 2.25.1

2 4

[openeuler:OLK-5.10] BUILD REGRESSION a348aa0315d2a90cde93df922b84ab682459a834
by kernel test robot 18 Mar '25

18 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: a348aa0315d2a90cde93df922b84ab682459a834 !14918 [OLK-5.10] backport important bugfix from the kernel-5.10.y Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503171920.f4jVchcy-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202503181406.E4pR441t-lkp@intel.com ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-001-20250317 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250317 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250317 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250317 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250317 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250317 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250317 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250317 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250317 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250317 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-121-20250318 | |-- mm-memcontrol.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-got-void-noderef-__user-buffer | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20250318 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq-sysfs.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- block-blk-mq.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctxs-got-struct-blk_mq_hw_ctx-noderef-__rcu-queue_hw_ctx | |-- include-linux-blk-mq.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- mm-page_alloc.c:sparse:sparse:symbol-__drain_all_pages-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:sparse:sparse:symbol-__zone_set_pageset_high_and_batch-was-not-declared.-Should-it-be-static | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch | `-- mm-percpu.c:sparse:sparse:symbol-pcpu_free_slot-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20250318 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- block-blk-mq.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- include-linux-blk-mq.h:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- x86_64-randconfig-161-20250318 |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 1447m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-19 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250317 gcc-14.2.0 arm64 randconfig-002-20250317 gcc-14.2.0 arm64 randconfig-003-20250317 gcc-14.2.0 arm64 randconfig-004-20250317 gcc-14.2.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250317 gcc-12 x86_64 buildonly-randconfig-002-20250317 clang-20 x86_64 buildonly-randconfig-003-20250317 gcc-12 x86_64 buildonly-randconfig-004-20250317 gcc-12 x86_64 buildonly-randconfig-005-20250317 gcc-12 x86_64 buildonly-randconfig-006-20250317 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2815/2815] block/blk-mq.c:485:19: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 18 Mar '25

18 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a348aa0315d2a90cde93df922b84ab682459a834 commit: 8a6bee347626968d467aef07453c4547bc23cb64 [2815/2815] blk-mq: fix potential uaf for 'queue_hw_ctx' config: x86_64-randconfig-122-20250318 (https://download.01.org/0day-ci/archive/20250318/202503181406.E4pR441t-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250318/202503181406.E4pR441t-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503181406.E4pR441t-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-mq-sysfs.c:339:55: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@ block/blk-mq-sysfs.c:339:55: sparse: expected struct blk_mq_hw_ctx *hctx block/blk-mq-sysfs.c:339:55: sparse: got struct blk_mq_hw_ctx [noderef] __rcu * block/blk-mq-sysfs.c: note: in included file: include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** -- >> block/blk-mq.c:485:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@ block/blk-mq.c:485:19: sparse: expected struct blk_mq_hw_ctx *hctx block/blk-mq.c:485:19: sparse: got struct blk_mq_hw_ctx [noderef] __rcu * >> block/blk-mq.c:3270:41: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct blk_mq_hw_ctx **hctxs @@ got struct blk_mq_hw_ctx [noderef] __rcu **queue_hw_ctx @@ block/blk-mq.c:3270:41: sparse: expected struct blk_mq_hw_ctx **hctxs block/blk-mq.c:3270:41: sparse: got struct blk_mq_hw_ctx [noderef] __rcu **queue_hw_ctx block/blk-mq.c:3284:17: sparse: sparse: incompatible types in comparison expression (different address spaces): block/blk-mq.c:3284:17: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * block/blk-mq.c:3284:17: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** block/blk-mq.c:4033:14: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct blk_mq_hw_ctx *hctx @@ got struct blk_mq_hw_ctx [noderef] __rcu * @@ block/blk-mq.c: note: in included file: include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** include/linux/blk-mq.h:620:18: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu *[noderef] __rcu * include/linux/blk-mq.h:620:18: sparse: struct blk_mq_hw_ctx [noderef] __rcu ** vim +485 block/blk-mq.c 320ae51feed5c2 Jens Axboe 2013-10-24 446 cd6ce1482fd9e6 Bart Van Assche 2017-06-20 447 struct request *blk_mq_alloc_request_hctx(struct request_queue *q, 9a95e4ef709533 Bart Van Assche 2017-11-09 448 unsigned int op, blk_mq_req_flags_t flags, unsigned int hctx_idx) 1f5bd336b91505 Ming Lin 2016-06-13 449 { e6e7abffe386b6 Christoph Hellwig 2020-05-29 450 struct blk_mq_alloc_data data = { e6e7abffe386b6 Christoph Hellwig 2020-05-29 451 .q = q, e6e7abffe386b6 Christoph Hellwig 2020-05-29 452 .flags = flags, e6e7abffe386b6 Christoph Hellwig 2020-05-29 453 .cmd_flags = op, e6e7abffe386b6 Christoph Hellwig 2020-05-29 454 }; 600c3b0cea784a Christoph Hellwig 2020-05-29 455 u64 alloc_time_ns = 0; 6d2809d51a5079 Omar Sandoval 2017-02-27 456 unsigned int cpu; 600c3b0cea784a Christoph Hellwig 2020-05-29 457 unsigned int tag; 1f5bd336b91505 Ming Lin 2016-06-13 458 int ret; 1f5bd336b91505 Ming Lin 2016-06-13 459 600c3b0cea784a Christoph Hellwig 2020-05-29 460 /* alloc_time includes depth and tag waits */ 600c3b0cea784a Christoph Hellwig 2020-05-29 461 if (blk_queue_rq_alloc_time(q)) 600c3b0cea784a Christoph Hellwig 2020-05-29 462 alloc_time_ns = ktime_get_ns(); 600c3b0cea784a Christoph Hellwig 2020-05-29 463 1f5bd336b91505 Ming Lin 2016-06-13 464 /* 1f5bd336b91505 Ming Lin 2016-06-13 465 * If the tag allocator sleeps we could get an allocation for a 1f5bd336b91505 Ming Lin 2016-06-13 466 * different hardware context. No need to complicate the low level 1f5bd336b91505 Ming Lin 2016-06-13 467 * allocator for this for the rare use case of a command tied to 1f5bd336b91505 Ming Lin 2016-06-13 468 * a specific queue. 1f5bd336b91505 Ming Lin 2016-06-13 469 */ 600c3b0cea784a Christoph Hellwig 2020-05-29 470 if (WARN_ON_ONCE(!(flags & (BLK_MQ_REQ_NOWAIT | BLK_MQ_REQ_RESERVED)))) 1f5bd336b91505 Ming Lin 2016-06-13 471 return ERR_PTR(-EINVAL); 1f5bd336b91505 Ming Lin 2016-06-13 472 1f5bd336b91505 Ming Lin 2016-06-13 473 if (hctx_idx >= q->nr_hw_queues) 1f5bd336b91505 Ming Lin 2016-06-13 474 return ERR_PTR(-EIO); 1f5bd336b91505 Ming Lin 2016-06-13 475 3a0a529971ec4e Bart Van Assche 2017-11-09 476 ret = blk_queue_enter(q, flags); 1f5bd336b91505 Ming Lin 2016-06-13 477 if (ret) 1f5bd336b91505 Ming Lin 2016-06-13 478 return ERR_PTR(ret); 1f5bd336b91505 Ming Lin 2016-06-13 479 c8712c6a674e33 Christoph Hellwig 2016-09-23 480 /* c8712c6a674e33 Christoph Hellwig 2016-09-23 481 * Check if the hardware context is actually mapped to anything. c8712c6a674e33 Christoph Hellwig 2016-09-23 482 * If not tell the caller that it should skip this queue. c8712c6a674e33 Christoph Hellwig 2016-09-23 483 */ a5ea5811058ddb Christoph Hellwig 2020-05-16 484 ret = -EXDEV; e6e7abffe386b6 Christoph Hellwig 2020-05-29 @485 data.hctx = q->queue_hw_ctx[hctx_idx]; e6e7abffe386b6 Christoph Hellwig 2020-05-29 486 if (!blk_mq_hw_queue_mapped(data.hctx)) a5ea5811058ddb Christoph Hellwig 2020-05-16 487 goto out_queue_exit; e6e7abffe386b6 Christoph Hellwig 2020-05-29 488 cpu = cpumask_first_and(data.hctx->cpumask, cpu_online_mask); e6e7abffe386b6 Christoph Hellwig 2020-05-29 489 data.ctx = __blk_mq_get_ctx(q, cpu); 1f5bd336b91505 Ming Lin 2016-06-13 490 42fdc5e49c2be9 Christoph Hellwig 2020-06-29 491 if (!q->elevator) 600c3b0cea784a Christoph Hellwig 2020-05-29 492 blk_mq_tag_busy(data.hctx); 600c3b0cea784a Christoph Hellwig 2020-05-29 493 a5ea5811058ddb Christoph Hellwig 2020-05-16 494 ret = -EWOULDBLOCK; 600c3b0cea784a Christoph Hellwig 2020-05-29 495 tag = blk_mq_get_tag(&data); 600c3b0cea784a Christoph Hellwig 2020-05-29 496 if (tag == BLK_MQ_NO_TAG) a5ea5811058ddb Christoph Hellwig 2020-05-16 497 goto out_queue_exit; 600c3b0cea784a Christoph Hellwig 2020-05-29 498 return blk_mq_rq_ctx_init(&data, tag, alloc_time_ns); 600c3b0cea784a Christoph Hellwig 2020-05-29 499 a5ea5811058ddb Christoph Hellwig 2020-05-16 500 out_queue_exit: a5ea5811058ddb Christoph Hellwig 2020-05-16 501 blk_queue_exit(q); a5ea5811058ddb Christoph Hellwig 2020-05-16 502 return ERR_PTR(ret); 1f5bd336b91505 Ming Lin 2016-06-13 503 } 1f5bd336b91505 Ming Lin 2016-06-13 504 EXPORT_SYMBOL_GPL(blk_mq_alloc_request_hctx); 1f5bd336b91505 Ming Lin 2016-06-13 505 :::::: The code at line 485 was first introduced by commit :::::: e6e7abffe386b614a194ec32457a00c304c980f4 blk-mq: simplify the blk_mq_get_request calling convention :::::: TO: Christoph Hellwig <hch(a)lst.de> :::::: CC: Jens Axboe <axboe(a)kernel.dk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ubi: ubi_create_volume: Fix use-after-free when volume creation failed
by Wang Zhaolong 18 Mar '25

18 Mar '25

From: Zhihao Cheng <chengzhihao1(a)huawei.com> stable inclusion from stable-v4.19.247 commit abb67043060f2bf4c03d7c3debb9ae980e2b6db3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1CU CVE: CVE-2022-49388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8c03a1c21d72210f81cb369cc528e3fde4b45411 ] There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path: ubi_eba_replace_table(vol, eba_tbl) vol->eba_tbl = tbl out_mapping: ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl' out_unlock: put_device(&vol->dev) vol_release kfree(tbl->entries) // UAF Fix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link]. Fixes: 493cfaeaa0c9b ("mtd: utilize new cdev_device_add helper function") Link: https://bugzilla.kernel.org/show_bug.cgi?id=215965 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/vmt.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c index 729588b94e41..f2fe6cdf8cd9 100644 --- a/drivers/mtd/ubi/vmt.c +++ b/drivers/mtd/ubi/vmt.c @@ -326,11 +326,10 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) out_mapping: spin_lock(&ubi->volumes_lock); ubi->volumes[vol_id] = NULL; ubi->vol_count -= 1; spin_unlock(&ubi->volumes_lock); - ubi_eba_destroy_table(eba_tbl); out_acc: spin_lock(&ubi->volumes_lock); ubi->rsvd_pebs -= vol->reserved_pebs; ubi->avail_pebs += vol->reserved_pebs; out_unlock: -- 2.39.2

2 1

[PATCH OLK-6.6] arm64_mpam: Add prefetch option
by Zeng Heng 17 Mar '25

17 Mar '25

Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/mpam.h | 15 ++++++ arch/arm64/include/asm/thread_info.h | 1 + fs/resctrl/internal.h | 1 + fs/resctrl/rdtgroup.c | 78 ++++++++++++++++++++++++++++ 4 files changed, 95 insertions(+) diff --git a/arch/arm64/include/asm/mpam.h b/arch/arm64/include/asm/mpam.h index 9abe1fe58c34..f2fc1cf99fb6 100644 --- a/arch/arm64/include/asm/mpam.h +++ b/arch/arm64/include/asm/mpam.h @@ -143,16 +143,31 @@ static inline void resctrl_arch_set_rmid(struct task_struct *tsk, u32 rmid) #endif } +#define setbit(x,y) x |= (1<<y) +#define clrbit(x,y) x &= ~(1<<y) + static inline void mpam_thread_switch(struct task_struct *tsk) { u64 oldregval; int cpu = smp_processor_id(); u64 regval = mpam_get_regval(tsk); + u64 val, val1; if (!IS_ENABLED(CONFIG_ARM64_MPAM) || !static_branch_likely(&mpam_enabled)) return; + asm volatile("mrs %0, S3_1_c15_c6_4" : "=r" (val)); + val1 = val; + + if (task_thread_info(tsk)->prefetch_dis) + setbit(val1, 0); + else + clrbit(val1, 0); + + if (val1 != val) + asm volatile("msr S3_1_c15_c6_4, %0" : : "r"(val1)); + if (regval == READ_ONCE(mpam_resctrl_default_group)) regval = READ_ONCE(per_cpu(arm64_mpam_default, cpu)); diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h index 379d24059f5b..00cd142bc8fa 100644 --- a/arch/arm64/include/asm/thread_info.h +++ b/arch/arm64/include/asm/thread_info.h @@ -45,6 +45,7 @@ struct thread_info { #endif #ifdef CONFIG_ARM64_MPAM u64 mpam_partid_pmg; + u32 prefetch_dis; #endif u32 cpu; diff --git a/fs/resctrl/internal.h b/fs/resctrl/internal.h index fb620beba958..fbc76efa06d9 100644 --- a/fs/resctrl/internal.h +++ b/fs/resctrl/internal.h @@ -173,6 +173,7 @@ struct rdtgroup { struct mongroup mon; enum rdtgrp_mode mode; struct pseudo_lock_region *plr; + u32 prefetch_dis; }; /* List of all resource groups */ diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index 3f1bb36482e0..af868b8f0539 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -822,6 +822,76 @@ static int rdtgroup_tasks_show(struct kernfs_open_file *of, return ret; } +static void update_prefetch_tasks(struct rdtgroup *r, u32 prefetch_dis) +{ + struct task_struct *p, *t; + + rcu_read_lock(); + + for_each_process_thread(p, t) { + if (is_closid_match(t, r) || is_rmid_match(t, r)) + WRITE_ONCE(task_thread_info(t)->prefetch_dis, prefetch_dis); + } + + rcu_read_unlock(); + + smp_mb(); +} + +static ssize_t rdtgroup_prefetch_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + u32 prefetch_dis; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (!rdtgrp) { + rdtgroup_kn_unlock(of->kn); + return -ENOENT; + } + rdt_last_cmd_clear(); + + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED || + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) { + ret = -EINVAL; + rdt_last_cmd_puts("Pseudo-locking in progress\n"); + goto unlock; + } + + if (kstrtou32(buf, 0, &prefetch_dis)) { + rdt_last_cmd_printf("Task list parsing error prefetch %s\n", buf); + ret = -EINVAL; + goto unlock; + } + + if (rdtgrp->prefetch_dis != prefetch_dis) { + rdtgrp->prefetch_dis = prefetch_dis; + update_prefetch_tasks(rdtgrp, prefetch_dis); + } + +unlock: + rdtgroup_kn_unlock(of->kn); + + return ret ?: nbytes; +} + +static int rdtgroup_prefetch_show(struct kernfs_open_file *of, + struct seq_file *s, void *v) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (rdtgrp) + seq_printf(s, "%u\n", rdtgrp->prefetch_dis); + else + ret = -ENOENT; + rdtgroup_kn_unlock(of->kn); + + return ret; +} + static int rdtgroup_closid_show(struct kernfs_open_file *of, struct seq_file *s, void *v) { @@ -1891,6 +1961,14 @@ static struct rftype res_common_files[] = { .seq_show = rdtgroup_tasks_show, .fflags = RFTYPE_BASE, }, + { + .name = "prefetch_dis", + .mode = 0644, + .kf_ops = &rdtgroup_kf_single_ops, + .write = rdtgroup_prefetch_write, + .seq_show = rdtgroup_prefetch_show, + .fflags = RFTYPE_BASE, + }, { .name = "mon_hw_id", .mode = 0444, -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1497/1497] kernel/sched/.tmp_debug.o: warning: objtool: missing symbol for section .text.unlikely
by kernel test robot 17 Mar '25

17 Mar '25

Hi Qiang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a91497a471caf8cc4af64a68492be62ec9568f7e commit: acfa0f545c7dd43f959c28e8ab4b139c927ba387 [1497/1497] svm: reduce log of run queue and atomic->atomic64 config: x86_64-buildonly-randconfig-005-20250317 (https://download.01.org/0day-ci/archive/20250317/202503171950.PEaY4TuS-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250317/202503171950.PEaY4TuS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503171950.PEaY4TuS-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/sched/debug.c:797:6: warning: no previous prototype for 'sysrq_sched_debug_tidy' [-Wmissing-prototypes] 797 | void sysrq_sched_debug_tidy(void) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/.tmp_debug.o: warning: objtool: missing symbol for section .text.unlikely -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ext4: fix race condition between ext4_write and ext4_convert_inline_data
by Zizhi Wo 17 Mar '25

17 Mar '25

From: Baokun Li <libaokun1(a)huawei.com> stable inclusion from stable-v5.4.207 commit 18881d7e517169193d9ef6c89c7f322e3e164277 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2JS CVE: CVE-2022-49414 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f87c7a4b084afc13190cbb263538e444cb2b392a upstream. Hulk Robot reported a BUG_ON: ================================================================== EXT4-fs error (device loop3): ext4_mb_generate_buddy:805: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free clusters kernel BUG at fs/ext4/ext4_jbd2.c:53! invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 25371 Comm: syz-executor.3 Not tainted 5.10.0+ #1 RIP: 0010:ext4_put_nojournal fs/ext4/ext4_jbd2.c:53 [inline] RIP: 0010:__ext4_journal_stop+0x10e/0x110 fs/ext4/ext4_jbd2.c:116 [...] Call Trace: ext4_write_inline_data_end+0x59a/0x730 fs/ext4/inline.c:795 generic_perform_write+0x279/0x3c0 mm/filemap.c:3344 ext4_buffered_write_iter+0x2e3/0x3d0 fs/ext4/file.c:270 ext4_file_write_iter+0x30a/0x11c0 fs/ext4/file.c:520 do_iter_readv_writev+0x339/0x3c0 fs/read_write.c:732 do_iter_write+0x107/0x430 fs/read_write.c:861 vfs_writev fs/read_write.c:934 [inline] do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ================================================================== Above issue may happen as follows: cpu1 cpu2 __________________________|__________________________ do_pwritev vfs_writev do_iter_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_destroy_inline_data_nolock clear EXT4_STATE_MAY_INLINE_DATA ext4_map_blocks ext4_ext_map_blocks ext4_mb_new_blocks ext4_mb_regular_allocator ext4_mb_good_group_nolock ext4_mb_init_group ext4_mb_init_cache ext4_mb_generate_buddy --> error ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_restore_inline_data set EXT4_STATE_MAY_INLINE_DATA ext4_block_write_begin ext4_da_write_end ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_write_inline_data_end handle=NULL ext4_journal_stop(handle) __ext4_journal_stop ext4_put_nojournal(handle) ref_cnt = (unsigned long)handle BUG_ON(ref_cnt == 0) ---> BUG_ON The lock held by ext4_convert_inline_data is xattr_sem, but the lock held by generic_perform_write is i_rwsem. Therefore, the two locks can be concurrent. To solve above issue, we add inode_lock() for ext4_convert_inline_data(). At the same time, move ext4_convert_inline_data() in front of ext4_punch_hole(), remove similar handling from ext4_punch_hole(). Fixes: 0c8d414f163f ("ext4: let fallocate handle inline data correctly") Cc: stable(a)vger.kernel.org Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20220428134031.4153381-1-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/extents.c | 8 +++++--- fs/ext4/inode.c | 9 --------- 2 files changed, 5 insertions(+), 12 deletions(-) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index a317a74bf617..9b1156cd68d8 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -5083,13 +5083,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) FALLOC_FL_INSERT_RANGE)) return -EOPNOTSUPP; - if (mode & FALLOC_FL_PUNCH_HOLE) - return ext4_punch_hole(inode, offset, len); - + inode_lock(inode); ret = ext4_convert_inline_data(inode); + inode_unlock(inode); if (ret) return ret; + if (mode & FALLOC_FL_PUNCH_HOLE) + return ext4_punch_hole(inode, offset, len); + if (mode & FALLOC_FL_COLLAPSE_RANGE) return ext4_collapse_range(inode, offset, len); diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 6578d33b62d6..61c07bbeba03 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4294,15 +4294,6 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) trace_ext4_punch_hole(inode, offset, length, 0); - ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); - if (ext4_has_inline_data(inode)) { - down_write(&EXT4_I(inode)->i_mmap_sem); - ret = ext4_convert_inline_data(inode); - up_write(&EXT4_I(inode)->i_mmap_sem); - if (ret) - return ret; - } - /* * Write out all dirty pages to avoid race conditions * Then release them. -- 2.46.1

2 1

[openeuler:OLK-5.10 2815/2815] ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined
by kernel test robot 17 Mar '25

17 Mar '25

Hi Sean, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: a348aa0315d2a90cde93df922b84ab682459a834 commit: 5476cb89ef2297bd36f8b38e27b54617b6f63236 [2815/2815] x86/vdso: Implement a vDSO for Intel SGX enclave call config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20250317/202503171920.f4jVchcy-lkp@…) compiler: clang version 20.1.0 (https://github.com/llvm/llvm-project 24a30daaa559829ad079f2ff7f73eb4e18095f88) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250317/202503171920.f4jVchcy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503171920.f4jVchcy-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: version script assignment of 'LINUX_2.6' to symbol '__vdso_sgx_enter_enclave' failed: symbol not defined >> llvm-objdump: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory -- >> llvm-objcopy: error: 'arch/x86/entry/vdso/vdso64.so.dbg': No such file or directory -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
by Liu Chuang 17 Mar '25

17 Mar '25

From: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> stable inclusion from stable-v4.19.238 commit 60e5d391805d70458a01998de00d0c28cba40bf3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6H5 CVE: CVE-2022-49248 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------- [ Upstream commit bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d ] AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") while 'deferrable' flag can be uninitialized for non-control/notify AV/C transactions. UBSAN reports it: kernel: ================================================================================ kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9 kernel: load of value 158 is not a valid value for type '_Bool' kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P OE 5.15.0-18-generic #18-Ubuntu kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019 kernel: Call Trace: kernel: <IRQ> kernel: show_stack+0x52/0x58 kernel: dump_stack_lvl+0x4a/0x5f kernel: dump_stack+0x10/0x12 kernel: ubsan_epilogue+0x9/0x45 kernel: __ubsan_handle_load_invalid_value.cold+0x44/0x49 kernel: fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib] kernel: fcp_response+0x28/0x30 [snd_firewire_lib] kernel: fw_core_handle_request+0x230/0x3d0 [firewire_core] kernel: handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? transmit_complete_callback+0x9f/0x120 [firewire_core] kernel: ar_context_tasklet+0xa8/0x2e0 [firewire_ohci] kernel: tasklet_action_common.constprop.0+0xea/0xf0 kernel: tasklet_action+0x22/0x30 kernel: __do_softirq+0xd9/0x2e3 kernel: ? irq_finalize_oneshot.part.0+0xf0/0xf0 kernel: do_softirq+0x75/0xa0 kernel: </IRQ> kernel: <TASK> kernel: __local_bh_enable_ip+0x50/0x60 kernel: irq_forced_thread_fn+0x7e/0x90 kernel: irq_thread+0xba/0x190 kernel: ? irq_thread_fn+0x60/0x60 kernel: kthread+0x11e/0x140 kernel: ? irq_thread_check_affinity+0xf0/0xf0 kernel: ? set_kthread_struct+0x50/0x50 kernel: ret_from_fork+0x22/0x30 kernel: </TASK> kernel: ================================================================================ This commit fixes the bug. The bug has no disadvantage for the non- control/notify AV/C transactions since the flag has an effect for AV/C response with INTERIM (0x0f) status which is not used for the transactions in AV/C general specification. Fixes: 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> Link: https://lore.kernel.org/r/20220304125647.78430-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- sound/firewire/fcp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c index 61dda828f767..c8fbb54269cb 100644 --- a/sound/firewire/fcp.c +++ b/sound/firewire/fcp.c @@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit, t.response_match_bytes = response_match_bytes; t.state = STATE_PENDING; init_waitqueue_head(&t.wait); - - if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03) - t.deferrable = true; + t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03); spin_lock_irq(&transactions_lock); list_add_tail(&t.list, &transactions); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
by Liu Chuang 17 Mar '25

17 Mar '25

From: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> stable inclusion from stable-v4.19.238 commit 60e5d391805d70458a01998de00d0c28cba40bf3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6H5 CVE: CVE-2022-49248 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------- [ Upstream commit bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d ] AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") while 'deferrable' flag can be uninitialized for non-control/notify AV/C transactions. UBSAN reports it: kernel: ================================================================================ kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9 kernel: load of value 158 is not a valid value for type '_Bool' kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P OE 5.15.0-18-generic #18-Ubuntu kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019 kernel: Call Trace: kernel: <IRQ> kernel: show_stack+0x52/0x58 kernel: dump_stack_lvl+0x4a/0x5f kernel: dump_stack+0x10/0x12 kernel: ubsan_epilogue+0x9/0x45 kernel: __ubsan_handle_load_invalid_value.cold+0x44/0x49 kernel: fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib] kernel: fcp_response+0x28/0x30 [snd_firewire_lib] kernel: fw_core_handle_request+0x230/0x3d0 [firewire_core] kernel: handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? transmit_complete_callback+0x9f/0x120 [firewire_core] kernel: ar_context_tasklet+0xa8/0x2e0 [firewire_ohci] kernel: tasklet_action_common.constprop.0+0xea/0xf0 kernel: tasklet_action+0x22/0x30 kernel: __do_softirq+0xd9/0x2e3 kernel: ? irq_finalize_oneshot.part.0+0xf0/0xf0 kernel: do_softirq+0x75/0xa0 kernel: </IRQ> kernel: <TASK> kernel: __local_bh_enable_ip+0x50/0x60 kernel: irq_forced_thread_fn+0x7e/0x90 kernel: irq_thread+0xba/0x190 kernel: ? irq_thread_fn+0x60/0x60 kernel: kthread+0x11e/0x140 kernel: ? irq_thread_check_affinity+0xf0/0xf0 kernel: ? set_kthread_struct+0x50/0x50 kernel: ret_from_fork+0x22/0x30 kernel: </TASK> kernel: ================================================================================ This commit fixes the bug. The bug has no disadvantage for the non- control/notify AV/C transactions since the flag has an effect for AV/C response with INTERIM (0x0f) status which is not used for the transactions in AV/C general specification. Fixes: 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> Link: https://lore.kernel.org/r/20220304125647.78430-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- sound/firewire/fcp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c index 61dda828f767..c8fbb54269cb 100644 --- a/sound/firewire/fcp.c +++ b/sound/firewire/fcp.c @@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit, t.response_match_bytes = response_match_bytes; t.state = STATE_PENDING; init_waitqueue_head(&t.wait); - - if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03) - t.deferrable = true; + t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03); spin_lock_irq(&transactions_lock); list_add_tail(&t.list, &transactions); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
by Liu Chuang 17 Mar '25

17 Mar '25

From: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> stable inclusion from stable-v4.19.238 commit 60e5d391805d70458a01998de00d0c28cba40bf3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6H5 CVE: CVE-2022-49248 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- [ Upstream commit bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d ] AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") while 'deferrable' flag can be uninitialized for non-control/notify AV/C transactions. UBSAN reports it: kernel: ================================================================================ kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9 kernel: load of value 158 is not a valid value for type '_Bool' kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P OE 5.15.0-18-generic #18-Ubuntu kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019 kernel: Call Trace: kernel: <IRQ> kernel: show_stack+0x52/0x58 kernel: dump_stack_lvl+0x4a/0x5f kernel: dump_stack+0x10/0x12 kernel: ubsan_epilogue+0x9/0x45 kernel: __ubsan_handle_load_invalid_value.cold+0x44/0x49 kernel: fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib] kernel: fcp_response+0x28/0x30 [snd_firewire_lib] kernel: fw_core_handle_request+0x230/0x3d0 [firewire_core] kernel: handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? transmit_complete_callback+0x9f/0x120 [firewire_core] kernel: ar_context_tasklet+0xa8/0x2e0 [firewire_ohci] kernel: tasklet_action_common.constprop.0+0xea/0xf0 kernel: tasklet_action+0x22/0x30 kernel: __do_softirq+0xd9/0x2e3 kernel: ? irq_finalize_oneshot.part.0+0xf0/0xf0 kernel: do_softirq+0x75/0xa0 kernel: </IRQ> kernel: <TASK> kernel: __local_bh_enable_ip+0x50/0x60 kernel: irq_forced_thread_fn+0x7e/0x90 kernel: irq_thread+0xba/0x190 kernel: ? irq_thread_fn+0x60/0x60 kernel: kthread+0x11e/0x140 kernel: ? irq_thread_check_affinity+0xf0/0xf0 kernel: ? set_kthread_struct+0x50/0x50 kernel: ret_from_fork+0x22/0x30 kernel: </TASK> kernel: ================================================================================ This commit fixes the bug. The bug has no disadvantage for the non- control/notify AV/C transactions since the flag has an effect for AV/C response with INTERIM (0x0f) status which is not used for the transactions in AV/C general specification. Fixes: 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") Signed-off-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> Link: https://lore.kernel.org/r/20220304125647.78430-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- sound/firewire/fcp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c index 61dda828f767..c8fbb54269cb 100644 --- a/sound/firewire/fcp.c +++ b/sound/firewire/fcp.c @@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit, t.response_match_bytes = response_match_bytes; t.state = STATE_PENDING; init_waitqueue_head(&t.wait); - - if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03) - t.deferrable = true; + t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03); spin_lock_irq(&transactions_lock); list_add_tail(&t.list, &transactions); -- 2.34.1

2 1

[PATCH OLK-6.6] media: uvcvideo: Fix crash during unbind if gpio unit is in use
by Zhang Kunbo 17 Mar '25

17 Mar '25

From: Ricardo Ribalda <ribalda(a)chromium.org> stable inclusion from stable-v6.6.78 commit 0b5e0445bc8384c18bd35cb9fe87f6258c6271d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED4 CVE: CVE-2024-58079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5 upstream. We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device. If we unbind the driver from the usb interface, the cleanup functions are never called. In our case, the IRQ is never disabled. If an IRQ is triggered, it will try to access memory sections that are already free, causing an OOPS. We cannot use the function devm_request_threaded_irq here. The devm_* clean functions may be called after the main structure is released by uvc_delete. Luckily this bug has small impact, as it is only affected by devices with gpio units and the user has to unbind the device, a disconnect will not trigger this error. Cc: stable(a)vger.kernel.org Fixes: 2886477ff987 ("media: uvcvideo: Implement UVC_EXT_GPIO_UNIT") Reviewed-by: Sergey Senozhatsky <senozhatsky(a)chromium.org> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://lore.kernel.org/r/20241106-uvc-crashrmmod-v6-1-fbf9781c6e83@chromiu… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/usb/uvc/uvc_driver.c [ context conflicts. 0a56f698623f has not been merged. ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/media/usb/uvc/uvc_driver.c | 28 +++++++++++++++++++++------- drivers/media/usb/uvc/uvcvideo.h | 1 + 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 1b05890f99f4..8467f6329fd6 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1295,14 +1295,14 @@ static int uvc_gpio_parse(struct uvc_device *dev) struct gpio_desc *gpio_privacy; int irq; - gpio_privacy = devm_gpiod_get_optional(&dev->udev->dev, "privacy", + gpio_privacy = devm_gpiod_get_optional(&dev->intf->dev, "privacy", GPIOD_IN); if (IS_ERR_OR_NULL(gpio_privacy)) return PTR_ERR_OR_ZERO(gpio_privacy); irq = gpiod_to_irq(gpio_privacy); if (irq < 0) - return dev_err_probe(&dev->udev->dev, irq, + return dev_err_probe(&dev->intf->dev, irq, "No IRQ for privacy GPIO\n"); unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT, @@ -1329,15 +1329,27 @@ static int uvc_gpio_parse(struct uvc_device *dev) static int uvc_gpio_init_irq(struct uvc_device *dev) { struct uvc_entity *unit = dev->gpio_unit; + int ret; if (!unit || unit->gpio.irq < 0) return 0; - return devm_request_threaded_irq(&dev->udev->dev, unit->gpio.irq, NULL, - uvc_gpio_irq, - IRQF_ONESHOT | IRQF_TRIGGER_FALLING | - IRQF_TRIGGER_RISING, - "uvc_privacy_gpio", dev); + ret = request_threaded_irq(unit->gpio.irq, NULL, uvc_gpio_irq, + IRQF_ONESHOT | IRQF_TRIGGER_FALLING | + IRQF_TRIGGER_RISING, + "uvc_privacy_gpio", dev); + + unit->gpio.initialized = !ret; + + return ret; +} + +static void uvc_gpio_deinit(struct uvc_device *dev) +{ + if (!dev->gpio_unit || !dev->gpio_unit->gpio.initialized) + return; + + free_irq(dev->gpio_unit->gpio.irq, dev); } /* ------------------------------------------------------------------------ @@ -1934,6 +1946,8 @@ static void uvc_unregister_video(struct uvc_device *dev) { struct uvc_streaming *stream; + uvc_gpio_deinit(dev); + list_for_each_entry(stream, &dev->streams, list) { /* Nothing to do here, continue. */ if (!video_is_registered(&stream->vdev)) diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index e5b12717016f..997f4b5b5e22 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -229,6 +229,7 @@ struct uvc_entity { u8 *bmControls; struct gpio_desc *gpio_privacy; int irq; + bool initialized; } gpio; }; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1495/1495] drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c:119:6: sparse: sparse: symbol 'mlx5i_grp_sw_update_stats' was not declared. Should it be static?
by kernel test robot 16 Mar '25

16 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d734d6bbda17b68dd3979a9f707564a18cf04761 commit: 78ebe0ea5251a234cfc5ed00b0d196c74ee7b2e4 [1495/1495] net/mlx5e: IPoIB, Add ndo stats support for IPoIB netdevices config: x86_64-randconfig-123-20250316 (https://download.01.org/0day-ci/archive/20250316/202503162347.VAauKjgX-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250316/202503162347.VAauKjgX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503162347.VAauKjgX-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c:119:6: sparse: sparse: symbol 'mlx5i_grp_sw_update_stats' was not declared. Should it be static? drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c:119:6: warning: no previous prototype for 'mlx5i_grp_sw_update_stats' [-Wmissing-prototypes] 119 | void mlx5i_grp_sw_update_stats(struct mlx5e_priv *priv) | ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c:35: drivers/net/ethernet/mellanox/mlx5/core/en.h:208:19: warning: 'mlx5e_priv_flags' defined but not used [-Wunused-const-variable=] 208 | static const char mlx5e_priv_flags[][ETH_GSTRING_LEN] = { | ^~~~~~~~~~~~~~~~ vim +/mlx5i_grp_sw_update_stats +119 drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c 118 > 119 void mlx5i_grp_sw_update_stats(struct mlx5e_priv *priv) 120 { 121 struct mlx5e_sw_stats s = { 0 }; 122 int i, j; 123 124 for (i = 0; i < priv->profile->max_nch(priv->mdev); i++) { 125 struct mlx5e_channel_stats *channel_stats; 126 struct mlx5e_rq_stats *rq_stats; 127 128 channel_stats = &priv->channel_stats[i]; 129 rq_stats = &channel_stats->rq; 130 131 s.rx_packets += rq_stats->packets; 132 s.rx_bytes += rq_stats->bytes; 133 134 for (j = 0; j < priv->max_opened_tc; j++) { 135 struct mlx5e_sq_stats *sq_stats = &channel_stats->sq[j]; 136 137 s.tx_packets += sq_stats->packets; 138 s.tx_bytes += sq_stats->bytes; 139 s.tx_queue_dropped += sq_stats->dropped; 140 } 141 } 142 143 memcpy(&priv->stats.sw, &s, sizeof(s)); 144 } 145 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1495/1495] drivers/infiniband/hw/mlx5/devx.c:1111:1: sparse: sparse: symbol 'mlx5_ib_object_MLX5_IB_OBJECT_DEVX_UMEM' was not declared. Should it be static?
by kernel test robot 16 Mar '25

16 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d734d6bbda17b68dd3979a9f707564a18cf04761 commit: a18da41fb250cfa4191a98958bcd39df2111206f [1495/1495] RDMA/uverbs: Fix typo in string concatenation macro config: x86_64-randconfig-123-20250316 (https://download.01.org/0day-ci/archive/20250316/202503162045.rwTdUh4F-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250316/202503162045.rwTdUh4F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503162045.rwTdUh4F-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/infiniband/hw/mlx5/devx.c:1099:1: sparse: sparse: symbol 'mlx5_ib_object_MLX5_IB_OBJECT_DEVX' was not declared. Should it be static? drivers/infiniband/hw/mlx5/devx.c:1104:1: sparse: sparse: symbol 'mlx5_ib_object_MLX5_IB_OBJECT_DEVX_OBJ' was not declared. Should it be static? >> drivers/infiniband/hw/mlx5/devx.c:1111:1: sparse: sparse: symbol 'mlx5_ib_object_MLX5_IB_OBJECT_DEVX_UMEM' was not declared. Should it be static? -- >> drivers/infiniband/hw/mlx5/flow.c:236:1: sparse: sparse: symbol 'mlx5_ib_object_MLX5_IB_OBJECT_FLOW_MATCHER' was not declared. Should it be static? vim +/mlx5_ib_object_MLX5_IB_OBJECT_DEVX_UMEM +1111 drivers/infiniband/hw/mlx5/devx.c aeae94579caf774 Yishai Hadas 2018-06-17 988 9a119cd597769e0 Jason Gunthorpe 2018-07-04 989 DECLARE_UVERBS_NAMED_METHOD( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 990 MLX5_IB_METHOD_DEVX_UMEM_REG, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 991 UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_UMEM_REG_HANDLE, aeae94579caf774 Yishai Hadas 2018-06-17 992 MLX5_IB_OBJECT_DEVX_UMEM, aeae94579caf774 Yishai Hadas 2018-06-17 993 UVERBS_ACCESS_NEW, 83bb4442330f035 Jason Gunthorpe 2018-07-04 994 UA_MANDATORY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 995 UVERBS_ATTR_PTR_IN(MLX5_IB_ATTR_DEVX_UMEM_REG_ADDR, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 996 UVERBS_ATTR_TYPE(u64), 83bb4442330f035 Jason Gunthorpe 2018-07-04 997 UA_MANDATORY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 998 UVERBS_ATTR_PTR_IN(MLX5_IB_ATTR_DEVX_UMEM_REG_LEN, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 999 UVERBS_ATTR_TYPE(u64), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1000 UA_MANDATORY), bccd06223f21654 Jason Gunthorpe 2018-07-26 1001 UVERBS_ATTR_FLAGS_IN(MLX5_IB_ATTR_DEVX_UMEM_REG_ACCESS, bccd06223f21654 Jason Gunthorpe 2018-07-26 1002 enum ib_access_flags), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1003 UVERBS_ATTR_PTR_OUT(MLX5_IB_ATTR_DEVX_UMEM_REG_OUT_ID, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1004 UVERBS_ATTR_TYPE(u32), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1005 UA_MANDATORY)); aeae94579caf774 Yishai Hadas 2018-06-17 1006 528922afd41cdd1 Yishai Hadas 2018-07-08 1007 DECLARE_UVERBS_NAMED_METHOD_DESTROY( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1008 MLX5_IB_METHOD_DEVX_UMEM_DEREG, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1009 UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_UMEM_DEREG_HANDLE, aeae94579caf774 Yishai Hadas 2018-06-17 1010 MLX5_IB_OBJECT_DEVX_UMEM, aeae94579caf774 Yishai Hadas 2018-06-17 1011 UVERBS_ACCESS_DESTROY, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1012 UA_MANDATORY)); aeae94579caf774 Yishai Hadas 2018-06-17 1013 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1014 DECLARE_UVERBS_NAMED_METHOD( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1015 MLX5_IB_METHOD_DEVX_QUERY_EQN, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1016 UVERBS_ATTR_PTR_IN(MLX5_IB_ATTR_DEVX_QUERY_EQN_USER_VEC, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1017 UVERBS_ATTR_TYPE(u32), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1018 UA_MANDATORY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1019 UVERBS_ATTR_PTR_OUT(MLX5_IB_ATTR_DEVX_QUERY_EQN_DEV_EQN, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1020 UVERBS_ATTR_TYPE(u32), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1021 UA_MANDATORY)); f6fe01b7181be17 Yishai Hadas 2018-06-17 1022 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1023 DECLARE_UVERBS_NAMED_METHOD( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1024 MLX5_IB_METHOD_DEVX_QUERY_UAR, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1025 UVERBS_ATTR_PTR_IN(MLX5_IB_ATTR_DEVX_QUERY_UAR_USER_IDX, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1026 UVERBS_ATTR_TYPE(u32), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1027 UA_MANDATORY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1028 UVERBS_ATTR_PTR_OUT(MLX5_IB_ATTR_DEVX_QUERY_UAR_DEV_IDX, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1029 UVERBS_ATTR_TYPE(u32), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1030 UA_MANDATORY)); 7c043e908a74ae0 Yishai Hadas 2018-06-17 1031 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1032 DECLARE_UVERBS_NAMED_METHOD( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1033 MLX5_IB_METHOD_DEVX_OTHER, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1034 UVERBS_ATTR_PTR_IN( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1035 MLX5_IB_ATTR_DEVX_OTHER_CMD_IN, 8aa8c95ce4ccc10 Yishai Hadas 2018-06-17 1036 UVERBS_ATTR_MIN_SIZE(MLX5_ST_SZ_BYTES(general_obj_in_cmd_hdr)), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1037 UA_MANDATORY, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1038 UA_ALLOC_AND_COPY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1039 UVERBS_ATTR_PTR_OUT( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1040 MLX5_IB_ATTR_DEVX_OTHER_CMD_OUT, 8aa8c95ce4ccc10 Yishai Hadas 2018-06-17 1041 UVERBS_ATTR_MIN_SIZE(MLX5_ST_SZ_BYTES(general_obj_out_cmd_hdr)), 540cd69209682a3 Jason Gunthorpe 2018-07-04 1042 UA_MANDATORY)); 8aa8c95ce4ccc10 Yishai Hadas 2018-06-17 1043 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1044 DECLARE_UVERBS_NAMED_METHOD( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1045 MLX5_IB_METHOD_DEVX_OBJ_CREATE, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1046 UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_OBJ_CREATE_HANDLE, 7efce3691d33e1f Yishai Hadas 2018-06-17 1047 MLX5_IB_OBJECT_DEVX_OBJ, 7efce3691d33e1f Yishai Hadas 2018-06-17 1048 UVERBS_ACCESS_NEW, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1049 UA_MANDATORY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1050 UVERBS_ATTR_PTR_IN( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1051 MLX5_IB_ATTR_DEVX_OBJ_CREATE_CMD_IN, 7efce3691d33e1f Yishai Hadas 2018-06-17 1052 UVERBS_ATTR_MIN_SIZE(MLX5_ST_SZ_BYTES(general_obj_in_cmd_hdr)), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1053 UA_MANDATORY, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1054 UA_ALLOC_AND_COPY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1055 UVERBS_ATTR_PTR_OUT( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1056 MLX5_IB_ATTR_DEVX_OBJ_CREATE_CMD_OUT, 7efce3691d33e1f Yishai Hadas 2018-06-17 1057 UVERBS_ATTR_MIN_SIZE(MLX5_ST_SZ_BYTES(general_obj_out_cmd_hdr)), 540cd69209682a3 Jason Gunthorpe 2018-07-04 1058 UA_MANDATORY)); 7efce3691d33e1f Yishai Hadas 2018-06-17 1059 528922afd41cdd1 Yishai Hadas 2018-07-08 1060 DECLARE_UVERBS_NAMED_METHOD_DESTROY( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1061 MLX5_IB_METHOD_DEVX_OBJ_DESTROY, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1062 UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_OBJ_DESTROY_HANDLE, 7efce3691d33e1f Yishai Hadas 2018-06-17 1063 MLX5_IB_OBJECT_DEVX_OBJ, 7efce3691d33e1f Yishai Hadas 2018-06-17 1064 UVERBS_ACCESS_DESTROY, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1065 UA_MANDATORY)); 7efce3691d33e1f Yishai Hadas 2018-06-17 1066 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1067 DECLARE_UVERBS_NAMED_METHOD( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1068 MLX5_IB_METHOD_DEVX_OBJ_MODIFY, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1069 UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_OBJ_MODIFY_HANDLE, e662e14d801b01a Yishai Hadas 2018-06-17 1070 MLX5_IB_OBJECT_DEVX_OBJ, e662e14d801b01a Yishai Hadas 2018-06-17 1071 UVERBS_ACCESS_WRITE, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1072 UA_MANDATORY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1073 UVERBS_ATTR_PTR_IN( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1074 MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_IN, e662e14d801b01a Yishai Hadas 2018-06-17 1075 UVERBS_ATTR_MIN_SIZE(MLX5_ST_SZ_BYTES(general_obj_in_cmd_hdr)), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1076 UA_MANDATORY, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1077 UA_ALLOC_AND_COPY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1078 UVERBS_ATTR_PTR_OUT( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1079 MLX5_IB_ATTR_DEVX_OBJ_MODIFY_CMD_OUT, e662e14d801b01a Yishai Hadas 2018-06-17 1080 UVERBS_ATTR_MIN_SIZE(MLX5_ST_SZ_BYTES(general_obj_out_cmd_hdr)), 540cd69209682a3 Jason Gunthorpe 2018-07-04 1081 UA_MANDATORY)); e662e14d801b01a Yishai Hadas 2018-06-17 1082 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1083 DECLARE_UVERBS_NAMED_METHOD( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1084 MLX5_IB_METHOD_DEVX_OBJ_QUERY, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1085 UVERBS_ATTR_IDR(MLX5_IB_ATTR_DEVX_OBJ_QUERY_HANDLE, e662e14d801b01a Yishai Hadas 2018-06-17 1086 MLX5_IB_OBJECT_DEVX_OBJ, e662e14d801b01a Yishai Hadas 2018-06-17 1087 UVERBS_ACCESS_READ, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1088 UA_MANDATORY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1089 UVERBS_ATTR_PTR_IN( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1090 MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_IN, e662e14d801b01a Yishai Hadas 2018-06-17 1091 UVERBS_ATTR_MIN_SIZE(MLX5_ST_SZ_BYTES(general_obj_in_cmd_hdr)), 83bb4442330f035 Jason Gunthorpe 2018-07-04 1092 UA_MANDATORY, 83bb4442330f035 Jason Gunthorpe 2018-07-04 1093 UA_ALLOC_AND_COPY), 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1094 UVERBS_ATTR_PTR_OUT( 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1095 MLX5_IB_ATTR_DEVX_OBJ_QUERY_CMD_OUT, e662e14d801b01a Yishai Hadas 2018-06-17 1096 UVERBS_ATTR_MIN_SIZE(MLX5_ST_SZ_BYTES(general_obj_out_cmd_hdr)), 540cd69209682a3 Jason Gunthorpe 2018-07-04 1097 UA_MANDATORY)); e662e14d801b01a Yishai Hadas 2018-06-17 1098 6c61d2a55c4e598 Jason Gunthorpe 2018-07-04 1099 DECLARE_UVERBS_GLOBAL_METHODS(MLX5_IB_OBJECT_DEVX, 7c043e908a74ae0 Yishai Hadas 2018-06-17 1100 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_OTHER), f6fe01b7181be17 Yishai Hadas 2018-06-17 1101 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_QUERY_UAR), f6fe01b7181be17 Yishai Hadas 2018-06-17 1102 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_QUERY_EQN)); 8aa8c95ce4ccc10 Yishai Hadas 2018-06-17 1103 6c61d2a55c4e598 Jason Gunthorpe 2018-07-04 1104 DECLARE_UVERBS_NAMED_OBJECT(MLX5_IB_OBJECT_DEVX_OBJ, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1105 UVERBS_TYPE_ALLOC_IDR(devx_obj_cleanup), 7efce3691d33e1f Yishai Hadas 2018-06-17 1106 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_OBJ_CREATE), e662e14d801b01a Yishai Hadas 2018-06-17 1107 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_OBJ_DESTROY), e662e14d801b01a Yishai Hadas 2018-06-17 1108 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_OBJ_MODIFY), e662e14d801b01a Yishai Hadas 2018-06-17 1109 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_OBJ_QUERY)); 7efce3691d33e1f Yishai Hadas 2018-06-17 1110 6c61d2a55c4e598 Jason Gunthorpe 2018-07-04 @1111 DECLARE_UVERBS_NAMED_OBJECT(MLX5_IB_OBJECT_DEVX_UMEM, 9a119cd597769e0 Jason Gunthorpe 2018-07-04 1112 UVERBS_TYPE_ALLOC_IDR(devx_umem_cleanup), aeae94579caf774 Yishai Hadas 2018-06-17 1113 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_UMEM_REG), aeae94579caf774 Yishai Hadas 2018-06-17 1114 &UVERBS_METHOD(MLX5_IB_METHOD_DEVX_UMEM_DEREG)); aeae94579caf774 Yishai Hadas 2018-06-17 1115 :::::: The code at line 1111 was first introduced by commit :::::: 6c61d2a55c4e5980e231fac9bb54e6ff1a5e811b RDMA/uverbs: Simplify UVERBS_OBJECT and _TREE family of macros :::::: TO: Jason Gunthorpe <jgg(a)mellanox.com> :::::: CC: Jason Gunthorpe <jgg(a)mellanox.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] cpufreq: pmac32-cpufreq: Fix refcount leak bug
by Zhang Kunbo 16 Mar '25

16 Mar '25

From: Liang He <windhl(a)126.com> stable inclusion from stable-v4.19.253 commit 4585890ab2dbf455d80e254d3d859d4c1e357920 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6TT CVE: CVE-2022-49621 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ccd7567d4b6cf187fdfa55f003a9e461ee629e36 ] In pmac_cpufreq_init_MacRISC3(), we need to add corresponding of_node_put() for the three node pointers whose refcount have been incremented by of_find_node_by_name(). Signed-off-by: Liang He <windhl(a)126.com> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/cpufreq/pmac32-cpufreq.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/cpufreq/pmac32-cpufreq.c b/drivers/cpufreq/pmac32-cpufreq.c index e225edb5c359..ce0dda1a4241 100644 --- a/drivers/cpufreq/pmac32-cpufreq.c +++ b/drivers/cpufreq/pmac32-cpufreq.c @@ -474,6 +474,10 @@ static int pmac_cpufreq_init_MacRISC3(struct device_node *cpunode) if (slew_done_gpio_np) slew_done_gpio = read_gpio(slew_done_gpio_np); + of_node_put(volt_gpio_np); + of_node_put(freq_gpio_np); + of_node_put(slew_done_gpio_np); + /* If we use the frequency GPIOs, calculate the min/max speeds based * on the bus frequencies */ -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION d734d6bbda17b68dd3979a9f707564a18cf04761
by kernel test robot 16 Mar '25

16 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: d734d6bbda17b68dd3979a9f707564a18cf04761 !15448 vrf: use RCU protection in l3mdev_l3_out() Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503151948.7IasEYy9-lkp@intel.com arch/x86/kernel/apic/io_apic.o: warning: objtool: acpi_get_override_irq()+0x108: can't find switch jump table drivers/gpu/drm/amd/amdgpu/amdgpu_ids.o: warning: objtool: amdgpu_vmid_grab()+0xd3e: unreachable instruction drivers/media/i2c/adv7511-v4l2.o: warning: objtool: adv7511_set_fmt()+0x805: unreachable instruction drivers/media/radio/radio-trust.o: warning: objtool: missing symbol for section .init.text fs/debugfs/file.o: warning: objtool: full_proxy_open()+0x55a: unreachable instruction fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' mm/debug.c:143:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int' [-Wformat] mm/debug.c:175:18: warning: format specifies type 'unsigned long' but the argument has type 'const unsigned long *' [-Wformat] mm/debug.c:175:3: warning: format specifies type 'int' but the argument has type 'unsigned long' [-Wformat] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] mm/page_alloc.c:1645:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct deferred_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-strict] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/nvme/host/rdma.c:931 nvme_rdma_setup_ctrl() warn: missing error code 'ret' net/ipv4/tcp_ipv4.c:820 tcp_v4_send_ack() warn: variable dereferenced before check 'sk' (see line 817) net/netfilter/nft_counter.c:157:35: sparse: sparse: incorrect type in argument 1 (different address spaces) sound/isa/msnd/msnd_pinnacle.o: warning: objtool: snd_msnd_probe()+0xf7: can't find switch jump table Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250315 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250315 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250315 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250315 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-r062-20250316 | |-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-r113-20250316 | |-- drivers-crypto-s5p-sss.c:sparse:sparse:Variable-length-array-is-used. | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- net-netfilter-nft_counter.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-struct-nft_counter_percpu_priv-noderef-__percpu-priv-got-struct-nft_counter_percpu_priv-priv |-- arm64-randconfig-r132-20250309 | |-- drivers-net-ethernet-huawei-hinic-hinic_dbgtool_knl.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-short-usertype-out_size | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:sparse:sparse:symbol-__set_cos_up_map-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:sparse:sparse:symbol-hinic_dcb_config_init-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:sparse:sparse:symbol-hinic_dcbnl_set_all-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:sparse:sparse:symbol-hinic_set_prio_tc_map-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-assigned-dwqe_mapping-got-void-noderef-__iomem-dwqe_mapping | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-manufacture_id-got-restricted-__be32-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-reason_code-got-restricted-__be16-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-resp_code-got-restricted-__be16-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:symbol-g_hinic_chip_list-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:symbol-hinic_event_process-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:symbol-hinic_get_ppf_hwdev_by_pdev-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:symbol-hinic_version_cmp-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_lld.c:sparse:sparse:symbol-ver_incompat_table-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_nictool.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-out_buf | |-- drivers-net-ethernet-huawei-hinic-hinic_qp.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-net-ethernet-huawei-hinic-hinic_qp.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-status-got-restricted-__be32-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_rx.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-addr_high-got-restricted-__be32-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_rx.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-addr_low-got-restricted-__be32-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_rx.c:sparse:sparse:symbol-hinic_rx_free_buffers-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_rx.c:sparse:sparse:symbol-rx_pass_super_cqe-was-not-declared.-Should-it-be-static | |-- drivers-net-ethernet-huawei-hinic-hinic_tx.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-net-ethernet-huawei-hinic-hinic_tx.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-hi_addr-got-restricted-__be32-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_tx.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-len-got-restricted-__be32-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_tx.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-lo_addr-got-restricted-__be32-usertype | |-- drivers-net-ethernet-huawei-hinic-hinic_tx.c:sparse:sparse:symbol-hinic_setup_tx_wqe-was-not-declared.-Should-it-be-static | `-- drivers-net-ethernet-huawei-hinic-hinic_tx.c:sparse:sparse:symbol-hinic_stop_sq-was-not-declared.-Should-it-be-static |-- x86_64-allnoconfig | |-- Makefile:include-config-auto.conf.cmd:No-such-file-or-directory | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250315 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-002-20250315 | |-- drivers-media-radio-radio-trust.o:warning:objtool:missing-symbol-for-section-.init.text | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250207 | `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- x86_64-buildonly-randconfig-003-20250217 | `-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- x86_64-buildonly-randconfig-003-20250315 | |-- arch-x86-kernel-apic-io_apic.o:warning:objtool:acpi_get_override_irq:can-t-find-switch-jump-table | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- sound-isa-msnd-msnd_pinnacle.o:warning:objtool:snd_msnd_probe:can-t-find-switch-jump-table |-- x86_64-buildonly-randconfig-004-20250102 | `-- drivers-media-i2c-adv7511-v4l2.o:warning:objtool:adv7511_set_fmt:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20250315 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20241216 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250315 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250315 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-defconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-101-20241223 | `-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction |-- x86_64-randconfig-101-20250316 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-102-20250103 | `-- drivers-acpi-cppc_acpi.c:WARNING:NULL-check-before-some-freeing-functions-is-not-needed. |-- x86_64-randconfig-102-20250316 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-103-20241218 | `-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace |-- x86_64-randconfig-103-20250219 | |-- kernel-sched-debug.c:error:no-member-named-nr_wakeups_force_preferred_cpus-in-struct-dyn_affinity_stats | `-- kernel-sched-debug.c:error:no-member-named-nr_wakeups_preferred_cpus-in-struct-dyn_affinity_stats |-- x86_64-randconfig-103-20250305 | `-- drivers-gpu-drm-amd-amdgpu-amdgpu_ids.o:warning:objtool:amdgpu_vmid_grab:unreachable-instruction |-- x86_64-randconfig-103-20250316 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-104-20250316 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-121-20250316 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-122-20241226 | `-- fs-debugfs-file.o:warning:objtool:full_proxy_open:unreachable-instruction |-- x86_64-randconfig-122-20250309 | `-- drivers-net-tun.c:sparse:sparse:incompatible-types-in-comparison-expression-(different-address-spaces): |-- x86_64-randconfig-122-20250316 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-123-20250316 | |-- drivers-net-dsa-bcm_sf2_cfp.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-restricted-__be16-usertype-got-unsigned-int | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-161-20250313 | |-- drivers-nvme-host-rdma.c-nvme_rdma_setup_ctrl()-warn:missing-error-code-ret | `-- net-ipv4-tcp_ipv4.c-tcp_v4_send_ack()-warn:variable-dereferenced-before-check-sk-(see-line-) |-- x86_64-randconfig-161-20250316 | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-randconfig-r052-20250316 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-randconfig-r112-20250311 |-- mm-debug.c:warning:format-specifies-type-int-but-the-argument-has-type-unsigned-long |-- mm-debug.c:warning:format-specifies-type-unsigned-long-but-the-argument-has-type-const-unsigned-long |-- mm-debug.c:warning:format-specifies-type-void-but-the-argument-has-type-int `-- mm-debug.c:warning:more-conversions-than-data-arguments elapsed time: 1448m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250315 gcc-14.2.0 arm64 randconfig-002-20250315 gcc-14.2.0 arm64 randconfig-003-20250315 gcc-14.2.0 arm64 randconfig-004-20250315 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250315 gcc-12 x86_64 buildonly-randconfig-002-20250315 clang-19 x86_64 buildonly-randconfig-003-20250315 clang-19 x86_64 buildonly-randconfig-004-20250315 clang-19 x86_64 buildonly-randconfig-005-20250315 clang-19 x86_64 buildonly-randconfig-006-20250315 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0