- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/5] Support pv-spinlock feature
by lishusen 16 Mar '25

16 Mar '25

Support pv-spinlock feature to improved spin lock performance for performance tuning. Zengruan Ye (5): KVM: arm64: Add SMCCC PV-sched to kick cpu KVM: arm64: Implement PV_SCHED_KICK_CPU call KVM: arm64: Add interface to support PV qspinlock KVM: arm64: Enable PV qspinlock KVM: arm64: Add tracepoints for PV qspinlock Documentation/virt/kvm/arm/pvsched.rst | 16 +++++ arch/arm64/Kconfig | 13 ++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/asm/paravirt.h | 37 ++++++++++ arch/arm64/include/asm/qspinlock.h | 40 ++++++++++- arch/arm64/include/asm/qspinlock_paravirt.h | 12 ++++ arch/arm64/include/asm/spinlock.h | 3 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/paravirt-spinlocks.c | 5 ++ arch/arm64/kernel/paravirt.c | 78 +++++++++++++++++++++ arch/arm64/kernel/trace-paravirt.h | 66 +++++++++++++++++ arch/arm64/kvm/arm.c | 4 +- arch/arm64/kvm/handle_exit.c | 1 + arch/arm64/kvm/hypercalls.c | 3 + arch/arm64/kvm/pvsched.c | 28 ++++++++ arch/arm64/kvm/trace_arm.h | 18 +++++ include/linux/arm-smccc.h | 6 ++ 18 files changed, 332 insertions(+), 2 deletions(-) create mode 100644 arch/arm64/include/asm/qspinlock_paravirt.h create mode 100644 arch/arm64/kernel/trace-paravirt.h -- 2.33.0

2 6

[PATCH OLK-6.6 0/5] Support pv-spinlock feature
by lishusen 16 Mar '25

16 Mar '25

Support pv-spinlock feature to improved spin lock performance for performance tuning. Zengruan Ye (5): KVM: arm64: Add SMCCC PV-sched to kick cpu KVM: arm64: Implement PV_SCHED_KICK_CPU call KVM: arm64: Add interface to support PV qspinlock KVM: arm64: Enable PV qspinlock KVM: arm64: Add tracepoints for PV qspinlock Documentation/virt/kvm/arm/pvsched.rst | 16 +++++ arch/arm64/Kconfig | 13 ++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/asm/paravirt.h | 37 ++++++++++ arch/arm64/include/asm/qspinlock.h | 35 +++++++++ arch/arm64/include/asm/qspinlock_paravirt.h | 12 ++++ arch/arm64/include/asm/spinlock.h | 3 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/paravirt-spinlocks.c | 5 ++ arch/arm64/kernel/paravirt.c | 78 +++++++++++++++++++++ arch/arm64/kernel/trace-paravirt.h | 66 +++++++++++++++++ arch/arm64/kvm/arm.c | 4 +- arch/arm64/kvm/handle_exit.c | 1 + arch/arm64/kvm/hypercalls.c | 3 + arch/arm64/kvm/pvsched.c | 28 ++++++++ arch/arm64/kvm/trace_arm.h | 18 +++++ include/linux/arm-smccc.h | 6 ++ 18 files changed, 328 insertions(+), 1 deletion(-) create mode 100644 arch/arm64/include/asm/qspinlock_paravirt.h create mode 100644 arch/arm64/kernel/trace-paravirt.h -- 2.33.0

2 6

[openeuler:openEuler-1.0-LTS 1473/1473] drivers/net/ethernet/huawei/hinic/hinic_lld.c:142:1: sparse: sparse: symbol 'g_hinic_chip_list' was not declared. Should it be static?
by kernel test robot 16 Mar '25

16 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d734d6bbda17b68dd3979a9f707564a18cf04761 commit: 6cb2e756917d122560e0c52f350682760d004eec [1473/1473] net: hinic: Add NIC Layer config: arm64-randconfig-r132-20250309 (https://download.01.org/0day-ci/archive/20250316/202503161041.eseBkXZW-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250316/202503161041.eseBkXZW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503161041.eseBkXZW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:142:1: sparse: sparse: symbol 'g_hinic_chip_list' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_lld.c:158:23: sparse: sparse: symbol 'g_lld_lock' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:484:31: sparse: sparse: symbol 'ver_incompat_table' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:529:5: sparse: sparse: symbol 'hinic_version_cmp' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:754:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] manufacture_id @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:754:29: sparse: expected unsigned int [usertype] manufacture_id drivers/net/ethernet/huawei/hinic/hinic_lld.c:754:29: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:755:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] resp_code @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:755:24: sparse: expected unsigned short [usertype] resp_code drivers/net/ethernet/huawei/hinic/hinic_lld.c:755:24: sparse: got restricted __be16 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:756:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] reason_code @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:756:26: sparse: expected unsigned short [usertype] reason_code drivers/net/ethernet/huawei/hinic/hinic_lld.c:756:26: sparse: got restricted __be16 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:801:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:801:16: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:801:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:802:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:802:16: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:802:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:803:16: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:803:16: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:803:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:804:14: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:804:14: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:804:14: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:842:52: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] ifa_address @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:842:52: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_lld.c:842:52: sparse: got restricted __be32 [usertype] ifa_address drivers/net/ethernet/huawei/hinic/hinic_lld.c:881:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] ip_cnt @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:881:25: sparse: expected unsigned short [usertype] ip_cnt drivers/net/ethernet/huawei/hinic/hinic_lld.c:881:25: sparse: got restricted __be16 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:1268:6: sparse: sparse: symbol 'hinic_get_ppf_hwdev_by_pdev' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:1539:19: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:1781:57: sparse: sparse: Using plain integer as NULL pointer >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:1824:6: sparse: sparse: symbol 'hinic_event_process' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_lld.c:2203:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[assigned] cfg_reg_base @@ got void [noderef] __iomem *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:2203:32: sparse: expected void *[assigned] cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2203:32: sparse: got void [noderef] __iomem *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2204:33: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[assigned] intr_reg_base @@ got void [noderef] __iomem *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:2204:33: sparse: expected void *[assigned] intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2204:33: sparse: got void [noderef] __iomem *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2205:27: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[assigned] db_base @@ got void [noderef] __iomem *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:2205:27: sparse: expected void *[assigned] db_base drivers/net/ethernet/huawei/hinic/hinic_lld.c:2205:27: sparse: got void [noderef] __iomem *db_base >> drivers/net/ethernet/huawei/hinic/hinic_lld.c:2207:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *[assigned] dwqe_mapping @@ got void [noderef] __iomem *dwqe_mapping @@ drivers/net/ethernet/huawei/hinic/hinic_lld.c:2207:32: sparse: expected void *[assigned] dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_lld.c:2207:32: sparse: got void [noderef] __iomem *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_lld.c:529:5: warning: no previous prototype for 'hinic_version_cmp' [-Wmissing-prototypes] 529 | int hinic_version_cmp(char *ver1, char *ver2) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1268:7: warning: no previous prototype for 'hinic_get_ppf_hwdev_by_pdev' [-Wmissing-prototypes] 1268 | void *hinic_get_ppf_hwdev_by_pdev(struct pci_dev *pdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1390:5: warning: no previous prototype for 'hinic_get_card_func_info_by_card_name' [-Wmissing-prototypes] 1390 | int hinic_get_card_func_info_by_card_name(char *chip_name, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_lld.c:1824:6: warning: no previous prototype for 'hinic_event_process' [-Wmissing-prototypes] 1824 | void hinic_event_process(void *adapter, struct hinic_event_info *event) | ^~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_qp.c:49:26: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:62:28: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:70:18: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_qp.c:85:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] status @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_qp.c:85:21: sparse: expected unsigned int [usertype] status drivers/net/ethernet/huawei/hinic/hinic_qp.c:85:21: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_qp.c:96:20: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:107:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:114:23: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:122:23: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_qp.c:191:33: sparse: sparse: cast to restricted __be32 -- >> drivers/net/ethernet/huawei/hinic/hinic_rx.c:152:44: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] addr_high @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_rx.c:152:44: sparse: expected unsigned int [usertype] addr_high drivers/net/ethernet/huawei/hinic/hinic_rx.c:152:44: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_rx.c:154:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] addr_low @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_rx.c:154:43: sparse: expected unsigned int [usertype] addr_low drivers/net/ethernet/huawei/hinic/hinic_rx.c:154:43: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_rx.c:174:6: sparse: sparse: symbol 'hinic_rx_free_buffers' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_rx.c:568:24: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_rx.c:606:6: sparse: sparse: symbol 'rx_pass_super_cqe' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_rx.c:680:26: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_rx.c:688:28: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_rx.c:689:28: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_rx.c:709:45: sparse: sparse: cast to restricted __be32 In file included from include/linux/sctp.h:57, from drivers/net/ethernet/huawei/hinic/hinic_rx.c:30: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:174:6: warning: no previous prototype for 'hinic_rx_free_buffers' [-Wmissing-prototypes] 174 | void hinic_rx_free_buffers(struct hinic_rxq *rxq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:548:5: warning: no previous prototype for 'recv_one_pkt' [-Wmissing-prototypes] 548 | int recv_one_pkt(struct hinic_rxq *rxq, struct hinic_rq_cqe *rx_cqe, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:606:6: warning: no previous prototype for 'rx_pass_super_cqe' [-Wmissing-prototypes] 606 | void rx_pass_super_cqe(struct hinic_rxq *rxq, u32 index, u32 pkt_num, | ^~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:593:35: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_tx.c:594:35: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_tx.c:595:35: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:1051:5: sparse: sparse: symbol 'hinic_setup_tx_wqe' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:1230:5: sparse: sparse: symbol 'hinic_stop_sq' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] hi_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: expected unsigned int [usertype] hi_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] lo_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: expected unsigned int [usertype] lo_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] len @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: expected unsigned int [usertype] len drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] hi_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: expected unsigned int [usertype] hi_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] lo_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: expected unsigned int [usertype] lo_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] len @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: expected unsigned int [usertype] len drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] hi_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: expected unsigned int [usertype] hi_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:109:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] lo_addr @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: expected unsigned int [usertype] lo_addr drivers/net/ethernet/huawei/hinic/hinic_tx.c:110:28: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] len @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: expected unsigned int [usertype] len drivers/net/ethernet/huawei/hinic/hinic_tx.c:111:25: sparse: got restricted __be32 [usertype] In file included from include/linux/sctp.h:57, from drivers/net/ethernet/huawei/hinic/hinic_tx.c:26: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:1051:5: warning: no previous prototype for 'hinic_setup_tx_wqe' [-Wmissing-prototypes] 1051 | int hinic_setup_tx_wqe(struct hinic_txq *txq) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:1230:5: warning: no previous prototype for 'hinic_stop_sq' [-Wmissing-prototypes] 1230 | int hinic_stop_sq(struct hinic_txq *txq) | ^~~~~~~~~~~~~ -- drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:65:7: sparse: sparse: symbol 'dbgtool_dev_id' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:66:13: sparse: sparse: symbol 'dbgtool_chr_dev' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:69:14: sparse: sparse: symbol 'dbgtool_d_class' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:72:5: sparse: sparse: symbol 'g_dbgtool_init_flag' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:73:5: sparse: sparse: symbol 'g_dbgtool_ref_cnt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:176:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got unsigned char [usertype] *cmd @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:176:51: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:176:51: sparse: got unsigned char [usertype] *cmd drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:190:44: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *ack @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:190:44: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:190:44: sparse: got void *ack drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:135:6: sparse: sparse: symbol 'dbgtool_knl_api_cmd_read' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:238:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got unsigned char [usertype] *cmd @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:238:51: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:238:51: sparse: got unsigned char [usertype] *cmd drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:207:6: sparse: sparse: symbol 'dbgtool_knl_api_cmd_write' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:339:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got struct pf_dev_info *dev_info @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:339:37: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:339:37: sparse: got struct pf_dev_info *dev_info drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:299:6: sparse: sparse: symbol 'dbgtool_knl_pf_dev_info_get' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:357:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got struct ffm_record_info *ffm_rd @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:357:37: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:357:37: sparse: got struct ffm_record_info *ffm_rd drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:353:6: sparse: sparse: symbol 'dbgtool_knl_ffm_info_rd' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:371:6: sparse: sparse: symbol 'dbgtool_knl_ffm_info_clr' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:423:54: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void *buf_in @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:423:54: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:423:54: sparse: got void *buf_in >> drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:446:44: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got unsigned short [usertype] *out_size @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:446:44: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:446:44: sparse: got unsigned short [usertype] *out_size drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:453:44: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *buf_out @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:453:44: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:453:44: sparse: got void *buf_out drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:386:6: sparse: sparse: symbol 'dbgtool_knl_msg_to_up' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:508:37: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:508:37: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:508:37: sparse: got void * drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:495:6: sparse: sparse: symbol 'dbgtool_knl_unlocked_ioctl' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:573:6: sparse: sparse: symbol 'ffm_intr_msg_record' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:135:6: warning: no previous prototype for 'dbgtool_knl_api_cmd_read' [-Wmissing-prototypes] 135 | long dbgtool_knl_api_cmd_read(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:207:6: warning: no previous prototype for 'dbgtool_knl_api_cmd_write' [-Wmissing-prototypes] 207 | long dbgtool_knl_api_cmd_write(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:299:6: warning: no previous prototype for 'dbgtool_knl_pf_dev_info_get' [-Wmissing-prototypes] 299 | long dbgtool_knl_pf_dev_info_get(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:353:6: warning: no previous prototype for 'dbgtool_knl_ffm_info_rd' [-Wmissing-prototypes] 353 | long dbgtool_knl_ffm_info_rd(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:371:6: warning: no previous prototype for 'dbgtool_knl_ffm_info_clr' [-Wmissing-prototypes] 371 | long dbgtool_knl_ffm_info_clr(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:386:6: warning: no previous prototype for 'dbgtool_knl_msg_to_up' [-Wmissing-prototypes] 386 | long dbgtool_knl_msg_to_up(struct dbgtool_param *para, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:495:6: warning: no previous prototype for 'dbgtool_knl_unlocked_ioctl' [-Wmissing-prototypes] 495 | long dbgtool_knl_unlocked_ioctl(struct file *pfile, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:573:6: warning: no previous prototype for 'ffm_intr_msg_record' [-Wmissing-prototypes] 573 | void ffm_intr_msg_record(void *handle, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:498: warning: Function parameter or member 'arg' not described in 'dbgtool_knl_unlocked_ioctl' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:575: warning: Function parameter or member 'in_size' not described in 'ffm_intr_msg_record' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:575: warning: Function parameter or member 'out_size' not described in 'ffm_intr_msg_record' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:664: warning: Function parameter or member 'vhwdev' not described in 'dbgtool_knl_init' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:664: warning: Excess function parameter 'hwdev' description in 'dbgtool_knl_init' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:792: warning: Function parameter or member 'vhwdev' not described in 'dbgtool_knl_deinit' drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c:792: warning: Excess function parameter 'hwdev' description in 'dbgtool_knl_deinit' -- drivers/net/ethernet/huawei/hinic/hinic_nictool.c:104:43: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void *in_buff @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:104:43: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_nictool.c:104:43: sparse: got void *in_buff >> drivers/net/ethernet/huawei/hinic/hinic_nictool.c:162:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:162:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:162:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1070:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1070:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1070:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1153:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1153:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1153:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1363:35: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1363:35: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1363:35: sparse: got void * drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1492:25: sparse: sparse: symbol 'sm_module_cmd_handle' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1663:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1663:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1663:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1750:32: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got void *out_buf @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1750:32: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1750:32: sparse: got void *out_buf drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1756:5: sparse: sparse: symbol 'send_to_service_driver' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1871:38: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1871:38: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1871:38: sparse: got void * drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1964:5: sparse: sparse: symbol 'if_nictool_exist' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1756:5: warning: no previous prototype for 'send_to_service_driver' [-Wmissing-prototypes] 1756 | int send_to_service_driver(struct msg_module *nt_msg, void *buf_in, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nictool.c:1964:5: warning: no previous prototype for 'if_nictool_exist' [-Wmissing-prototypes] 1964 | int if_nictool_exist(void) | ^~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:62:6: sparse: sparse: symbol 'hinic_dcb_config_init' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:226:6: sparse: sparse: symbol 'hinic_set_prio_tc_map' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:825:4: sparse: sparse: symbol 'hinic_dcbnl_set_all' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1059:5: sparse: sparse: symbol '__set_cos_up_map' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_dcb.c:62:6: warning: no previous prototype for 'hinic_dcb_config_init' [-Wmissing-prototypes] 62 | void hinic_dcb_config_init(struct hinic_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:226:6: warning: no previous prototype for 'hinic_set_prio_tc_map' [-Wmissing-prototypes] 226 | void hinic_set_prio_tc_map(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:825:4: warning: no previous prototype for 'hinic_dcbnl_set_all' [-Wmissing-prototypes] 825 | u8 hinic_dcbnl_set_all(struct net_device *netdev) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1059:5: warning: no previous prototype for '__set_cos_up_map' [-Wmissing-prototypes] 1059 | int __set_cos_up_map(struct hinic_nic_dev *nic_dev, u8 *cos_up) | ^~~~~~~~~~~~~~~~ vim +/g_hinic_chip_list +142 drivers/net/ethernet/huawei/hinic/hinic_lld.c 746ea35981b1f77 Xue 2019-01-30 139 746ea35981b1f77 Xue 2019-01-30 140 #define MAX_CARD_ID 64 746ea35981b1f77 Xue 2019-01-30 141 static u64 card_bit_map; 746ea35981b1f77 Xue 2019-01-30 @142 LIST_HEAD(g_hinic_chip_list); 746ea35981b1f77 Xue 2019-01-30 143 struct hinic_uld_info g_uld_info[SERVICE_T_MAX] = { {0} }; 746ea35981b1f77 Xue 2019-01-30 144 static const char *s_uld_name[SERVICE_T_MAX] = { 746ea35981b1f77 Xue 2019-01-30 145 "nic", "ovs", "roce", "toe", "iwarp", "fc", "fcoe", }; 746ea35981b1f77 Xue 2019-01-30 146 :::::: The code at line 142 was first introduced by commit :::::: 746ea35981b1f77e988d48642409d73f0470b3eb net: hinic: Add Hardware Abstract Layer :::::: TO: Xue <xuechaojing(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 15 Mar '25

15 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d734d6bbda17b68dd3979a9f707564a18cf04761 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250315/202503151948.7IasEYy9-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503151948.7IasEYy9-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 304c7f18d674a3cbb439f7ee346622b2e6c5bc9e
by kernel test robot 15 Mar '25

15 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 304c7f18d674a3cbb439f7ee346622b2e6c5bc9e !15421 [OLK-6.6] [Backport] upstream fix for driver nvme Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202503151158.xNxBbX1r-lkp@intel.com aarch64-linux-ld: Unexpected GOT/PLT entries detected! aarch64-linux-ld: Unexpected run-time procedure linkages detected! drivers/gpu/drm/sti/sti_dvo.c:531:21: error: implicit declaration of function 'devm_ioremap' [-Werror=implicit-function-declaration] include/linux/fortify-string.h:515:65: warning: left-hand operand of comma expression has no effect [-Wunused-value] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250314 | |-- aarch64-linux-ld:Unexpected-GOT-PLT-entries-detected | |-- aarch64-linux-ld:Unexpected-run-time-procedure-linkages-detected | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250315 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250315 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250315 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250315 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250315 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250314 | |-- drivers-gpu-drm-sti-sti_dvo.c:error:implicit-declaration-of-function-devm_ioremap | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250314 | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_ATTR_VALUE_UNDEFINED-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_BCN-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_ATTR_PG_TCS-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_HOST-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_VER_CEE-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_CAP_DCBX_VER_IEEE-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:DCB_NUMTCS_ATTR_PG-undeclared-(first-use-in-this-function) | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getcap | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getnumtcs | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpfccfg | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgbwgcfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-getpgtccfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_setets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-ieee_setpfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setdcbx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setnumtcs | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpfccfg | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpfcstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgbwgcfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgtccfgrx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setpgtccfgtx | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:const-struct-dcbnl_rtnl_ops-has-no-member-named-setstate | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-incomplete-type-struct-ieee_ets | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-application-of-sizeof-to-incomplete-type-struct-ieee_pfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:invalid-use-of-undefined-type-struct-ieee_pfc | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:storage-size-of-pfc-isn-t-known | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:variable-hinic_dcbnl_ops-has-initializer-but-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_dcb.c:error:variable-pfc-has-initializer-but-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_main.c:error:struct-net_device-has-no-member-named-dcbnl_ops | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_ets-has-incomplete-type | |-- drivers-net-ethernet-huawei-hinic-hinic_nic_dev.h:error:field-hinic_ieee_ets_default-has-incomplete-type | |-- include-linux-fortify-string.h:warning:left-hand-operand-of-comma-expression-has-no-effect | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250314 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-161-20250315 |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 1444m configs tested: 21 configs skipped: 124 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250314 gcc-14.2.0 arm64 randconfig-002-20250314 clang-21 arm64 randconfig-003-20250314 clang-15 arm64 randconfig-004-20250314 clang-21 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch defconfig gcc-14.2.0 loongarch randconfig-001-20250314 gcc-14.2.0 loongarch randconfig-002-20250314 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250314 clang-19 x86_64 buildonly-randconfig-002-20250314 clang-19 x86_64 buildonly-randconfig-003-20250314 gcc-12 x86_64 buildonly-randconfig-004-20250314 clang-19 x86_64 buildonly-randconfig-005-20250314 gcc-12 x86_64 buildonly-randconfig-006-20250314 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v3 0/3] CVE-2025-21816
by Xiongfeng Wang 15 Mar '25

15 Mar '25

Frederic Weisbecker (2): hrtimer: Report offline hrtimer enqueue hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 3 ++ kernel/time/hrtimer.c | 105 ++++++++++++++++++++++++++++++++-------- 2 files changed, 89 insertions(+), 19 deletions(-) -- 2.20.1

2 4

[PATCH openEuler-1.0-LTS] ath9k_htc: fix uninit value bugs
by He Yujie 15 Mar '25

15 Mar '25

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.238 commit ee4222052a76559c20e821bc3519cefb58b6d3e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2I0 CVE: CVE-2022-49235 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit d1e0df1c57bd30871dd1c855742a7c346dbca853 ] Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Reported-by: syzbot+f83a1df1ed4f67e8d8ad(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20220115122733.11160-1-paskripkin@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_hst.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index d091c8ebdcf0..18c9210b9424 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb, hdr->endpoint_id = epid; hdr->flags = flags; hdr->payload_len = cpu_to_be16(len); + memset(hdr->control, 0, sizeof(hdr->control)); status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb); @@ -271,6 +272,10 @@ int htc_connect_service(struct htc_target *target, conn_msg->dl_pipeid = endpoint->dl_pipeid; conn_msg->ul_pipeid = endpoint->ul_pipeid; + /* To prevent infoleak */ + conn_msg->svc_meta_len = 0; + conn_msg->pad = 0; + ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0); if (ret) goto err; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
by He Yujie 15 Mar '25

15 Mar '25

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> stable inclusion from stable-v4.19.238 commit db863ab2baf058ed05c7b723612e3c40c9dd6885 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3RP CVE: CVE-2022-49095 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 16ed828b872d12ccba8f07bcc446ae89ba662f9c ] The error handling path of the probe releases a resource that is not freed in the remove function. In some cases, a ioremap() must be undone. Add the missing iounmap() call in the remove function. Link: https://lore.kernel.org/r/247066a3104d25f9a05de8b3270fc3c848763bcc.16476732… Fixes: 45804fbb00ee ("[SCSI] 53c700: Amiga Zorro NCR53c710 SCSI") Reviewed-by: Geert Uytterhoeven <geert(a)linux-m68k.org> Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/scsi/zorro7xx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c index aff31991aea9..ee6d97473853 100644 --- a/drivers/scsi/zorro7xx.c +++ b/drivers/scsi/zorro7xx.c @@ -158,6 +158,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z) scsi_remove_host(host); NCR_700_release(host); + if (host->base > 0x01000000) + iounmap(hostdata->base); kfree(hostdata); free_irq(host->irq, host); zorro_release_device(z); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ath9k_htc: fix uninit value bugs
by He Yujie 15 Mar '25

15 Mar '25

From: Pavel Skripkin <paskripkin(a)gmail.com> stable inclusion from stable-v4.19.238 commit ee4222052a76559c20e821bc3519cefb58b6d3e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2I0 CVE: CVE-2022-49235 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… [ Upstream commit d1e0df1c57bd30871dd1c855742a7c346dbca853 ] Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Reported-by: syzbot+f83a1df1ed4f67e8d8ad(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20220115122733.11160-1-paskripkin@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_hst.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index d091c8ebdcf0..18c9210b9424 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb, hdr->endpoint_id = epid; hdr->flags = flags; hdr->payload_len = cpu_to_be16(len); + memset(hdr->control, 0, sizeof(hdr->control)); status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb); @@ -271,6 +272,10 @@ int htc_connect_service(struct htc_target *target, conn_msg->dl_pipeid = endpoint->dl_pipeid; conn_msg->ul_pipeid = endpoint->ul_pipeid; + /* To prevent infoleak */ + conn_msg->svc_meta_len = 0; + conn_msg->pad = 0; + ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0); if (ret) goto err; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] phy: qcom-qmp: fix struct clk leak on probe errors
by He Yujie 15 Mar '25

15 Mar '25

From: Johan Hovold <johan+linaro(a)kernel.org> stable inclusion from stable-v4.19.247 commit 621a4bcfb7aa031e7760d7b156bad7a45df58387 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2VQ CVE: CVE-2022-49397 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- commit f0a4bc38a12f5a0cc5ad68670d9480e91e6a94df upstream. Make sure to release the pipe clock reference in case of a late probe error (e.g. probe deferral). Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets") Cc: stable(a)vger.kernel.org # 4.12 Cc: Vivek Gautam <vivek.gautam(a)codeaurora.org> Reviewed-by: Bjorn Andersson <bjorn.andersson(a)linaro.org> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> Link: https://lore.kernel.org/r/20220427063243.32576-2-johan+linaro@kernel.org Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c index 4c470104a0d6..7971299e28c4 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp.c @@ -1466,7 +1466,7 @@ int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id) * all phys that don't need this. */ snprintf(prop_name, sizeof(prop_name), "pipe%d", id); - qphy->pipe_clk = of_clk_get_by_name(np, prop_name); + qphy->pipe_clk = devm_get_clk_from_child(dev, np, prop_name); if (IS_ERR(qphy->pipe_clk)) { if (qmp->cfg->type == PHY_TYPE_PCIE || qmp->cfg->type == PHY_TYPE_USB3) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: sfp: fix memory leak in sfp_probe()
by He Yujie 15 Mar '25

15 Mar '25

From: Jianglei Nie <niejianglei2021(a)163.com> stable inclusion from stable-v4.19.253 commit 1545bc727625ea6e8decd717e5d1e8cc704ccf8f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP27T CVE: CVE-2022-49619 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 0a18d802d65cf662644fd1d369c86d84a5630652 ] sfp_probe() allocates a memory chunk from sfp with sfp_alloc(). When devm_add_action() fails, sfp is not freed, which leads to a memory leak. We should use devm_add_action_or_reset() instead of devm_add_action(). Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Link: https://lore.kernel.org/r/20220629075550.2152003-1-niejianglei2021@163.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/net/phy/sfp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c index 998d08ae7431..ab89eb1a4b7f 100644 --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c @@ -1811,7 +1811,7 @@ static int sfp_probe(struct platform_device *pdev) platform_set_drvdata(pdev, sfp); - err = devm_add_action(sfp->dev, sfp_cleanup, sfp); + err = devm_add_action_or_reset(sfp->dev, sfp_cleanup, sfp); if (err < 0) return err; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] um: Fix out-of-bounds read in LDT setup
by Xiangwei Li 15 Mar '25

15 Mar '25

From: Vincent Whitchurch <vincent.whitchurch(a)axis.com> mainline inclusion from mainline-v5.19-rc1 commit 2a4a62a14be1947fa945c5c11ebf67326381a568 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP73Y CVE: CVE-2022-49395 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syscall_stub_data() expects the data_count parameter to be the number of longs, not bytes. ================================================================== BUG: KASAN: stack-out-of-bounds in syscall_stub_data+0x70/0xe0 Read of size 128 at addr 000000006411f6f0 by task swapper/1 CPU: 0 PID: 1 Comm: swapper Not tainted 5.18.0+ #18 Call Trace: show_stack.cold+0x166/0x2a7 __dump_stack+0x3a/0x43 dump_stack_lvl+0x1f/0x27 print_report.cold+0xdb/0xf81 kasan_report+0x119/0x1f0 kasan_check_range+0x3a3/0x440 memcpy+0x52/0x140 syscall_stub_data+0x70/0xe0 write_ldt_entry+0xac/0x190 init_new_ldt+0x515/0x960 init_new_context+0x2c4/0x4d0 mm_init.constprop.0+0x5ed/0x760 mm_alloc+0x118/0x170 0x60033f48 do_one_initcall+0x1d7/0x860 0x60003e7b kernel_init+0x6e/0x3d4 new_thread_handler+0x1e7/0x2c0 The buggy address belongs to stack of task swapper/1 and is located at offset 64 in frame: init_new_ldt+0x0/0x960 This frame has 2 objects: [32, 40) 'addr' [64, 80) 'desc' ================================================================== Fixes: 858259cf7d1c443c83 ("uml: maintain own LDT entries") Signed-off-by: Vincent Whitchurch <vincent.whitchurch(a)axis.com> Cc: stable(a)vger.kernel.org Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- arch/x86/um/ldt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/um/ldt.c b/arch/x86/um/ldt.c index 3ee234b6234d..255a44dd415a 100644 --- a/arch/x86/um/ldt.c +++ b/arch/x86/um/ldt.c @@ -23,9 +23,11 @@ static long write_ldt_entry(struct mm_id *mm_idp, int func, { long res; void *stub_addr; + + BUILD_BUG_ON(sizeof(*desc) % sizeof(long)); + res = syscall_stub_data(mm_idp, (unsigned long *)desc, - (sizeof(*desc) + sizeof(long) - 1) & - ~(sizeof(long) - 1), + sizeof(*desc) / sizeof(long), addr, &stub_addr); if (!res) { unsigned long args[] = { func, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
by Wang Zhaolong 15 Mar '25

15 Mar '25

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v5.18-rc1 commit 3cbf0e392f173ba0ce425968c8374a6aa3e90f2e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6A4 CVE: CVE-2021-47634 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------ Hulk Robot reported a KASAN report about use-after-free: ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0x13d/0x160 Read of size 8 at addr ffff888035e37d98 by task ubiattach/1385 [...] Call Trace: klist_dec_and_del+0xa7/0x4a0 klist_put+0xc7/0x1a0 device_del+0x4d4/0xed0 cdev_device_del+0x1a/0x80 ubi_attach_mtd_dev+0x2951/0x34b0 [ubi] ctrl_cdev_ioctl+0x286/0x2f0 [ubi] Allocated by task 1414: device_add+0x60a/0x18b0 cdev_device_add+0x103/0x170 ubi_create_volume+0x1118/0x1a10 [ubi] ubi_cdev_ioctl+0xb7f/0x1ba0 [ubi] Freed by task 1385: cdev_device_del+0x1a/0x80 ubi_remove_volume+0x438/0x6c0 [ubi] ubi_cdev_ioctl+0xbf4/0x1ba0 [ubi] [...] ================================================================== The lock held by ctrl_cdev_ioctl is ubi_devices_mutex, but the lock held by ubi_cdev_ioctl is ubi->device_mutex. Therefore, the two locks can be concurrent. ctrl_cdev_ioctl contains two operations: ubi_attach and ubi_detach. ubi_detach is bug-free because it uses reference counting to prevent concurrency. However, uif_init and uif_close in ubi_attach may race with ubi_cdev_ioctl. uif_init will race with ubi_cdev_ioctl as in the following stack. cpu1 cpu2 cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_add_volume // sysfs exist kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free ubi_free_volume cdev_del // double free cdev_device_del And uif_close will race with ubi_cdev_ioctl as in the following stack. cpu1 cpu2 cpu3 _______________________|________________________|______________________ ctrl_cdev_ioctl ubi_attach_mtd_dev uif_init ubi_cdev_ioctl ubi_create_volume cdev_device_add ubi_debugfs_init_dev //error goto out_uif; uif_close kill_volumes ubi_cdev_ioctl ubi_remove_volume cdev_device_del // first free ubi_free_volume // double free The cause of this problem is that commit 714fb87e8bc0 make device "available" before it becomes accessible via sysfs. Therefore, we roll back the modification. We will fix the race condition between ubi device creation and udev by removing ubi_get_device in vol_attribute_show and dev_attribute_show.This avoids accessing uninitialized ubi_devices[ubi_num]. ubi_get_device is used to prevent devices from being deleted during sysfs execution. However, now kernfs ensures that devices will not be deleted before all reference counting are released. The key process is shown in the following stack. device_del device_remove_attrs device_remove_groups sysfs_remove_groups sysfs_remove_group remove_files kernfs_remove_by_name kernfs_remove_by_name_ns __kernfs_remove kernfs_drain Fixes: 714fb87e8bc0 ("ubi: Fix race condition between ubi device creation and udev") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Conflicts: drivers/mtd/ubi/build.c [Not merged: fc55dacf7fea and its prerequisite patches.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/build.c | 9 +-------- drivers/mtd/ubi/vmt.c | 8 +------- 2 files changed, 2 insertions(+), 15 deletions(-) diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c index 93cce95287ba..d15c6a64f7cd 100644 --- a/drivers/mtd/ubi/build.c +++ b/drivers/mtd/ubi/build.c @@ -361,13 +361,10 @@ static ssize_t dev_attribute_show(struct device *dev, * * Remember, 'struct ubi_device' is freed in the release function, so * we still can use 'ubi->ubi_num'. */ ubi = container_of(dev, struct ubi_device, dev); - ubi = ubi_get_device(ubi->ubi_num); - if (!ubi) - return -ENODEV; if (attr == &dev_eraseblock_size) ret = sprintf(buf, "%d\n", ubi->leb_size); else if (attr == &dev_avail_eraseblocks) ret = sprintf(buf, "%d\n", ubi->avail_pebs); @@ -392,11 +389,10 @@ static ssize_t dev_attribute_show(struct device *dev, else if (attr == &dev_ro_mode) ret = sprintf(buf, "%d\n", ubi->ro_mode); else ret = -EINVAL; - ubi_put_device(ubi); return ret; } static struct attribute *ubi_dev_attrs[] = { &dev_eraseblock_size.attr, @@ -974,13 +970,10 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, err = autoresize(ubi, ubi->autoresize_vol_id); if (err) goto out_detach; } - /* Make device "available" before it becomes accessible via sysfs */ - ubi_devices[ubi_num] = ubi; - err = uif_init(ubi); if (err) goto out_detach; err = ubi_debugfs_init_dev(ubi); @@ -1021,19 +1014,19 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, spin_lock(&ubi->wl_lock); ubi->thread_enabled = 1; wake_up_process(ubi->bgt_thread); spin_unlock(&ubi->wl_lock); + ubi_devices[ubi_num] = ubi; ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL); return ubi_num; out_debugfs: ubi_debugfs_exit_dev(ubi); out_uif: uif_close(ubi); out_detach: - ubi_devices[ubi_num] = NULL; ubi_wl_close(ubi); ubi_free_internal_volumes(ubi); vfree(ubi->vtbl); out_free: vfree(ubi->peb_buf); diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c index 729588b94e41..d0c6b66b7450 100644 --- a/drivers/mtd/ubi/vmt.c +++ b/drivers/mtd/ubi/vmt.c @@ -67,20 +67,15 @@ static struct device_attribute attr_vol_upd_marker = static ssize_t vol_attribute_show(struct device *dev, struct device_attribute *attr, char *buf) { int ret; struct ubi_volume *vol = container_of(dev, struct ubi_volume, dev); - struct ubi_device *ubi; - - ubi = ubi_get_device(vol->ubi->ubi_num); - if (!ubi) - return -ENODEV; + struct ubi_device *ubi = vol->ubi; spin_lock(&ubi->volumes_lock); if (!ubi->volumes[vol->vol_id]) { spin_unlock(&ubi->volumes_lock); - ubi_put_device(ubi); return -ENODEV; } /* Take a reference to prevent volume removal */ vol->ref_count += 1; spin_unlock(&ubi->volumes_lock); @@ -114,11 +109,10 @@ static ssize_t vol_attribute_show(struct device *dev, /* We've done the operation, drop volume and UBI device references */ spin_lock(&ubi->volumes_lock); vol->ref_count -= 1; ubi_assert(vol->ref_count >= 0); spin_unlock(&ubi->volumes_lock); - ubi_put_device(ubi); return ret; } static struct attribute *volume_dev_attrs[] = { &attr_vol_reserved_ebs.attr, -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] wifi: mac80211: fix use-after-free in chanctx code
by Xiangwei Li 15 Mar '25

15 Mar '25

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v4.19.247 commit 9f1e5cc85ad77e52f54049a94db0407445ae2a34 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3RV CVE: CVE-2022-49416 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2965c4cdf7ad9ce0796fac5e57debb9519ea721e upstream. In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point. However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx. Cc: stable(a)vger.kernel.org Fixes: 5bcae31d9cb1 ("mac80211: implement multi-vif in-place reservations") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20220601091926.df419d91b165.I17a9b3894ff0b8323ce2… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- net/mac80211/chan.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c index d9558ffb8acf..6d95ce1c4a27 100644 --- a/net/mac80211/chan.c +++ b/net/mac80211/chan.c @@ -1638,12 +1638,9 @@ int ieee80211_vif_use_reserved_context(struct ieee80211_sub_if_data *sdata) if (new_ctx->replace_state == IEEE80211_CHANCTX_REPLACE_NONE) { if (old_ctx) - err = ieee80211_vif_use_reserved_reassign(sdata); - else - err = ieee80211_vif_use_reserved_assign(sdata); + return ieee80211_vif_use_reserved_reassign(sdata); - if (err) - return err; + return ieee80211_vif_use_reserved_assign(sdata); } /* -- 2.25.1

2 1

[PATCH OLK-5.10] module: fix [e_shstrndx].sh_size=0 OOB access
by Xiangwei Li 15 Mar '25

15 Mar '25

From: Alexey Dobriyan <adobriyan(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 391e982bfa632b8315235d8be9c0a81374c6a19c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP43S CVE: CVE-2022-49444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is trivial to craft a module to trigger OOB access in this line: if (info->secstrings[strhdr->sh_size - 1] != '\0') { BUG: unable to handle page fault for address: ffffc90000aa0fff PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014 RIP: 0010:load_module+0x19b/0x2391 Fixes: ec2a29593c83 ("module: harden ELF info handling") Signed-off-by: Alexey Dobriyan <adobriyan(a)gmail.com> [rebased patch onto modules-next] Signed-off-by: Luis Chamberlain <mcgrof(a)kernel.org> Conflicts: kernel/module/main.c kernel/module.c [context conflict] Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- kernel/module.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index e978debc93df..57b34c32a916 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3053,6 +3053,10 @@ static int elf_validity_check(struct load_info *info) * strings in the section safe. */ info->secstrings = (void *)info->hdr + strhdr->sh_offset; + if (strhdr->sh_size == 0) { + pr_err("empty section name table\n"); + return -ENOEXEC; + } if (info->secstrings[strhdr->sh_size - 1] != '\0') return -ENOEXEC; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/4] Fix 4 CVEs in JFFS2
by Wang Zhaolong 15 Mar '25

15 Mar '25

CVE-2022-49381 CVE-2022-49277 CVE-2022-49276 CVE-2021-47656 Baokun Li (4): jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_scan_medium jffs2: fix memory leak in jffs2_do_mount_fs jffs2: fix memory leak in jffs2_do_fill_super fs/jffs2/build.c | 4 +++- fs/jffs2/fs.c | 3 ++- fs/jffs2/scan.c | 6 ++++-- 3 files changed, 9 insertions(+), 4 deletions(-) -- 2.34.3

2 5

[openeuler:OLK-6.6 2034/2034] aarch64-linux-ld: Unexpected GOT/PLT entries detected!
by kernel test robot 15 Mar '25

15 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 304c7f18d674a3cbb439f7ee346622b2e6c5bc9e commit: b991780c836ceb9a479c6c6e385e914b487e353a [2034/2034] arm64: introduce copy_mc_to_kernel() implementation config: arm64-randconfig-001-20250314 (https://download.01.org/0day-ci/archive/20250315/202503151158.xNxBbX1r-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250315/202503151158.xNxBbX1r-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503151158.xNxBbX1r-lkp@intel.com/ All errors (new ones prefixed by >>): >> aarch64-linux-ld: Unexpected GOT/PLT entries detected! >> aarch64-linux-ld: Unexpected run-time procedure linkages detected! aarch64-linux-ld: mm/kasan/shadow.o: in function `memcpy_mc': mm/kasan/shadow.c:90:(.text+0x5d0): undefined reference to `__memcpy_mc' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] Fixes two CVEs of jffs2
by Wang Zhaolong 15 Mar '25

15 Mar '25

CVE-2022-49381 CVE-2021-47656 Baokun Li (2): jffs2: fix use-after-free in jffs2_clear_xattr_subsystem jffs2: fix memory leak in jffs2_do_fill_super fs/jffs2/fs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.3

2 3

[PATCH OLK-5.10] cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
by Wang Zhaolong 15 Mar '25

15 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSSQA CVE: NA ---------------------------------------- If an error occurs when port 139 is used to mount the CIFS, the mount process may racy with the reconnect process. If the mount process first sets tcpStatus to CifsExiting and then the reconnect process sets tcpStatus to CifsNeedReconnect later, the cifs_reconnect() function enters an infinite loop and and the cifsd process cannot exit. mount.cifs cifsd ------------------------------------------------------------------ cifs_do_mount cifs_smb3_do_mount cifs_mount mount_get_conns cifs_get_smb_ses cifs_demultiplex_thread cifs_negotiate_protocol smb2_need_neg smb2_negotiate SMB2_negotiate cifs_send_recv compound_send_recv wait_for_response cifs_read_from_socket cifs_readv_from_socket cifs_readv_from_socket smb2_can_echo cifs_reconnect do { generic_ip_connect cifs_sync_mid_result DeleteMidQEntry _cifs_mid_q_entry_release cifs_small_buf_release cifs_put_tcp_session tcpStatus = CifsExiting; // The status will not be changed later in mount.cifs. ip_rfc1001_connect smb_send __smb_send_rqst tcpStatus = CifsNeedReconnect; // infinite loop } while (tcpStatus == CifsNeedReconnect) This patch adds a check in __smb_send_rqst() to not change tcpStatus to CifsNeedReconnect if tcpStatus is CifsExiting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/transport.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index c6fd4223b3be..d634a7692e13 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -437,11 +437,14 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, /* * If we have only sent part of an SMB then the next SMB could * be taken as the remainder of this one. We need to kill the * socket so the server throws away the partial SMB */ - server->tcpStatus = CifsNeedReconnect; + spin_lock(&GlobalMid_Lock); + if (server->tcpStatus != CifsExiting) + server->tcpStatus = CifsNeedReconnect; + spin_unlock(&GlobalMid_Lock); trace_smb3_partial_send_reconnect(server->CurrentMid, server->hostname); } smbd_done: if (rc < 0 && rc != -EINTR) -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
by Wang Zhaolong 15 Mar '25

15 Mar '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSSQA CVE: NA ---------------------------------------- If an error occurs when port 139 is used to mount the CIFS, the mount process may racy with the reconnect process. If the mount process first sets tcpStatus to CifsExiting and then the reconnect process sets tcpStatus to CifsNeedReconnect later, the cifs_reconnect() function enters an infinite loop and and the cifsd process cannot exit. mount.cifs cifsd ------------------------------------------------------------------ cifs_do_mount cifs_smb3_do_mount cifs_mount mount_get_conns cifs_get_smb_ses cifs_demultiplex_thread cifs_negotiate_protocol smb2_need_neg smb2_negotiate SMB2_negotiate cifs_send_recv compound_send_recv wait_for_response cifs_read_from_socket cifs_readv_from_socket cifs_readv_from_socket smb2_can_echo cifs_reconnect do { generic_ip_connect cifs_sync_mid_result DeleteMidQEntry _cifs_mid_q_entry_release cifs_small_buf_release cifs_put_tcp_session tcpStatus = CifsExiting; // The status will not be changed later in mount.cifs. ip_rfc1001_connect smb_send __smb_send_rqst tcpStatus = CifsNeedReconnect; // infinite loop } while (tcpStatus == CifsNeedReconnect) This patch adds a check in __smb_send_rqst() to not change tcpStatus to CifsNeedReconnect if tcpStatus is CifsExiting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/transport.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index c74d6b577d95..7694056e5990 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -374,11 +374,14 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, /* * If we have only sent part of an SMB then the next SMB could * be taken as the remainder of this one. We need to kill the * socket so the server throws away the partial SMB */ - server->tcpStatus = CifsNeedReconnect; + spin_lock(&GlobalMid_Lock); + if (server->tcpStatus != CifsExiting) + server->tcpStatus = CifsNeedReconnect; + spin_unlock(&GlobalMid_Lock); trace_smb3_partial_send_reconnect(server->CurrentMid, server->hostname); } smbd_done: if (rc < 0 && rc != -EINTR) -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
by Liu Chuang 14 Mar '25

14 Mar '25

From: Vinod Polimera <quic_vpolimer(a)quicinc.com> stable inclusion from stable-v4.19.247 commit aa4cb188988dc6f1b3f4917d4dbc452150a5d871 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP4BH CVE: CVE-2022-49489 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa5186b279ecf44b14fb435540d2065be91cb1ed ] BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3 Call trace: dpu_vbif_init_memtypes+0x40/0xb8 dpu_runtime_resume+0xcc/0x1c0 pm_generic_runtime_resume+0x30/0x44 __genpd_runtime_resume+0x68/0x7c genpd_runtime_resume+0x134/0x258 __rpm_callback+0x98/0x138 rpm_callback+0x30/0x88 rpm_resume+0x36c/0x49c __pm_runtime_resume+0x80/0xb0 dpu_core_irq_uninstall+0x30/0xb0 dpu_irq_uninstall+0x18/0x24 msm_drm_uninit+0xd8/0x16c Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") Signed-off-by: Vinod Polimera <quic_vpolimer(a)quicinc.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/483255/ Link: https://lore.kernel.org/r/1650857213-30075-1-git-send-email-quic_vpolimer@q… [DB: fixed Fixes tag] Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c index 2d9b7b5fb49c..7c3b8c97434d 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c @@ -657,8 +657,10 @@ static void _dpu_kms_hw_destroy(struct dpu_kms *dpu_kms) for (i = 0; i < dpu_kms->catalog->vbif_count; i++) { u32 vbif_idx = dpu_kms->catalog->vbif[i].id; - if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) + if ((vbif_idx < VBIF_MAX) && dpu_kms->hw_vbif[vbif_idx]) { dpu_hw_vbif_destroy(dpu_kms->hw_vbif[vbif_idx]); + dpu_kms->hw_vbif[vbif_idx] = NULL; + } } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
by Liu Chuang 14 Mar '25

14 Mar '25

From: Gong Yuanjun <ruc_gongyuanjun(a)163.com> stable inclusion from stable-v4.19.247 commit 961ee8a6eeef4632a215d995d837b204f8c7c2d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP2G2 CVE: CVE-2022-49324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- [ Upstream commit 4107fa700f314592850e2c64608f6ede4c077476 ] Add the missing of_node_put() to release the refcount incremented by of_find_compatible_node(). Signed-off-by: Gong Yuanjun <ruc_gongyuanjun(a)163.com> Reviewed-by: Serge Semin <fancer.lancer(a)gmail.com> Signed-off-by: Thomas Bogendoerfer <tsbogend(a)alpha.franken.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- arch/mips/kernel/mips-cpc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c index fcf9af492d60..cf46502c605e 100644 --- a/arch/mips/kernel/mips-cpc.c +++ b/arch/mips/kernel/mips-cpc.c @@ -31,6 +31,7 @@ phys_addr_t __weak mips_cpc_default_phys_base(void) cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc"); if (cpc_node) { err = of_address_to_resource(cpc_node, 0, &res); + of_node_put(cpc_node); if (!err) return res.start; } -- 2.34.1

2 1

[openeuler:OLK-6.6 2033/2033] drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type
by kernel test robot 14 Mar '25

14 Mar '25

Hi Zhou, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9176bda54ce98dbe711ae84180a3968e9d1e4889 commit: 9c1c9598010fbb9daa1e2a67d23830092fb6246a [2033/2033] net/hinic: Update Huawei Intelligent Network Card Driver: hinic config: x86_64-buildonly-randconfig-005-20250314 (https://download.01.org/0day-ci/archive/20250314/202503141744.6L1UQKTr-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250314/202503141744.6L1UQKTr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503141744.6L1UQKTr-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/net/ethernet/huawei/hinic/hinic_tx.c:39: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:913:5: warning: no previous prototype for 'hinic_setup_tx_wqe' [-Wmissing-prototypes] 913 | int hinic_setup_tx_wqe(struct hinic_txq *txq) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_tx.c:1100:5: warning: no previous prototype for 'hinic_stop_sq' [-Wmissing-prototypes] 1100 | int hinic_stop_sq(struct hinic_txq *txq) | ^~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_rx.c:39: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:171:6: warning: no previous prototype for 'hinic_rx_free_buffers' [-Wmissing-prototypes] 171 | void hinic_rx_free_buffers(struct hinic_rxq *rxq) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:513:5: warning: no previous prototype for 'recv_one_pkt' [-Wmissing-prototypes] 513 | int recv_one_pkt(struct hinic_rxq *rxq, struct hinic_rq_cqe *rx_cqe, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_rx.c:560:6: warning: no previous prototype for 'rx_pass_super_cqe' [-Wmissing-prototypes] 560 | void rx_pass_super_cqe(struct hinic_rxq *rxq, u32 index, u32 pkt_num, | ^~~~~~~~~~~~~~~~~ -- In file included from drivers/net/ethernet/huawei/hinic/hinic_dcb.c:32: >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:210:33: error: field 'hinic_ieee_ets_default' has incomplete type 210 | struct ieee_ets hinic_ieee_ets_default; | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:211:33: error: field 'hinic_ieee_ets' has incomplete type 211 | struct ieee_ets hinic_ieee_ets; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h:212:33: error: field 'hinic_ieee_pfc' has incomplete type 212 | struct ieee_pfc hinic_ieee_pfc; | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:62:6: warning: no previous prototype for 'hinic_dcb_config_init' [-Wmissing-prototypes] 62 | void hinic_dcb_config_init(struct hinic_nic_dev *nic_dev, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:95:6: warning: no previous prototype for 'hinic_init_ieee_settings' [-Wmissing-prototypes] 95 | void hinic_init_ieee_settings(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/string.h:294, from include/linux/uuid.h:11, from include/linux/mod_devicetable.h:14, from include/linux/pci.h:27, from drivers/net/ethernet/huawei/hinic/hinic_dcb.c:18: drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_init_ieee_settings': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 103 | memset(ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:103:9: note: in expansion of macro 'memset' 103 | memset(ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:54: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:9: note: in expansion of macro 'memset' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:515:65: warning: left-hand operand of comma expression has no effect [-Wunused-value] 515 | fortify_memset_chk(__fortify_size, p_size, p_size_field), \ | ^ include/linux/fortify-string.h:524:25: note: in expansion of macro '__fortify_memset_chk' 524 | #define memset(p, c, s) __fortify_memset_chk(p, c, s, \ | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:104:9: note: in expansion of macro 'memset' 104 | memset(&nic_dev->hinic_ieee_ets, 0x0, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:105:12: error: invalid use of undefined type 'struct ieee_ets' 105 | ets->ets_cap = dcb_cfg->pg_tcs; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:108:20: error: invalid use of undefined type 'struct ieee_ets' 108 | ets->tc_tsa[i] = tc_attr->prio_type ? | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:110:20: error: invalid use of undefined type 'struct ieee_ets' 110 | ets->tc_tx_bw[i] = nic_dev->dcb_cfg.bw_pct[HINIC_DCB_CFG_TX][i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:111:20: error: invalid use of undefined type 'struct ieee_ets' 111 | ets->tc_rx_bw[i] = nic_dev->dcb_cfg.bw_pct[HINIC_DCB_CFG_RX][i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:112:20: error: invalid use of undefined type 'struct ieee_ets' 112 | ets->prio_tc[i] = hinic_dcb_get_tc(dcb_cfg, | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:115:54: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 115 | memcpy(&nic_dev->hinic_ieee_ets, ets, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:115:9: note: in expansion of macro 'memcpy' 115 | memcpy(&nic_dev->hinic_ieee_ets, ets, sizeof(struct ieee_ets)); | ^~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:33: error: invalid application of 'sizeof' to incomplete type 'struct ieee_pfc' 117 | memset(pfc, 0x0, sizeof(struct ieee_pfc)); | ^~~~~~ include/linux/fortify-string.h:514:42: note: in definition of macro '__fortify_memset_chk' 514 | size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:117:9: note: in expansion of macro 'memset' 117 | memset(pfc, 0x0, sizeof(struct ieee_pfc)); | ^~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:118:12: error: invalid use of undefined type 'struct ieee_pfc' 118 | pfc->pfc_cap = dcb_cfg->pfc_tcs; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:121:28: error: invalid use of undefined type 'struct ieee_pfc' 121 | pfc->pfc_en |= (u8)BIT(i); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcb_init': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) 244 | nic_dev->dcbx_cap = DCB_CAP_DCBX_HOST | DCB_CAP_DCBX_VER_CEE; | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:29: note: each undeclared identifier is reported only once for each function it appears in >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:244:49: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 244 | nic_dev->dcbx_cap = DCB_CAP_DCBX_HOST | DCB_CAP_DCBX_VER_CEE; | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:258:6: warning: no previous prototype for 'hinic_set_prio_tc_map' [-Wmissing-prototypes] 258 | void hinic_set_prio_tc_map(struct hinic_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_state': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:380:35: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 380 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_pg_tc_cfg_tx': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:475:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) 475 | if (prio != DCB_ATTR_VALUE_UNDEFINED) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_pg_tc_cfg_rx': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:507:21: error: 'DCB_ATTR_VALUE_UNDEFINED' undeclared (first use in this function) 507 | if (prio != DCB_ATTR_VALUE_UNDEFINED) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_getcap': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:689:14: error: 'DCB_CAP_ATTR_PG' undeclared (first use in this function) 689 | case DCB_CAP_ATTR_PG: | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:692:14: error: 'DCB_CAP_ATTR_PFC' undeclared (first use in this function) 692 | case DCB_CAP_ATTR_PFC: | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:695:14: error: 'DCB_CAP_ATTR_UP2TC' undeclared (first use in this function) 695 | case DCB_CAP_ATTR_UP2TC: | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:698:14: error: 'DCB_CAP_ATTR_PG_TCS' undeclared (first use in this function) 698 | case DCB_CAP_ATTR_PG_TCS: | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:701:14: error: 'DCB_CAP_ATTR_PFC_TCS' undeclared (first use in this function) 701 | case DCB_CAP_ATTR_PFC_TCS: | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:704:14: error: 'DCB_CAP_ATTR_GSP' undeclared (first use in this function) 704 | case DCB_CAP_ATTR_GSP: | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:707:14: error: 'DCB_CAP_ATTR_BCN' undeclared (first use in this function) 707 | case DCB_CAP_ATTR_BCN: | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:710:14: error: 'DCB_CAP_ATTR_DCBX' undeclared (first use in this function) 710 | case DCB_CAP_ATTR_DCBX: | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function '__set_hw_ets': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1026:42: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1026 | if ((nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) { | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1027:44: error: invalid use of undefined type 'struct ieee_ets' 1027 | up_tc[cos] = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1028:46: error: invalid use of undefined type 'struct ieee_ets' 1028 | up_pgid[cos] = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1031:40: error: invalid use of undefined type 'struct ieee_ets' 1031 | (my_ets->tc_tsa[cos] == IEEE8021Q_TSA_STRICT) ? | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1049:42: error: invalid use of undefined type 'struct ieee_ets' 1049 | pg_bw[i] = my_ets->tc_tx_bw[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_df_ieee_cfg': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:16: error: variable 'pfc' has initializer but incomplete type 1126 | struct ieee_pfc pfc = {0}; | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: warning: excess elements in struct initializer 1126 | struct ieee_pfc pfc = {0}; | ^ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:32: note: (near initialization for 'pfc') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: error: storage size of 'pfc' isn't known 1126 | struct ieee_pfc pfc = {0}; | ^~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1131:35: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1131 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1134:48: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1134 | if (memcmp(my_ets, ets_default, sizeof(struct ieee_ets))) | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1137:19: error: invalid use of undefined type 'struct ieee_pfc' 1137 | if (my_pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1149:52: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1149 | memcpy(my_ets, ets_default, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1149:17: note: in expansion of macro 'memcpy' 1149 | memcpy(my_ets, ets_default, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1153:23: error: invalid use of undefined type 'struct ieee_pfc' 1153 | my_pfc->pfc_en = 0; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1126:25: warning: unused variable 'pfc' [-Wunused-variable] 1126 | struct ieee_pfc pfc = {0}; | ^~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1201:4: warning: no previous prototype for 'hinic_dcbnl_set_all' [-Wmissing-prototypes] 1201 | u8 hinic_dcbnl_set_all(struct net_device *netdev) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_set_all': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1208:35: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 1208 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_get_ets': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1279:12: error: invalid use of undefined type 'struct ieee_ets' 1279 | ets->ets_cap = my_ets->ets_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1279:30: error: invalid use of undefined type 'struct ieee_ets' 1279 | ets->ets_cap = my_ets->ets_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:59: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:637:34: note: in definition of macro '__fortify_memcpy_chk' 637 | const size_t __p_size = (p_size); \ | ^~~~~~ include/linux/fortify-string.h:694:17: note: in expansion of macro '__struct_size' 694 | __struct_size(p), __struct_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:37: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:638:34: note: in definition of macro '__fortify_memcpy_chk' 638 | const size_t __q_size = (q_size); \ | ^~~~~~ include/linux/fortify-string.h:694:35: note: in expansion of macro '__struct_size' 694 | __struct_size(p), __struct_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:639:40: note: in definition of macro '__fortify_memcpy_chk' 639 | const size_t __p_size_field = (p_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:17: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:37: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~ include/linux/fortify-string.h:640:40: note: in definition of macro '__fortify_memcpy_chk' 640 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:35: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:9: note: in expansion of macro 'memcpy' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1280:19: error: invalid use of undefined type 'struct ieee_ets' 1280 | memcpy(ets->tc_tx_bw, my_ets->tc_tx_bw, sizeof(ets->tc_tx_bw)); -- | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:22: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ include/linux/fortify-string.h:639:40: note: in definition of macro '__fortify_memcpy_chk' 639 | const size_t __p_size_field = (p_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:17: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:35: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ include/linux/fortify-string.h:640:40: note: in definition of macro '__fortify_memcpy_chk' 640 | const size_t __q_size_field = (q_size_field); \ | ^~~~~~~~~~~~ include/linux/fortify-string.h:695:35: note: in expansion of macro '__member_size' 695 | __member_size(p), __member_size(q), \ | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:22: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ include/linux/fortify-string.h:648:27: note: in definition of macro '__fortify_memcpy_chk' 648 | __underlying_##op(p, q, __fortify_size); \ | ^ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:35: error: invalid use of undefined type 'struct ieee_ets' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~ include/linux/fortify-string.h:648:30: note: in definition of macro '__fortify_memcpy_chk' 648 | __underlying_##op(p, q, __fortify_size); \ | ^ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1328:9: note: in expansion of macro 'memcpy' 1328 | memcpy(my_ets->tc_tsa, ets->tc_tsa, sizeof(ets->tc_tsa)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1336:58: error: invalid application of 'sizeof' to incomplete type 'struct ieee_ets' 1336 | memcpy(my_ets, &back_ets, sizeof(struct ieee_ets)); | ^~~~~~ include/linux/fortify-string.h:636:48: note: in definition of macro '__fortify_memcpy_chk' 636 | const size_t __fortify_size = (size_t)(size); \ | ^~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1336:25: note: in expansion of macro 'memcpy' 1336 | memcpy(my_ets, &back_ets, sizeof(struct ieee_ets)); | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1294:25: warning: unused variable 'back_ets' [-Wunused-variable] 1294 | struct ieee_ets back_ets; | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_get_pfc': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1360:12: error: invalid use of undefined type 'struct ieee_pfc' 1360 | pfc->pfc_en = my_pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1360:29: error: invalid use of undefined type 'struct ieee_pfc' 1360 | pfc->pfc_en = my_pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1361:12: error: invalid use of undefined type 'struct ieee_pfc' 1361 | pfc->pfc_cap = my_pfc->pfc_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1361:30: error: invalid use of undefined type 'struct ieee_pfc' 1361 | pfc->pfc_cap = my_pfc->pfc_cap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_ieee_set_pfc': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1378:35: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1378 | if (!(nic_dev->dcbx_cap & DCB_CAP_DCBX_VER_IEEE)) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1381:19: error: invalid use of undefined type 'struct ieee_pfc' 1381 | if (my_pfc->pfc_en == pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1381:34: error: invalid use of undefined type 'struct ieee_pfc' 1381 | if (my_pfc->pfc_en == pfc->pfc_en) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1384:22: error: invalid use of undefined type 'struct ieee_pfc' 1384 | pfc_map = pfc->pfc_en & nic_dev->up_valid_bitmap; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1385:30: error: invalid use of undefined type 'struct ieee_pfc' 1385 | outof_range_pfc = pfc->pfc_en & (~nic_dev->up_valid_bitmap); | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1400:27: error: invalid use of undefined type 'struct ieee_ets' 1400 | if (my_ets->prio_tc[i] > max_tc) | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1401:40: error: invalid use of undefined type 'struct ieee_ets' 1401 | max_tc = my_ets->prio_tc[i]; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1415:15: error: invalid use of undefined type 'struct ieee_pfc' 1415 | my_pfc->pfc_en = pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1415:29: error: invalid use of undefined type 'struct ieee_pfc' 1415 | my_pfc->pfc_en = pfc->pfc_en; | ^~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_getnumtcs': >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1432:14: error: 'DCB_NUMTCS_ATTR_PG' undeclared (first use in this function) 1432 | case DCB_NUMTCS_ATTR_PG: | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1435:14: error: 'DCB_NUMTCS_ATTR_PFC' undeclared (first use in this function) 1435 | case DCB_NUMTCS_ATTR_PFC: | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: In function 'hinic_dcbnl_setdcbx': drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1476:22: error: 'DCB_CAP_DCBX_VER_IEEE' undeclared (first use in this function) 1476 | if (((mode & DCB_CAP_DCBX_VER_IEEE) && (mode & DCB_CAP_DCBX_VER_CEE)) || | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1476:56: error: 'DCB_CAP_DCBX_VER_CEE' undeclared (first use in this function) 1476 | if (((mode & DCB_CAP_DCBX_VER_IEEE) && (mode & DCB_CAP_DCBX_VER_CEE)) || | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1477:22: error: 'DCB_CAP_DCBX_LLD_MANAGED' undeclared (first use in this function) 1477 | ((mode & DCB_CAP_DCBX_LLD_MANAGED) && | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1478:23: error: 'DCB_CAP_DCBX_HOST' undeclared (first use in this function) 1478 | (!(mode & DCB_CAP_DCBX_HOST)))) { | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c: At top level: >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1519:14: error: variable 'hinic_dcbnl_ops' has initializer but incomplete type 1519 | const struct dcbnl_rtnl_ops hinic_dcbnl_ops = { | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_getets' 1521 | .ieee_getets = hinic_dcbnl_ieee_get_ets, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:27: warning: excess elements in struct initializer 1521 | .ieee_getets = hinic_dcbnl_ieee_get_ets, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1521:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setets' 1522 | .ieee_setets = hinic_dcbnl_ieee_set_ets, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:27: warning: excess elements in struct initializer 1522 | .ieee_setets = hinic_dcbnl_ieee_set_ets, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1522:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_getpfc' 1523 | .ieee_getpfc = hinic_dcbnl_ieee_get_pfc, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:27: warning: excess elements in struct initializer 1523 | .ieee_getpfc = hinic_dcbnl_ieee_get_pfc, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1523:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'ieee_setpfc' 1524 | .ieee_setpfc = hinic_dcbnl_ieee_set_pfc, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:27: warning: excess elements in struct initializer 1524 | .ieee_setpfc = hinic_dcbnl_ieee_set_pfc, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1524:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getstate' 1527 | .getstate = hinic_dcbnl_get_state, | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:27: warning: excess elements in struct initializer 1527 | .getstate = hinic_dcbnl_get_state, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1527:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setstate' 1528 | .setstate = hinic_dcbnl_set_state, | ^~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:27: warning: excess elements in struct initializer 1528 | .setstate = hinic_dcbnl_set_state, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1528:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpermhwaddr' 1529 | .getpermhwaddr = hinic_dcbnl_get_perm_hw_addr, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:27: warning: excess elements in struct initializer 1529 | .getpermhwaddr = hinic_dcbnl_get_perm_hw_addr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1529:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgtx' 1530 | .setpgtccfgtx = hinic_dcbnl_set_pg_tc_cfg_tx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:27: warning: excess elements in struct initializer 1530 | .setpgtccfgtx = hinic_dcbnl_set_pg_tc_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1530:27: note: (near initialization for 'hinic_dcbnl_ops') >> drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgtx' 1531 | .setpgbwgcfgtx = hinic_dcbnl_set_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:27: warning: excess elements in struct initializer 1531 | .setpgbwgcfgtx = hinic_dcbnl_set_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1531:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgtccfgrx' 1532 | .setpgtccfgrx = hinic_dcbnl_set_pg_tc_cfg_rx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:27: warning: excess elements in struct initializer 1532 | .setpgtccfgrx = hinic_dcbnl_set_pg_tc_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1532:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpgbwgcfgrx' 1533 | .setpgbwgcfgrx = hinic_dcbnl_set_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:27: warning: excess elements in struct initializer 1533 | .setpgbwgcfgrx = hinic_dcbnl_set_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1533:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgtccfgtx' 1534 | .getpgtccfgtx = hinic_dcbnl_get_pg_tc_cfg_tx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:27: warning: excess elements in struct initializer 1534 | .getpgtccfgtx = hinic_dcbnl_get_pg_tc_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1534:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgbwgcfgtx' 1535 | .getpgbwgcfgtx = hinic_dcbnl_get_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:27: warning: excess elements in struct initializer 1535 | .getpgbwgcfgtx = hinic_dcbnl_get_pg_bwg_cfg_tx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1535:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1536:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgtccfgrx' 1536 | .getpgtccfgrx = hinic_dcbnl_get_pg_tc_cfg_rx, | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1536:27: warning: excess elements in struct initializer 1536 | .getpgtccfgrx = hinic_dcbnl_get_pg_tc_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1536:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1537:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpgbwgcfgrx' 1537 | .getpgbwgcfgrx = hinic_dcbnl_get_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1537:27: warning: excess elements in struct initializer 1537 | .getpgbwgcfgrx = hinic_dcbnl_get_pg_bwg_cfg_rx, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1537:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1538:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpfccfg' 1538 | .setpfccfg = hinic_dcbnl_set_pfc_cfg, | ^~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1538:27: warning: excess elements in struct initializer 1538 | .setpfccfg = hinic_dcbnl_set_pfc_cfg, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1538:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1539:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpfccfg' 1539 | .getpfccfg = hinic_dcbnl_get_pfc_cfg, | ^~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1539:27: warning: excess elements in struct initializer 1539 | .getpfccfg = hinic_dcbnl_get_pfc_cfg, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1539:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1540:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setall' 1540 | .setall = hinic_dcbnl_set_all, | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1540:27: warning: excess elements in struct initializer 1540 | .setall = hinic_dcbnl_set_all, | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1540:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1541:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getcap' 1541 | .getcap = hinic_dcbnl_getcap, | ^~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1541:27: warning: excess elements in struct initializer 1541 | .getcap = hinic_dcbnl_getcap, | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1541:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1542:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getnumtcs' 1542 | .getnumtcs = hinic_dcbnl_getnumtcs, | ^~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1542:27: warning: excess elements in struct initializer 1542 | .getnumtcs = hinic_dcbnl_getnumtcs, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1542:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1543:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setnumtcs' 1543 | .setnumtcs = hinic_dcbnl_setnumtcs, | ^~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1543:27: warning: excess elements in struct initializer 1543 | .setnumtcs = hinic_dcbnl_setnumtcs, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1543:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1544:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'getpfcstate' 1544 | .getpfcstate = hinic_dcbnl_getpfcstate, | ^~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1544:27: warning: excess elements in struct initializer 1544 | .getpfcstate = hinic_dcbnl_getpfcstate, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1544:27: note: (near initialization for 'hinic_dcbnl_ops') drivers/net/ethernet/huawei/hinic/hinic_dcb.c:1545:10: error: 'const struct dcbnl_rtnl_ops' has no member named 'setpfcstate' 1545 | .setpfcstate = hinic_dcbnl_setpfcstate, | ^~~~~~~~~~~ .. vim +/hinic_ieee_ets_default +210 drivers/net/ethernet/huawei/hinic/hinic_nic_dev.h 153 154 struct hinic_nic_dev { 155 struct pci_dev *pdev; 156 struct net_device *netdev; 157 void *hwdev; 158 159 int poll_weight; 160 161 unsigned long *vlan_bitmap; 162 163 u16 num_qps; 164 u16 max_qps; 165 166 u32 msg_enable; 167 unsigned long flags; 168 169 u16 sq_depth; 170 u16 rq_depth; 171 172 /* mapping from priority */ 173 u8 sq_cos_mapping[HINIC_DCB_UP_MAX]; 174 u8 default_cos_id; 175 struct hinic_txq *txqs; 176 struct hinic_rxq *rxqs; 177 178 struct nic_service_cap nic_cap; 179 180 struct irq_info *qps_irq_info; 181 struct hinic_irq *irq_cfg; 182 struct work_struct rx_mode_work; 183 struct delayed_work moderation_task; 184 struct workqueue_struct *workq; 185 186 struct list_head uc_filter_list; 187 struct list_head mc_filter_list; 188 unsigned long rx_mod_state; 189 int netdev_uc_cnt; 190 int netdev_mc_cnt; 191 int lb_test_rx_idx; 192 int lb_pkt_len; 193 u8 *lb_test_rx_buf; 194 195 u8 rss_tmpl_idx; 196 u16 num_rss; 197 u16 rss_limit; 198 u8 rss_hash_engine; 199 struct nic_rss_type rss_type; 200 u8 *rss_hkey_user; 201 /* hkey in big endian */ 202 u32 *rss_hkey_user_be; 203 u32 *rss_indir_user; 204 205 u8 dcbx_cap; 206 u32 dcb_changes; 207 u8 max_cos; 208 u8 up_valid_bitmap; 209 u8 up_cos[HINIC_DCB_UP_MAX]; > 210 struct ieee_ets hinic_ieee_ets_default; > 211 struct ieee_ets hinic_ieee_ets; 212 struct ieee_pfc hinic_ieee_pfc; 213 struct hinic_dcb_config dcb_cfg; 214 struct hinic_dcb_config tmp_dcb_cfg; 215 struct hinic_dcb_config save_dcb_cfg; 216 unsigned long dcb_flags; 217 int disable_port_cnt; 218 /* lock for disable or enable traffic flow */ 219 struct semaphore dcb_sem; 220 221 bool heart_status; 222 223 struct hinic_intr_coal_info *intr_coalesce; 224 unsigned long last_moder_jiffies; 225 u32 adaptive_rx_coal; 226 u8 intr_coal_set_flag; 227 u32 his_link_speed; 228 /* interrupt coalesce must be different in virtual machine */ 229 bool in_vm; 230 bool is_vm_slave; 231 int is_bm_slave; 232 struct hinic_nic_stats stats; 233 /* lock for nic resource */ 234 struct mutex nic_mutex; 235 bool force_port_disable; 236 struct semaphore port_state_sem; 237 u8 link_status; 238 239 struct hinic_environment_info env_info; 240 struct hinic_adaptive_cfg adaptive_cfg; 241 242 /* pangea cpu affinity setting */ 243 bool force_affinity; 244 cpumask_t affinity_mask; 245 246 u32 lro_replenish_thld; 247 u16 rx_buff_len; 248 u32 page_order; 249 }; 250 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v2 0/3] CVE-2025-21816
by Xiongfeng Wang 14 Mar '25

14 Mar '25

Frederic Weisbecker (2): hrtimer: Report offline hrtimer enqueue hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 5 +- kernel/time/hrtimer.c | 105 ++++++++++++++++++++++++++++++++-------- 2 files changed, 90 insertions(+), 20 deletions(-) -- 2.20.1

2 4

[PATCH OLK-6.6 0/6] Add dp module in hibmc driver
by Yongbang Shi 14 Mar '25

14 Mar '25

From: Baihan Li <libaihan(a)huawei.com> Realizing the basic display function of DP cable for DP connector displaying. Add DP module in hibmc drm driver, which is for Hisilicon Hibmc SoC which used for Out-of-band management. Blow is the general hardware connection, both the Hibmc and the host CPU are on the same mother board. +----------+ +----------+ +----- ----+ +----------------+ | | PCIe | Hibmc | | | | | |host CPU( |<----->| display |<---->| dp kapi |<---->| dp aux moduel | |arm64,x86)| |subsystem | | moduel |<---->| dp link moduel | +----------+ +----------+ +----------+ +----------------+ Baihan Li (5): drm/hisilicon/hibmc: add dp aux in hibmc drivers drm/hisilicon/hibmc: add dp link moduel in hibmc drivers drm/hisilicon/hibmc: add dp hw moduel in hibmc driver drm/hisilicon/hibmc: refactored struct hibmc_drm_private drm/hisilicon/hibmc: add dp module in hibmc Jani Nikula (1): drm/hisilicon/hibmc: convert to struct drm_edid drivers/gpu/drm/hisilicon/hibmc/Makefile | 3 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c | 164 +++++++++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 63 ++++ .../gpu/drm/hisilicon/hibmc/dp/dp_config.h | 19 + drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 220 ++++++++++++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 28 ++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 332 ++++++++++++++++++ drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 76 ++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 118 +++++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 14 + .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 19 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 42 ++- .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 33 +- 13 files changed, 1085 insertions(+), 46 deletions(-) create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c create mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c -- 2.33.0

2 7

[PATCH openEuler-1.0-LTS] dlm: fix plock invalid read
by Xia Fukun 14 Mar '25

14 Mar '25

From: Alexander Aring <aahringo(a)redhat.com> stable inclusion from stable-v4.19.247 commit 5a1765adf9855cf0f6d3f7e0eb4b78ca66f70dee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3TG CVE: CVE-2022-49407 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 42252d0d2aa9b94d168241710a761588b3959019 upstream. This patch fixes an invalid read showed by KASAN. A unlock will allocate a "struct plock_op" and a followed send_op() will append it to a global send_list data structure. In some cases a followed dev_read() moves it to recv_list and dev_write() will cast it to "struct plock_xop" and access fields which are only available in those structures. At this point an invalid read happens by accessing those fields. To fix this issue the "callback" field is moved to "struct plock_op" to indicate that a cast to "plock_xop" is allowed and does the additional "plock_xop" handling if set. Example of the KASAN output which showed the invalid read: [ 2064.296453] ================================================================== [ 2064.304852] BUG: KASAN: slab-out-of-bounds in dev_write+0x52b/0x5a0 [dlm] [ 2064.306491] Read of size 8 at addr ffff88800ef227d8 by task dlm_controld/7484 [ 2064.308168] [ 2064.308575] CPU: 0 PID: 7484 Comm: dlm_controld Kdump: loaded Not tainted 5.14.0+ #9 [ 2064.310292] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 2064.311618] Call Trace: [ 2064.312218] dump_stack_lvl+0x56/0x7b [ 2064.313150] print_address_description.constprop.8+0x21/0x150 [ 2064.314578] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.315610] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.316595] kasan_report.cold.14+0x7f/0x11b [ 2064.317674] ? dev_write+0x52b/0x5a0 [dlm] [ 2064.318687] dev_write+0x52b/0x5a0 [dlm] [ 2064.319629] ? dev_read+0x4a0/0x4a0 [dlm] [ 2064.320713] ? bpf_lsm_kernfs_init_security+0x10/0x10 [ 2064.321926] vfs_write+0x17e/0x930 [ 2064.322769] ? __fget_light+0x1aa/0x220 [ 2064.323753] ksys_write+0xf1/0x1c0 [ 2064.324548] ? __ia32_sys_read+0xb0/0xb0 [ 2064.325464] do_syscall_64+0x3a/0x80 [ 2064.326387] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.327606] RIP: 0033:0x7f807e4ba96f [ 2064.328470] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 39 87 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 7c 87 f8 ff 48 [ 2064.332902] RSP: 002b:00007ffd50cfe6e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2064.334658] RAX: ffffffffffffffda RBX: 000055cc3886eb30 RCX: 00007f807e4ba96f [ 2064.336275] RDX: 0000000000000040 RSI: 00007ffd50cfe7e0 RDI: 0000000000000010 [ 2064.337980] RBP: 00007ffd50cfe7e0 R08: 0000000000000000 R09: 0000000000000001 [ 2064.339560] R10: 000055cc3886eb30 R11: 0000000000000293 R12: 000055cc3886eb80 [ 2064.341237] R13: 000055cc3886eb00 R14: 000055cc3886f590 R15: 0000000000000001 [ 2064.342857] [ 2064.343226] Allocated by task 12438: [ 2064.344057] kasan_save_stack+0x1c/0x40 [ 2064.345079] __kasan_kmalloc+0x84/0xa0 [ 2064.345933] kmem_cache_alloc_trace+0x13b/0x220 [ 2064.346953] dlm_posix_unlock+0xec/0x720 [dlm] [ 2064.348811] do_lock_file_wait.part.32+0xca/0x1d0 [ 2064.351070] fcntl_setlk+0x281/0xbc0 [ 2064.352879] do_fcntl+0x5e4/0xfe0 [ 2064.354657] __x64_sys_fcntl+0x11f/0x170 [ 2064.356550] do_syscall_64+0x3a/0x80 [ 2064.358259] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2064.360745] [ 2064.361511] Last potentially related work creation: [ 2064.363957] kasan_save_stack+0x1c/0x40 [ 2064.365811] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.368100] call_rcu+0x11b/0xf70 [ 2064.369785] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.372404] receive_from_sock+0x290/0x770 [dlm] [ 2064.374607] process_recv_sockets+0x32/0x40 [dlm] [ 2064.377290] process_one_work+0x9a8/0x16e0 [ 2064.379357] worker_thread+0x87/0xbf0 [ 2064.381188] kthread+0x3ac/0x490 [ 2064.383460] ret_from_fork+0x22/0x30 [ 2064.385588] [ 2064.386518] Second to last potentially related work creation: [ 2064.389219] kasan_save_stack+0x1c/0x40 [ 2064.391043] __kasan_record_aux_stack+0xaf/0xc0 [ 2064.393303] call_rcu+0x11b/0xf70 [ 2064.394885] dlm_process_incoming_buffer+0x47d/0xfd0 [dlm] [ 2064.397694] receive_from_sock+0x290/0x770 [dlm] [ 2064.399932] process_recv_sockets+0x32/0x40 [dlm] [ 2064.402180] process_one_work+0x9a8/0x16e0 [ 2064.404388] worker_thread+0x87/0xbf0 [ 2064.406124] kthread+0x3ac/0x490 [ 2064.408021] ret_from_fork+0x22/0x30 [ 2064.409834] [ 2064.410599] The buggy address belongs to the object at ffff88800ef22780 [ 2064.410599] which belongs to the cache kmalloc-96 of size 96 [ 2064.416495] The buggy address is located 88 bytes inside of [ 2064.416495] 96-byte region [ffff88800ef22780, ffff88800ef227e0) [ 2064.422045] The buggy address belongs to the page: [ 2064.424635] page:00000000b6bef8bc refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xef22 [ 2064.428970] flags: 0xfffffc0000200(slab|node=0|zone=1|lastcpupid=0x1fffff) [ 2064.432515] raw: 000fffffc0000200 ffffea0000d68b80 0000001400000014 ffff888001041780 [ 2064.436110] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 2064.439813] page dumped because: kasan: bad access detected [ 2064.442548] [ 2064.443310] Memory state around the buggy address: [ 2064.445988] ffff88800ef22680: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 2064.449444] ffff88800ef22700: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 2064.452941] >ffff88800ef22780: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 2064.456383] ^ [ 2064.459386] ffff88800ef22800: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 2064.462788] ffff88800ef22880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 2064.466239] ================================================================== reproducer in python: import argparse import struct import fcntl import os parser = argparse.ArgumentParser() parser.add_argument('-f', '--file', help='file to use fcntl, must be on dlm lock filesystem e.g. gfs2') args = parser.parse_args() f = open(args.file, 'wb+') lockdata = struct.pack('hhllhh', fcntl.F_WRLCK,0,0,0,0,0) fcntl.fcntl(f, fcntl.F_SETLK, lockdata) lockdata = struct.pack('hhllhh', fcntl.F_UNLCK,0,0,0,0,0) fcntl.fcntl(f, fcntl.F_SETLK, lockdata) Fixes: 586759f03e2e ("gfs2: nfs lock support for gfs2") Cc: stable(a)vger.kernel.org Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Alexander Aring <aahringo(a)redhat.com> Signed-off-by: David Teigland <teigland(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- fs/dlm/plock.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/fs/dlm/plock.c b/fs/dlm/plock.c index c7d5a2ea3d03..e0c05e08d8bf 100644 --- a/fs/dlm/plock.c +++ b/fs/dlm/plock.c @@ -26,11 +26,11 @@ struct plock_op { struct list_head list; int done; struct dlm_plock_info info; + int (*callback)(struct file_lock *fl, int result); }; struct plock_xop { struct plock_op xop; - int (*callback)(struct file_lock *fl, int result); void *fl; void *file; struct file_lock flc; @@ -132,19 +132,18 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, /* fl_owner is lockd which doesn't distinguish processes on the nfs client */ op->info.owner = (__u64) fl->fl_pid; - xop->callback = fl->fl_lmops->lm_grant; + op->callback = fl->fl_lmops->lm_grant; locks_init_lock(&xop->flc); locks_copy_lock(&xop->flc, fl); xop->fl = fl; xop->file = file; } else { op->info.owner = (__u64)(long) fl->fl_owner; - xop->callback = NULL; } send_op(op); - if (xop->callback == NULL) { + if (!op->callback) { rv = wait_event_interruptible(recv_wq, (op->done != 0)); if (rv == -ERESTARTSYS) { log_debug(ls, "dlm_posix_lock: wait killed %llx", @@ -206,7 +205,7 @@ static int dlm_plock_callback(struct plock_op *op) file = xop->file; flc = &xop->flc; fl = xop->fl; - notify = xop->callback; + notify = op->callback; if (op->info.rv) { notify(fl, op->info.rv); @@ -439,10 +438,9 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count, if (op->info.fsid == info.fsid && op->info.number == info.number && op->info.owner == info.owner) { - struct plock_xop *xop = (struct plock_xop *)op; list_del_init(&op->list); memcpy(&op->info, &info, sizeof(info)); - if (xop->callback) + if (op->callback) do_callback = 1; else op->done = 1; -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/3] CVE-2025-21816
by Xiongfeng Wang 14 Mar '25

14 Mar '25

Frederic Weisbecker (2): hrtimer: Report offline hrtimer enqueue hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 5 +- kernel/time/hrtimer.c | 105 ++++++++++++++++++++++++++++++++-------- 2 files changed, 90 insertions(+), 20 deletions(-) -- 2.20.1

2 4

[openeuler:OLK-5.10] BUILD SUCCESS c2f6be994ae124fea938cd77272722cffb1a3c26
by kernel test robot 14 Mar '25

14 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: c2f6be994ae124fea938cd77272722cffb1a3c26 !2893 igc: add default intel igc driver module support Unverified Warning (likely false positive, kindly check if interested): drivers/infiniband/hw/bnxt_re/ib_verbs.c:1026 bnxt_re_init_rq_attr() warn: can 'srq' even be NULL? drivers/infiniband/hw/bnxt_re/ib_verbs.c:1185 bnxt_re_init_qp_attr() warn: can 'cq' even be NULL? drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1245 ngbe_link_test() error: uninitialized symbol 'link_up'. drivers/net/ethernet/netswift/ngbe/ngbe_ethtool.c:1905 ngbe_diag_test() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:1222 ngbe_fc_autoneg() error: uninitialized symbol 'link_up'. drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4324 ngbe_write_ee_hostif32() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_main.c:1850 ngbe_request_msix_irqs() warn: 'entry->vector' from request_irq() not released on lines: 1850. drivers/net/ethernet/netswift/ngbe/ngbe_main.c:3931 ngbe_setup_all_rx_resources() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_main.c:5084 ngbe_reset_subtask() warn: inconsistent indenting drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1248 ngbe_phy_get_advertised_pause() error: uninitialized symbol 'value'. drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1260 ngbe_phy_get_advertised_pause_m88e1512() error: uninitialized symbol 'value'. drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1287 ngbe_phy_get_lp_advertised_pause() error: uninitialized symbol 'value'. drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1291 ngbe_phy_get_lp_advertised_pause() warn: mask and shift to zero: expr='value >> 10' drivers/net/ethernet/netswift/ngbe/ngbe_phy.c:1304 ngbe_phy_get_lp_advertised_pause_m88e1512() error: uninitialized symbol 'value'. Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250313 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-defconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-101-20250314 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-102-20250314 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-103-20250314 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-104-20250314 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-randconfig-161-20250313 | |-- drivers-infiniband-hw-bnxt_re-ib_verbs.c-bnxt_re_init_qp_attr()-warn:can-cq-even-be-NULL | |-- drivers-infiniband-hw-bnxt_re-ib_verbs.c-bnxt_re_init_rq_attr()-warn:can-srq-even-be-NULL | |-- drivers-net-ethernet-netswift-ngbe-ngbe_ethtool.c-ngbe_diag_test()-warn:inconsistent-indenting | |-- drivers-net-ethernet-netswift-ngbe-ngbe_ethtool.c-ngbe_link_test()-error:uninitialized-symbol-link_up-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_hw.c-ngbe_fc_autoneg()-error:uninitialized-symbol-link_up-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_hw.c-ngbe_write_ee_hostif32()-warn:inconsistent-indenting | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c-ngbe_request_msix_irqs()-warn:entry-vector-from-request_irq()-not-released-on-lines:. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c-ngbe_reset_subtask()-warn:inconsistent-indenting | |-- drivers-net-ethernet-netswift-ngbe-ngbe_main.c-ngbe_setup_all_rx_resources()-warn:inconsistent-indenting | |-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_advertised_pause()-error:uninitialized-symbol-value-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_advertised_pause_m88e1512()-error:uninitialized-symbol-value-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_lp_advertised_pause()-error:uninitialized-symbol-value-. | |-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_lp_advertised_pause()-warn:mask-and-shift-to-zero:expr-value | `-- drivers-net-ethernet-netswift-ngbe-ngbe_phy.c-ngbe_phy_get_lp_advertised_pause_m88e1512()-error:uninitialized-symbol-value-. `-- x86_64-randconfig-161-20250314 |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch elapsed time: 1458m configs tested: 16 configs skipped: 129 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250313 clang-18 arm64 randconfig-002-20250313 clang-16 arm64 randconfig-003-20250313 gcc-14.2.0 arm64 randconfig-004-20250313 clang-21 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250313 clang-19 x86_64 buildonly-randconfig-002-20250313 clang-19 x86_64 buildonly-randconfig-003-20250313 clang-19 x86_64 buildonly-randconfig-004-20250313 gcc-12 x86_64 buildonly-randconfig-005-20250313 clang-19 x86_64 buildonly-randconfig-006-20250313 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] CVE-2025-21816
by Xiongfeng Wang 14 Mar '25

14 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 102 ++++++++++++++++++++++++++++++++-------- 2 files changed, 84 insertions(+), 19 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-21816
by Xiongfeng Wang 14 Mar '25

14 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++-------- 2 files changed, 83 insertions(+), 21 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49514
by Liu Shixin 14 Mar '25

14 Mar '25

Miaoqian Lin (1): ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe Tzung-Bi Shih (1): ASoC: mediatek: mt8173: fix device_node leak sound/soc/mediatek/mt8173/mt8173-max98090.c | 8 +++++++- sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 ++ sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 ++ sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 ++ 4 files changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] mm: fix unexpected zeroed page mapping with zram swap
by Liu Shixin 14 Mar '25

14 Mar '25

From: Minchan Kim <minchan(a)kernel.org> stable inclusion from stable-v4.19.242 commit f86d55cf616199404c05f5b0c5c41b17351baa02 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP28G CVE: CVE-2022-49052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e914d8f00391520ecc4495dd0ca0124538ab7119 upstream. Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault will read zeroed data The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't increase the refcount of swap slot at copy_mm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swap_slot_free_notify function. With this patch, CPU A will see correct data. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap_free swap_range_free bd_disk->fops->swap_slot_free_notify swap_readpage read zeroed data pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return on next refault will see mapped data by CPU B The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and do_swap_page is followed by swap_free so it will free the compressed form from in zram quickly. Link: https://lkml.kernel.org/r/YjTVVxIAsnKAXjTd@google.com Fixes: 0bcac06f27d7 ("mm, swap: skip swapcache for swapin of synchronous device") Reported-by: Ivan Babrou <ivan(a)cloudflare.com> Tested-by: Ivan Babrou <ivan(a)cloudflare.com> Signed-off-by: Minchan Kim <minchan(a)kernel.org> Cc: Nitin Gupta <ngupta(a)vflare.org> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: David Hildenbrand <david(a)redhat.com> Cc: <stable(a)vger.kernel.org> [4.14+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/page_io.c [ Context conflicts. ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/page_io.c | 55 ---------------------------------------------------- 1 file changed, 55 deletions(-) diff --git a/mm/page_io.c b/mm/page_io.c index 17cff71a9304..9750f5580a91 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -71,55 +71,6 @@ void end_swap_bio_write(struct bio *bio) bio_put(bio); } -static void swap_slot_free_notify(struct page *page) -{ - struct swap_info_struct *sis; - struct gendisk *disk; - swp_entry_t entry; - - /* - * There is no guarantee that the page is in swap cache - the software - * suspend code (at least) uses end_swap_bio_read() against a non- - * swapcache page. So we must check PG_swapcache before proceeding with - * this optimization. - */ - if (unlikely(!PageSwapCache(page))) - return; - - sis = page_swap_info(page); - if (!(sis->flags & SWP_BLKDEV)) - return; - - /* - * The swap subsystem performs lazy swap slot freeing, - * expecting that the page will be swapped out again. - * So we can avoid an unnecessary write if the page - * isn't redirtied. - * This is good for real swap storage because we can - * reduce unnecessary I/O and enhance wear-leveling - * if an SSD is used as the as swap device. - * But if in-memory swap device (eg zram) is used, - * this causes a duplicated copy between uncompressed - * data in VM-owned memory and compressed data in - * zram-owned memory. So let's free zram-owned memory - * and make the VM-owned decompressed page *dirty*, - * so the page should be swapped out somewhere again if - * we again wish to reclaim it. - */ - disk = sis->bdev->bd_disk; - entry.val = page_private(page); - if (disk->fops->swap_slot_free_notify && - __swap_count(entry) == 1) { - unsigned long offset; - - offset = swp_offset(entry); - - SetPageDirty(page); - disk->fops->swap_slot_free_notify(sis->bdev, - offset); - } -} - static void end_swap_bio_read(struct bio *bio) { struct page *page = bio_first_page_all(bio); @@ -135,7 +86,6 @@ static void end_swap_bio_read(struct bio *bio) } SetPageUptodate(page); - swap_slot_free_notify(page); out: unlock_page(page); WRITE_ONCE(bio->bi_private, NULL); @@ -373,11 +323,6 @@ int swap_readpage(struct page *page, bool synchronous) ret = bdev_read_page(sis->bdev, map_swap_page(page, &sis->bdev), page); if (!ret) { - if (trylock_page(page)) { - swap_slot_free_notify(page); - unlock_page(page); - } - count_vm_event(PSWPIN); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: venus: hfi: avoid null dereference in deinit
by Liu Shixin 14 Mar '25

14 Mar '25

From: Luca Weiss <luca.weiss(a)fairphone.com> stable inclusion from stable-v4.19.247 commit a21d15dde21d7e8ae047eb8368677407db45d840 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6S3 CVE: CVE-2022-49527 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 86594f6af867b5165d2ba7b5a71fae3a5961e56c ] If venus_probe fails at pm_runtime_put_sync the error handling first calls hfi_destroy and afterwards hfi_core_deinit. As hfi_destroy sets core->ops to NULL, hfi_core_deinit cannot call the core_deinit function anymore. Avoid this null pointer derefence by skipping the call when necessary. Signed-off-by: Luca Weiss <luca.weiss(a)fairphone.com> Signed-off-by: Stanimir Varbanov <stanimir.varbanov(a)linaro.org> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/media/platform/qcom/venus/hfi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi.c b/drivers/media/platform/qcom/venus/hfi.c index 24207829982f..8a99e2d8274a 100644 --- a/drivers/media/platform/qcom/venus/hfi.c +++ b/drivers/media/platform/qcom/venus/hfi.c @@ -113,6 +113,9 @@ int hfi_core_deinit(struct venus_core *core, bool blocking) mutex_lock(&core->lock); } + if (!core->ops) + goto unlock; + ret = core->ops->core_deinit(core); if (!ret) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
by Liu Shixin 14 Mar '25

14 Mar '25

From: Jessica Zhang <quic_jesszhan(a)quicinc.com> stable inclusion from stable-v4.19.247 commit 1a5d1474026ea4f1a6f931075ca2adb884af39cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP48W CVE: CVE-2022-49488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ca75f6f7c6f89365e40f10f641b15981b1f07c31 ] There is a possibility for mdp5_get_global_state to return -EDEADLK when acquiring the modeset lock, but currently global_state in mdp5_mixer_release doesn't check for if an error is returned. To avoid a NULL dereference error, let's have mdp5_mixer_release check if an error is returned and propagate that error. Reported-by: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Signed-off-by: Jessica Zhang <quic_jesszhan(a)quicinc.com> Fixes: 7907a0d77cb4 ("drm/msm/mdp5: Use the new private_obj state") Reviewed-by: Rob Clark <robdclark(a)gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/485181/ Link: https://lore.kernel.org/r/20220505214051.155-2-quic_jesszhan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 10 ++++++++-- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 ++-- 3 files changed, 21 insertions(+), 8 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c index b1da9ce54379..f9179eb08e90 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c @@ -537,9 +537,15 @@ int mdp5_crtc_setup_pipeline(struct drm_crtc *crtc, if (ret) return ret; - mdp5_mixer_release(new_crtc_state->state, old_mixer); + ret = mdp5_mixer_release(new_crtc_state->state, old_mixer); + if (ret) + return ret; + if (old_r_mixer) { - mdp5_mixer_release(new_crtc_state->state, old_r_mixer); + ret = mdp5_mixer_release(new_crtc_state->state, old_r_mixer); + if (ret) + return ret; + if (!need_right_mixer) pipeline->r_mixer = NULL; } diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c index 113e6b569562..9c8275300b55 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c @@ -127,21 +127,28 @@ int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, return 0; } -void mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer) +int mdp5_mixer_release(struct drm_atomic_state *s, struct mdp5_hw_mixer *mixer) { struct mdp5_global_state *global_state = mdp5_get_global_state(s); - struct mdp5_hw_mixer_state *new_state = &global_state->hwmixer; + struct mdp5_hw_mixer_state *new_state; if (!mixer) - return; + return 0; + + if (IS_ERR(global_state)) + return PTR_ERR(global_state); + + new_state = &global_state->hwmixer; if (WARN_ON(!new_state->hwmixer_to_crtc[mixer->idx])) - return; + return -EINVAL; DBG("%s: release from crtc %s", mixer->name, new_state->hwmixer_to_crtc[mixer->idx]->name); new_state->hwmixer_to_crtc[mixer->idx] = NULL; + + return 0; } void mdp5_mixer_destroy(struct mdp5_hw_mixer *mixer) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h index 9be94f567fbd..6bcb0b544665 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h @@ -41,7 +41,7 @@ void mdp5_mixer_destroy(struct mdp5_hw_mixer *lm); int mdp5_mixer_assign(struct drm_atomic_state *s, struct drm_crtc *crtc, uint32_t caps, struct mdp5_hw_mixer **mixer, struct mdp5_hw_mixer **r_mixer); -void mdp5_mixer_release(struct drm_atomic_state *s, - struct mdp5_hw_mixer *mixer); +int mdp5_mixer_release(struct drm_atomic_state *s, + struct mdp5_hw_mixer *mixer); #endif /* __MDP5_LM_H__ */ -- 2.34.1

2 1

[PATCH OLK-5.10] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 14 Mar '25

14 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] CVE-2024-58069
by Liao Chen 13 Mar '25

13 Mar '25

fix CVE-2024-58069 Oleksij Rempel (1): rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read drivers/rtc/rtc-pcf85063.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/2] CVE-2025-21816
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 102 ++++++++++++++++++++++++++++++++-------- 2 files changed, 84 insertions(+), 19 deletions(-) -- 2.20.1

2 3

[PATCH OLK-5.10] PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: King Dix <kingdix10(a)qq.com> mainline inclusion from mainline-v6.14-rc1 commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK2 CVE: CVE-2025-21804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows: $ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff : Sometimes, garbage may appear after the colon. In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack. Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support") Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.c… Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Signed-off-by: King Dix <kingdix10(a)qq.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/controller/pcie-rcar-ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c index c91d85b151290..fc85263797e91 100644 --- a/drivers/pci/controller/pcie-rcar-ep.c +++ b/drivers/pci/controller/pcie-rcar-ep.c @@ -110,7 +110,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, } if (!devm_request_mem_region(&pdev->dev, res->start, resource_size(res), - outbound_name)) { + res->name)) { dev_err(pcie->dev, "Cannot request memory region %s.\n", outbound_name); return -EIO; -- 2.20.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21816
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++-------- 2 files changed, 83 insertions(+), 21 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6] hrtimer: Fix kabi broken of struct hrtimer_cpu_base
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLI0 -------------------------------- Fix kabi broken caused by the following commit. Because the reserved size is not enough, and struct hrtimer_cpu_base is not contained by any other stucture, we use KABI_EXTEND to fix the kabi. Fixes: 14548083da37 ("[Backport] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- include/linux/hrtimer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 1ec9be2ce4be..623537ee5c48 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -244,10 +244,10 @@ struct hrtimer_cpu_base { ktime_t softirq_expires_next; struct hrtimer *softirq_next_timer; struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES]; - call_single_data_t csd; KABI_RESERVE(1) KABI_RESERVE(2) + KABI_EXTEND(call_single_data_t csd) } ____cacheline_aligned; static inline void hrtimer_set_expires(struct hrtimer *timer, ktime_t time) -- 2.20.1

2 1

[PATCH OLK-6.6] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Frederic Weisbecker <frederic(a)kernel.org> mainline inclusion from mainline-v6.14-rc2 commit 53dac345395c0d2493cbc2f4c85fe38aef5b63f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLI0 CVE: CVE-2025-21816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hrtimers are migrated away from the dying CPU to any online target at the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers handling tasks involved in the CPU hotplug forward progress. However wakeups can still be performed by the outgoing CPU after CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being armed. Depending on several considerations (crystal ball power management based election, earliest timer already enqueued, timer migration enabled or not), the target may eventually be the current CPU even if offline. If that happens, the timer is eventually ignored. The most notable example is RCU which had to deal with each and every of those wake-ups by deferring them to an online CPU, along with related workarounds: _ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying) _ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU) _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq) The problem isn't confined to RCU though as the stop machine kthread (which runs CPUHP_AP_HRTIMERS_DYING) reports its completion at the end of its work through cpu_stop_signal_done() and performs a wake up that eventually arms the deadline server timer: WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0 CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted Stopper: multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0 RIP: 0010:hrtimer_start_range_ns+0x289/0x2d0 Call Trace: <TASK> start_dl_timer enqueue_dl_entity dl_server_start enqueue_task_fair enqueue_task ttwu_do_activate try_to_wake_up complete cpu_stopper_thread Instead of providing yet another bandaid to work around the situation, fix it in the hrtimers infrastructure instead: always migrate away a timer to an online target whenever it is enqueued from an offline CPU. This will also allow to revert all the above RCU disgraceful hacks. Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Reported-by: Vlad Poenaru <vlad.wing(a)gmail.com> Reported-by: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Tested-by: Paul E. McKenney <paulmck(a)kernel.org> Link: https://lore.kernel.org/all/20250117232433.24027-1-frederic@kernel.org Closes: 20241213203739.1519801-1-usamaarif642(a)gmail.com Conflicts: include/linux/hrtimer_defs.h include/linux/hrtimer.h [wxf: fix conflicts because 'struct hrtimer_cpu_base' is moved to another file.] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++-------- 2 files changed, 83 insertions(+), 21 deletions(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 30df0b35aafe..1ec9be2ce4be 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -244,6 +244,7 @@ struct hrtimer_cpu_base { ktime_t softirq_expires_next; struct hrtimer *softirq_next_timer; struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES]; + call_single_data_t csd; KABI_RESERVE(1) KABI_RESERVE(2) diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index 57e5cb36f1bc..a64c644df4ce 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -58,6 +58,8 @@ #define HRTIMER_ACTIVE_SOFT (HRTIMER_ACTIVE_HARD << MASK_SHIFT) #define HRTIMER_ACTIVE_ALL (HRTIMER_ACTIVE_SOFT | HRTIMER_ACTIVE_HARD) +static void retrigger_next_event(void *arg); + /* * The timer bases: * @@ -111,7 +113,8 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) = .clockid = CLOCK_TAI, .get_time = &ktime_get_clocktai, }, - } + }, + .csd = CSD_INIT(retrigger_next_event, NULL) }; static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { @@ -124,6 +127,14 @@ static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { [CLOCK_TAI] = HRTIMER_BASE_TAI, }; +static inline bool hrtimer_base_is_online(struct hrtimer_cpu_base *base) +{ + if (!IS_ENABLED(CONFIG_HOTPLUG_CPU)) + return true; + else + return likely(base->online); +} + /* * Functions and macros which are different for UP/SMP systems are kept in a * single place @@ -183,27 +194,54 @@ struct hrtimer_clock_base *lock_hrtimer_base(const struct hrtimer *timer, } /* - * We do not migrate the timer when it is expiring before the next - * event on the target cpu. When high resolution is enabled, we cannot - * reprogram the target cpu hardware and we would cause it to fire - * late. To keep it simple, we handle the high resolution enabled and - * disabled case similar. + * Check if the elected target is suitable considering its next + * event and the hotplug state of the current CPU. + * + * If the elected target is remote and its next event is after the timer + * to queue, then a remote reprogram is necessary. However there is no + * guarantee the IPI handling the operation would arrive in time to meet + * the high resolution deadline. In this case the local CPU becomes a + * preferred target, unless it is offline. + * + * High and low resolution modes are handled the same way for simplicity. * * Called with cpu_base->lock of target cpu held. */ -static int -hrtimer_check_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base) +static bool hrtimer_suitable_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base, + struct hrtimer_cpu_base *new_cpu_base, + struct hrtimer_cpu_base *this_cpu_base) { ktime_t expires; + /* + * The local CPU clockevent can be reprogrammed. Also get_target_base() + * guarantees it is online. + */ + if (new_cpu_base == this_cpu_base) + return true; + + /* + * The offline local CPU can't be the default target if the + * next remote target event is after this timer. Keep the + * elected new base. An IPI will we issued to reprogram + * it as a last resort. + */ + if (!hrtimer_base_is_online(this_cpu_base)) + return true; + expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset); - return expires < new_base->cpu_base->expires_next; + + return expires >= new_base->cpu_base->expires_next; } -static inline -struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, - int pinned) +static inline struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, int pinned) { + if (!hrtimer_base_is_online(base)) { + int cpu = cpumask_any_and(cpu_online_mask, housekeeping_cpumask(HK_TYPE_TIMER)); + + return &per_cpu(hrtimer_bases, cpu); + } + #if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ_COMMON) if (static_branch_likely(&timers_migration_enabled) && !pinned) return &per_cpu(hrtimer_bases, get_nohz_timer_target()); @@ -254,8 +292,8 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, raw_spin_unlock(&base->cpu_base->lock); raw_spin_lock(&new_base->cpu_base->lock); - if (new_cpu_base != this_cpu_base && - hrtimer_check_target(timer, new_base)) { + if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, + this_cpu_base)) { raw_spin_unlock(&new_base->cpu_base->lock); raw_spin_lock(&base->cpu_base->lock); new_cpu_base = this_cpu_base; @@ -264,8 +302,7 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, } WRITE_ONCE(timer->base, new_base); } else { - if (new_cpu_base != this_cpu_base && - hrtimer_check_target(timer, new_base)) { + if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, this_cpu_base)) { new_cpu_base = this_cpu_base; goto again; } @@ -730,8 +767,6 @@ static inline int hrtimer_is_hres_enabled(void) return hrtimer_hres_enabled; } -static void retrigger_next_event(void *arg); - /* * Switch to high resolution mode */ @@ -1218,6 +1253,7 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, u64 delta_ns, const enum hrtimer_mode mode, struct hrtimer_clock_base *base) { + struct hrtimer_cpu_base *this_cpu_base = this_cpu_ptr(&hrtimer_bases); struct hrtimer_clock_base *new_base; bool force_local, first; @@ -1229,9 +1265,15 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, * and enforce reprogramming after it is queued no matter whether * it is the new first expiring timer again or not. */ - force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases); + force_local = base->cpu_base == this_cpu_base; force_local &= base->cpu_base->next_timer == timer; + /* + * Don't force local queuing if this enqueue happens on a unplugged + * CPU after hrtimer_cpu_dying() has been invoked. + */ + force_local &= this_cpu_base->online; + /* * Remove an active timer from the queue. In case it is not queued * on the current CPU, make sure that remove_hrtimer() updates the @@ -1261,8 +1303,27 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, } first = enqueue_hrtimer(timer, new_base, mode); - if (!force_local) - return first; + if (!force_local) { + /* + * If the current CPU base is online, then the timer is + * never queued on a remote CPU if it would be the first + * expiring timer there. + */ + if (hrtimer_base_is_online(this_cpu_base)) + return first; + + /* + * Timer was enqueued remote because the current base is + * already offline. If the timer is the first to expire, + * kick the remote CPU to reprogram the clock event. + */ + if (first) { + struct hrtimer_cpu_base *new_cpu_base = new_base->cpu_base; + + smp_call_function_single_async(new_cpu_base->cpu, &new_cpu_base->csd); + } + return 0; + } /* * Timer was forced to stay on the current CPU to avoid -- 2.20.1

2 1

[PATCH OLK-6.6] PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: King Dix <kingdix10(a)qq.com> stable inclusion from stable-v6.6.76 commit 2c54b9fca1755e80a343ccfde0652dc5ea4744b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK2 CVE: CVE-2025-21804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 ] The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows: $ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff : Sometimes, garbage may appear after the colon. In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack. Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support") Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.c… Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Signed-off-by: King Dix <kingdix10(a)qq.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/controller/pcie-rcar-ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c index f9682df1da61..209719fb6ddc 100644 --- a/drivers/pci/controller/pcie-rcar-ep.c +++ b/drivers/pci/controller/pcie-rcar-ep.c @@ -107,7 +107,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, } if (!devm_request_mem_region(&pdev->dev, res->start, resource_size(res), - outbound_name)) { + res->name)) { dev_err(pcie->dev, "Cannot request memory region %s.\n", outbound_name); return -EIO; -- 2.20.1

2 1

[PATCH OLK-6.6] LoongArch: Fix warnings during S3 suspend
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v6.6.76 commit d49ab6857d98266010f3446c9c2063014db5b654 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK0 CVE: CVE-2025-21803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26c0a2d93af55d30a46d5f45d3e9c42cde730168 ] The enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(), and the later one may call the preempt_schedule_common() function, resulting in a thread switch and causing the CPU to be in an interrupt enabled state after the enable_gpe_wakeup() function returns, leading to the warnings as follow. [ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8 [ C0] ... [ C0] Call Trace: [ C0] [<90000000002243b4>] show_stack+0x64/0x188 [ C0] [<900000000164673c>] dump_stack_lvl+0x60/0x88 [ C0] [<90000000002687e4>] __warn+0x8c/0x148 [ C0] [<90000000015e9978>] report_bug+0x1c0/0x2b0 [ C0] [<90000000016478e4>] do_bp+0x204/0x3b8 [ C0] [<90000000025b1924>] exception_handlers+0x1924/0x10000 [ C0] [<9000000000343bbc>] ktime_get+0xbc/0xc8 [ C0] [<9000000000354c08>] tick_sched_timer+0x30/0xb0 [ C0] [<90000000003408e0>] __hrtimer_run_queues+0x160/0x378 [ C0] [<9000000000341f14>] hrtimer_interrupt+0x144/0x388 [ C0] [<9000000000228348>] constant_timer_interrupt+0x38/0x48 [ C0] [<90000000002feba4>] __handle_irq_event_percpu+0x64/0x1e8 [ C0] [<90000000002fed48>] handle_irq_event_percpu+0x20/0x80 [ C0] [<9000000000306b9c>] handle_percpu_irq+0x5c/0x98 [ C0] [<90000000002fd4a0>] generic_handle_domain_irq+0x30/0x48 [ C0] [<9000000000d0c7b0>] handle_cpu_irq+0x70/0xa8 [ C0] [<9000000001646b30>] handle_loongarch_irq+0x30/0x48 [ C0] [<9000000001646bc8>] do_vint+0x80/0xe0 [ C0] [<90000000002aea1c>] finish_task_switch.isra.0+0x8c/0x2a8 [ C0] [<900000000164e34c>] __schedule+0x314/0xa48 [ C0] [<900000000164ead8>] schedule+0x58/0xf0 [ C0] [<9000000000294a2c>] worker_thread+0x224/0x498 [ C0] [<900000000029d2f0>] kthread+0xf8/0x108 [ C0] [<9000000000221f28>] ret_from_kernel_thread+0xc/0xa4 [ C0] [ C0] ---[ end trace 0000000000000000 ]--- The root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect acpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause a thread switch. Since there is no longer concurrent execution during loongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes() directly in enable_gpe_wakeup(). The solution is similar to commit 22db06337f590d01 ("ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()"). Fixes: 366bb35a8e48 ("LoongArch: Add suspend (ACPI S3) support") Signed-off-by: Qunqin Zhao <zhaoqunqin(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- arch/loongarch/power/platform.c | 2 +- drivers/acpi/acpica/achware.h | 2 -- include/acpi/acpixf.h | 1 + 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/loongarch/power/platform.c b/arch/loongarch/power/platform.c index 3ea8e07aa225..6c7735cda4d8 100644 --- a/arch/loongarch/power/platform.c +++ b/arch/loongarch/power/platform.c @@ -17,7 +17,7 @@ void enable_gpe_wakeup(void) if (acpi_gbl_reduced_hardware) return; - acpi_enable_all_wakeup_gpes(); + acpi_hw_enable_all_wakeup_gpes(); } void enable_pci_wakeup(void) diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h index 79bbfe00d241..b8543a34caea 100644 --- a/drivers/acpi/acpica/achware.h +++ b/drivers/acpi/acpica/achware.h @@ -103,8 +103,6 @@ acpi_hw_get_gpe_status(struct acpi_gpe_event_info *gpe_event_info, acpi_status acpi_hw_enable_all_runtime_gpes(void); -acpi_status acpi_hw_enable_all_wakeup_gpes(void); - u8 acpi_hw_check_all_gpes(acpi_handle gpe_skip_device, u32 gpe_skip_number); acpi_status diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h index a3c9dd4a1ac3..7e9e7e769043 100644 --- a/include/acpi/acpixf.h +++ b/include/acpi/acpixf.h @@ -763,6 +763,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status *event_status)) ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_dispatch_gpe(acpi_handle gpe_device, u32 gpe_number)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_disable_all_gpes(void)) +ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_enable_all_wakeup_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void)) -- 2.20.1

2 1

[PATCH OLK-6.6] wifi: wcn36xx: fix channel survey memory allocation size
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Barnabás Czémán <barnabas.czeman(a)mainlining.org> stable inclusion from stable-v6.6.76 commit e95f9c408ff8311f75eeabc8acf34a66670d8815 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBLV CVE: CVE-2024-57997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6200d947f050efdba4090dfefd8a01981363d954 ] KASAN reported a memory allocation issue in wcn->chan_survey due to incorrect size calculation. This commit uses kcalloc to allocate memory for wcn->chan_survey, ensuring proper initialization and preventing the use of uninitialized values when there are no frames on the channel. Fixes: 29696e0aa413 ("wcn36xx: Track SNR and RSSI for each RX frame") Signed-off-by: Barnabás Czémán <barnabas.czeman(a)mainlining.org> Acked-by: Loic Poulain <loic.poulain(a)linaro.org> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Link: https://patch.msgid.link/20241104-wcn36xx-memory-allocation-v1-1-5ec901cf37… Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/net/wireless/ath/wcn36xx/main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c index 2bd1163177f0..9bbbc86fd2d9 100644 --- a/drivers/net/wireless/ath/wcn36xx/main.c +++ b/drivers/net/wireless/ath/wcn36xx/main.c @@ -1586,7 +1586,10 @@ static int wcn36xx_probe(struct platform_device *pdev) } n_channels = wcn_band_2ghz.n_channels + wcn_band_5ghz.n_channels; - wcn->chan_survey = devm_kmalloc(wcn->dev, n_channels, GFP_KERNEL); + wcn->chan_survey = devm_kcalloc(wcn->dev, + n_channels, + sizeof(struct wcn36xx_chan_survey), + GFP_KERNEL); if (!wcn->chan_survey) { ret = -ENOMEM; goto out_wq; -- 2.20.1

2 1

[PATCH OLK-6.6] OPP: add index check to assert to avoid buffer overflow in _read_freq()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Neil Armstrong <neil.armstrong(a)linaro.org> stable inclusion from stable-v6.6.76 commit eb6ffa0192ba83ece1a318b956265519c5c7dcec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBNO CVE: CVE-2024-57998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d659bc68ed489022ea33342cfbda2911a81e7a0d ] Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called from the indexed variants: dev_pm_opp_find_freq_exact_indexed() or dev_pm_opp_find_freq_ceil/floor_indexed(). Add a secondary parameter to the assert function, unused for assert_single_clk() then add assert_clk_index() which will check for the clock index when called from the _indexed() find functions. Fixes: 142e17c1c2b4 ("OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs") Fixes: a5893928bb17 ("OPP: Add dev_pm_opp_find_freq_exact_indexed()") Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/opp/core.c | 42 +++++++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/drivers/opp/core.c b/drivers/opp/core.c index bceb27b1baa1..3c26130dc75e 100644 --- a/drivers/opp/core.c +++ b/drivers/opp/core.c @@ -101,11 +101,21 @@ struct opp_table *_find_opp_table(struct device *dev) * representation in the OPP table and manage the clock configuration themselves * in an platform specific way. */ -static bool assert_single_clk(struct opp_table *opp_table) +static bool assert_single_clk(struct opp_table *opp_table, + unsigned int __always_unused index) { return !WARN_ON(opp_table->clk_count > 1); } +/* + * Returns true if clock table is large enough to contain the clock index. + */ +static bool assert_clk_index(struct opp_table *opp_table, + unsigned int index) +{ + return opp_table->clk_count > index; +} + /** * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an opp * @opp: opp for which voltage has to be returned for @@ -499,12 +509,12 @@ static struct dev_pm_opp *_opp_table_find_key(struct opp_table *opp_table, unsigned long (*read)(struct dev_pm_opp *opp, int index), bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, unsigned long opp_key, unsigned long key), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE); /* Assert that the requirement is met */ - if (assert && !assert(opp_table)) + if (assert && !assert(opp_table, index)) return ERR_PTR(-EINVAL); mutex_lock(&opp_table->lock); @@ -532,7 +542,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, unsigned long opp_key, unsigned long key), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { struct opp_table *opp_table; struct dev_pm_opp *opp; @@ -555,7 +565,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, static struct dev_pm_opp *_find_key_exact(struct device *dev, unsigned long key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { /* * The value of key will be updated here, but will be ignored as the @@ -568,7 +578,7 @@ static struct dev_pm_opp *_find_key_exact(struct device *dev, static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _opp_table_find_key(opp_table, key, index, available, read, _compare_ceil, assert); @@ -577,7 +587,7 @@ static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _find_key(dev, key, index, available, read, _compare_ceil, assert); @@ -586,7 +596,7 @@ static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, static struct dev_pm_opp *_find_key_floor(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _find_key(dev, key, index, available, read, _compare_floor, assert); @@ -647,7 +657,8 @@ struct dev_pm_opp * dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq, u32 index, bool available) { - return _find_key_exact(dev, freq, index, available, _read_freq, NULL); + return _find_key_exact(dev, freq, index, available, _read_freq, + assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact_indexed); @@ -707,7 +718,8 @@ struct dev_pm_opp * dev_pm_opp_find_freq_ceil_indexed(struct device *dev, unsigned long *freq, u32 index) { - return _find_key_ceil(dev, freq, index, true, _read_freq, NULL); + return _find_key_ceil(dev, freq, index, true, _read_freq, + assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil_indexed); @@ -760,7 +772,7 @@ struct dev_pm_opp * dev_pm_opp_find_freq_floor_indexed(struct device *dev, unsigned long *freq, u32 index) { - return _find_key_floor(dev, freq, index, true, _read_freq, NULL); + return _find_key_floor(dev, freq, index, true, _read_freq, assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor_indexed); @@ -1676,7 +1688,7 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq) if (IS_ERR(opp_table)) return; - if (!assert_single_clk(opp_table)) + if (!assert_single_clk(opp_table, 0)) goto put_table; mutex_lock(&opp_table->lock); @@ -2027,7 +2039,7 @@ int _opp_add_v1(struct opp_table *opp_table, struct device *dev, unsigned long tol; int ret; - if (!assert_single_clk(opp_table)) + if (!assert_single_clk(opp_table, 0)) return -EINVAL; new_opp = _opp_allocate(opp_table); @@ -2889,7 +2901,7 @@ static int _opp_set_availability(struct device *dev, unsigned long freq, return r; } - if (!assert_single_clk(opp_table)) { + if (!assert_single_clk(opp_table, 0)) { r = -EINVAL; goto put_table; } @@ -2965,7 +2977,7 @@ int dev_pm_opp_adjust_voltage(struct device *dev, unsigned long freq, return r; } - if (!assert_single_clk(opp_table)) { + if (!assert_single_clk(opp_table, 0)) { r = -EINVAL; goto put_table; } -- 2.20.1

2 1

[PATCH OLK-6.6] iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Qasim Ijaz <qasdev00(a)gmail.com> stable inclusion from stable-v6.6.76 commit 38ac76fc06bc6826a3e4b12a98efbe98432380a9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBI4 CVE: CVE-2025-21724 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e24c1551059268b37f6f40639883eafb281b8b9c ] Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type. To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type to match the operand's type. Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com Reported-by: syzbot <syzbot+85992ace37d5b7b51635(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635 Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com> Reviewed-by: Joao Martins <joao.m.martins(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/iommu/iommufd/iova_bitmap.c drivers/vfio/iova_bitmap.c [Context conflicts] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/iommu/iommufd/iova_bitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c index ca5a1757adcd..9527db8d7ba1 100644 --- a/drivers/iommu/iommufd/iova_bitmap.c +++ b/drivers/iommu/iommufd/iova_bitmap.c @@ -130,7 +130,7 @@ struct iova_bitmap { static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, unsigned long iova) { - unsigned long pgsize = 1 << bitmap->mapped.pgshift; + unsigned long pgsize = 1UL << bitmap->mapped.pgshift; return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize); } -- 2.20.1

2 1

[PATCH OLK-6.6] PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> mainline inclusion from mainline-v6.14-rc1 commit 3708acbd5f169ebafe1faa519cb28adc56295546 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC3J CVE: CVE-2024-58006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") set_bar() was modified to support dynamically changing the backing physical address of a BAR that was already configured. This means that set_bar() can be called twice, without ever calling clear_bar() (as calling clear_bar() would clear the BAR's PCI address assigned by the host). This can only be done if the new BAR size/flags does not differ from the existing BAR configuration. Add these missing checks. If we allow set_bar() to set e.g. a new BAR size that differs from the existing BAR size, the new address translation range will be smaller than the BAR size already determined by the host, which would mean that a read past the new BAR size would pass the iATU untranslated, which could allow the host to read memory not belonging to the new struct pci_epf_bar. While at it, add comments which clarifies the support for dynamically changing the physical address of a BAR. (Which was also missing.) Fixes: 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") Link: https://lore.kernel.org/r/20241213143301.4158431-10-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Cc: stable(a)vger.kernel.org Conflicts: drivers/pci/controller/dwc/pcie-designware-ep.c [wxf: fix conflicts because of the following commit is not merged. commit 33a6938e0c337 "PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()"] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- .../pci/controller/dwc/pcie-designware-ep.c | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c index f2e5feba5526..7fd64ac2cea1 100644 --- a/drivers/pci/controller/dwc/pcie-designware-ep.c +++ b/drivers/pci/controller/dwc/pcie-designware-ep.c @@ -256,8 +256,28 @@ static int dw_pcie_ep_set_bar(struct pci_epc *epc, u8 func_no, u8 vfunc_no, if (ret) return ret; - if (ep->epf_bar[bar]) + /* + * Certain EPF drivers dynamically change the physical address of a BAR + * (i.e. they call set_bar() twice, without ever calling clear_bar(), as + * calling clear_bar() would clear the BAR's PCI address assigned by the + * host). + */ + if (ep->epf_bar[bar]) { + /* + * We can only dynamically change a BAR if the new BAR size and + * BAR flags do not differ from the existing configuration. + */ + if (ep->epf_bar[bar]->barno != bar || + ep->epf_bar[bar]->size != size || + ep->epf_bar[bar]->flags != flags) + return -EINVAL; + + /* + * When dynamically changing a BAR, skip writing the BAR reg, as + * that would clear the BAR's PCI address assigned by the host. + */ return 0; + } dw_pcie_dbi_ro_wr_en(pci); -- 2.20.1

2 1

[PATCH OLK-6.6] afs: Fix the maximum cell name length
by Qi Xi 13 Mar '25

13 Mar '25

From: David Howells <dhowells(a)redhat.com> mainline inclusion from mainline-v6.13-rc7 commit 8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQL CVE: CVE-2025-21646 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning: WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405 because procfs limits the maximum filename length to 255. However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL). Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too. Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253. Fixes: c3e9f888263b ("afs: Implement client support for the YFSVL.GetCellName RPC op") Reported-by: syzbot+7848fee1f1e5c53f912b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/6776d25d.050a0220.3a8527.0048.GAE@google.com/ Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/376236.1736180460@warthog.procyon.org.uk Tested-by: syzbot+7848fee1f1e5c53f912b(a)syzkaller.appspotmail.com cc: Marc Dionne <marc.dionne(a)auristor.com> cc: linux-afs(a)lists.infradead.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 ++++++-- fs/afs/vlclient.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/afs/afs.h b/fs/afs/afs.h index 81815724db6c..25c17100798b 100644 --- a/fs/afs/afs.h +++ b/fs/afs/afs.h @@ -10,7 +10,7 @@ #include <linux/in.h> -#define AFS_MAXCELLNAME 256 /* Maximum length of a cell name */ +#define AFS_MAXCELLNAME 253 /* Maximum length of a cell name (DNS limited) */ #define AFS_MAXVOLNAME 64 /* Maximum length of a volume name */ #define AFS_MAXNSERVERS 8 /* Maximum servers in a basic volume record */ #define AFS_NMAXNSERVERS 13 /* Maximum servers in a N/U-class volume record */ diff --git a/fs/afs/afs_vl.h b/fs/afs/afs_vl.h index 9c65ffb8a523..8da0899fbc08 100644 --- a/fs/afs/afs_vl.h +++ b/fs/afs/afs_vl.h @@ -13,6 +13,7 @@ #define AFS_VL_PORT 7003 /* volume location service port */ #define VL_SERVICE 52 /* RxRPC service ID for the Volume Location service */ #define YFS_VL_SERVICE 2503 /* Service ID for AuriStor upgraded VL service */ +#define YFS_VL_MAXCELLNAME 256 /* Maximum length of a cell name in YFS protocol */ enum AFSVL_Operations { VLGETENTRYBYID = 503, /* AFS Get VLDB entry by ID */ diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c index f04a80e4f5c3..83cf1bfbe343 100644 --- a/fs/afs/vl_alias.c +++ b/fs/afs/vl_alias.c @@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key) static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) { struct afs_cell *master; + size_t name_len; char *cell_name; cell_name = afs_vl_get_cell_name(cell, key); @@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) return 0; } - master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name), - NULL, false); + name_len = strlen(cell_name); + if (!name_len || name_len > AFS_MAXCELLNAME) + master = ERR_PTR(-EOPNOTSUPP); + else + master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false); kfree(cell_name); if (IS_ERR(master)) return PTR_ERR(master); diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c index 00fca3c66ba6..16653f2ffe4f 100644 --- a/fs/afs/vlclient.c +++ b/fs/afs/vlclient.c @@ -671,7 +671,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call) return ret; namesz = ntohl(call->tmp); - if (namesz > AFS_MAXCELLNAME) + if (namesz > YFS_VL_MAXCELLNAME) return afs_protocol_error(call, afs_eproto_cellname_len); paddedsz = (namesz + 3) & ~3; call->count = namesz; -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] powerpc/pseries: Fix use after free in remove_phb_dynamic()
by Qi Xi 13 Mar '25

13 Mar '25

From: Michael Ellerman <mpe(a)ellerman.id.au> mainline inclusion from mainline-v5.18-rc1 commit fe2640bd7a62f1f7c3f55fbda31084085075bc30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1SK CVE: CVE-2022-49196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host_bridge. If there are no outstanding references when we call device_unregister() then phb will be freed out from under us. This has gone mainly unnoticed, but with slub_debug and page_poison enabled it can lead to a crash: PID: 7574 TASK: c0000000d492cb80 CPU: 13 COMMAND: "drmgr" #0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc #1 [c0000000e4f075d0] oops_end at c000000000029608 #2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4 #3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8 #4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30 Data SLB Access [380] exception frame: R0: c000000000167250 R1: c0000000e4f07a00 R2: c000000002a46100 R3: c000000002b39ce8 R4: 00000000000000c0 R5: 00000000000000a9 R6: 3894674d000000c0 R7: 0000000000000000 R8: 00000000000000ff R9: 0000000000000100 R10: 6b6b6b6b6b6b6b6b R11: 0000000000008000 R12: c00000000023da80 R13: c0000009ffd38b00 R14: 0000000000000000 R15: 000000011c87f0f0 R16: 0000000000000006 R17: 0000000000000003 R18: 0000000000000002 R19: 0000000000000004 R20: 0000000000000005 R21: 000000011c87ede8 R22: 000000011c87c5a8 R23: 000000011c87d3a0 R24: 0000000000000000 R25: 0000000000000001 R26: c0000000e4f07cc8 R27: c00000004d1cc400 R28: c0080000031d00e8 R29: c00000004d23d800 R30: c00000004d1d2400 R31: c00000004d1d2540 NIP: c000000000167258 MSR: 8000000000009033 OR3: c000000000e9f474 CTR: 0000000000000000 LR: c000000000167250 XER: 0000000020040003 CCR: 0000000024088420 MQ: 0000000000000000 DAR: 6b6b6b6b6b6b6ba3 DSISR: c0000000e4f07920 Syscall Result: fffffffffffffff2 [NIP : release_resource+56] [LR : release_resource+48] #5 [c0000000e4f07a00] release_resource at c000000000167258 (unreliable) #6 [c0000000e4f07a30] remove_phb_dynamic at c000000000105648 #7 [c0000000e4f07ab0] dlpar_remove_slot at c0080000031a09e8 [rpadlpar_io] #8 [c0000000e4f07b50] remove_slot_store at c0080000031a0b9c [rpadlpar_io] #9 [c0000000e4f07be0] kobj_attr_store at c000000000817d8c #10 [c0000000e4f07c00] sysfs_kf_write at c00000000063e504 #11 [c0000000e4f07c20] kernfs_fop_write_iter at c00000000063d868 #12 [c0000000e4f07c70] new_sync_write at c00000000054339c #13 [c0000000e4f07d10] vfs_write at c000000000546624 #14 [c0000000e4f07d60] ksys_write at c0000000005469f4 #15 [c0000000e4f07db0] system_call_exception at c000000000030840 #16 [c0000000e4f07e10] system_call_vectored_common at c00000000000c168 To avoid it, we can take a reference to the host_bridge->dev until we're done using phb. Then when we drop the reference the phb will be freed. Fixes: 2dd9c11b9d4d ("powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb)") Reported-by: David Dai <zdai(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Tested-by: Sachin Sant <sachinp(a)linux.ibm.com> Link: https://lore.kernel.org/r/20220318034219.1188008-1-mpe@ellerman.id.au Conflicts: arch/powerpc/platforms/pseries/pci_dlpar.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/powerpc/platforms/pseries/pci_dlpar.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c index 561917fa54a8..bf4ca557c32d 100644 --- a/arch/powerpc/platforms/pseries/pci_dlpar.c +++ b/arch/powerpc/platforms/pseries/pci_dlpar.c @@ -89,6 +89,9 @@ int remove_phb_dynamic(struct pci_controller *phb) } } + /* Keep a reference so phb isn't freed yet */ + get_device(&host_bridge->dev); + /* Remove the PCI bus and unregister the bridge device from sysfs */ phb->bus = NULL; pci_remove_bus(b); @@ -111,6 +114,7 @@ int remove_phb_dynamic(struct pci_controller *phb) * the pcibios_free_controller_deferred() callback; * see pseries_root_bridge_prepare(). */ + put_device(&host_bridge->dev); return 0; } -- 2.33.0

2 1

[PATCH OLK-6.6 v2 1/2] fuse: cleanup request queuing towards virtiofs
by Yang Erkun 13 Mar '25

13 Mar '25

From: Miklos Szeredi <mszeredi(a)redhat.com> mainline inclusion from mainline-v6.12-rc1 commit 5de8acb41c86f1d335d165e0a350441ea3a1f480 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBT4CQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Virtiofs has its own queuing mechanism, but still requests are first queued on fiq->pending to be immediately dequeued and queued onto the virtio queue. The queuing on fiq->pending is unnecessary and might even have some performance impact due to being a contention point. Forget requests are handled similarly. Move the queuing of requests and forgets into the fiq->ops->*. fuse_iqueue_ops are renamed to reflect the new semantics. Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Fixed-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Reviewed-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Tested-by: Peter-Jan Gootzen <pgootzen(a)nvidia.com> Reviewed-by: Peter-Jan Gootzen <pgootzen(a)nvidia.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/dev.c fs/fuse/fuse_i.h fs/fuse/virtio_fs.c [Context conflicts] Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/fuse/dev.c | 157 ++++++++++++++++++++++++-------------------- fs/fuse/fuse_i.h | 19 ++---- fs/fuse/virtio_fs.c | 41 ++++-------- 3 files changed, 105 insertions(+), 112 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 8573d79ef29c..51330a688b17 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -192,11 +192,22 @@ unsigned int fuse_len_args(unsigned int numargs, struct fuse_arg *args) } EXPORT_SYMBOL_GPL(fuse_len_args); -u64 fuse_get_unique(struct fuse_iqueue *fiq) +static u64 fuse_get_unique_locked(struct fuse_iqueue *fiq) { fiq->reqctr += FUSE_REQ_ID_STEP; return fiq->reqctr; } + +u64 fuse_get_unique(struct fuse_iqueue *fiq) +{ + u64 ret; + + spin_lock(&fiq->lock); + ret = fuse_get_unique_locked(fiq); + spin_unlock(&fiq->lock); + + return ret; +} EXPORT_SYMBOL_GPL(fuse_get_unique); static unsigned int fuse_req_hash(u64 unique) @@ -215,22 +226,68 @@ __releases(fiq->lock) spin_unlock(&fiq->lock); } +static void fuse_dev_queue_forget(struct fuse_iqueue *fiq, struct fuse_forget_link *forget) +{ + spin_lock(&fiq->lock); + if (fiq->connected) { + fiq->forget_list_tail->next = forget; + fiq->forget_list_tail = forget; + fuse_dev_wake_and_unlock(fiq); + } else { + kfree(forget); + spin_unlock(&fiq->lock); + } +} + +static void fuse_dev_queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) +{ + spin_lock(&fiq->lock); + if (list_empty(&req->intr_entry)) { + list_add_tail(&req->intr_entry, &fiq->interrupts); + /* + * Pairs with smp_mb() implied by test_and_set_bit() + * from fuse_request_end(). + */ + smp_mb(); + if (test_bit(FR_FINISHED, &req->flags)) { + list_del_init(&req->intr_entry); + spin_unlock(&fiq->lock); + } else { + fuse_dev_wake_and_unlock(fiq); + } + } else { + spin_unlock(&fiq->lock); + } +} + +static void fuse_dev_queue_req(struct fuse_iqueue *fiq, struct fuse_req *req) +{ + spin_lock(&fiq->lock); + if (fiq->connected) { + if (req->in.h.opcode != FUSE_NOTIFY_REPLY) + req->in.h.unique = fuse_get_unique_locked(fiq); + list_add_tail(&req->list, &fiq->pending); + fuse_dev_wake_and_unlock(fiq); + } else { + spin_unlock(&fiq->lock); + req->out.h.error = -ENOTCONN; + fuse_request_end(req); + } +} + const struct fuse_iqueue_ops fuse_dev_fiq_ops = { - .wake_forget_and_unlock = fuse_dev_wake_and_unlock, - .wake_interrupt_and_unlock = fuse_dev_wake_and_unlock, - .wake_pending_and_unlock = fuse_dev_wake_and_unlock, + .send_forget = fuse_dev_queue_forget, + .send_interrupt = fuse_dev_queue_interrupt, + .send_req = fuse_dev_queue_req, }; EXPORT_SYMBOL_GPL(fuse_dev_fiq_ops); -static void queue_request_and_unlock(struct fuse_iqueue *fiq, - struct fuse_req *req) -__releases(fiq->lock) +static void fuse_send_one(struct fuse_iqueue *fiq, struct fuse_req *req) { req->in.h.len = sizeof(struct fuse_in_header) + fuse_len_args(req->args->in_numargs, (struct fuse_arg *) req->args->in_args); - list_add_tail(&req->list, &fiq->pending); - fiq->ops->wake_pending_and_unlock(fiq); + fiq->ops->send_req(fiq, req); } void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, @@ -241,15 +298,7 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, forget->forget_one.nodeid = nodeid; forget->forget_one.nlookup = nlookup; - spin_lock(&fiq->lock); - if (fiq->connected) { - fiq->forget_list_tail->next = forget; - fiq->forget_list_tail = forget; - fiq->ops->wake_forget_and_unlock(fiq); - } else { - kfree(forget); - spin_unlock(&fiq->lock); - } + fiq->ops->send_forget(fiq, forget); } static void flush_bg_queue(struct fuse_conn *fc) @@ -263,9 +312,7 @@ static void flush_bg_queue(struct fuse_conn *fc) req = list_first_entry(&fc->bg_queue, struct fuse_req, list); list_del(&req->list); fc->active_background++; - spin_lock(&fiq->lock); - req->in.h.unique = fuse_get_unique(fiq); - queue_request_and_unlock(fiq, req); + fuse_send_one(fiq, req); } } @@ -335,29 +382,12 @@ static int queue_interrupt(struct fuse_req *req) { struct fuse_iqueue *fiq = &req->fm->fc->iq; - spin_lock(&fiq->lock); /* Check for we've sent request to interrupt this req */ - if (unlikely(!test_bit(FR_INTERRUPTED, &req->flags))) { - spin_unlock(&fiq->lock); + if (unlikely(!test_bit(FR_INTERRUPTED, &req->flags))) return -EINVAL; - } - if (list_empty(&req->intr_entry)) { - list_add_tail(&req->intr_entry, &fiq->interrupts); - /* - * Pairs with smp_mb() implied by test_and_set_bit() - * from fuse_request_end(). - */ - smp_mb(); - if (test_bit(FR_FINISHED, &req->flags)) { - list_del_init(&req->intr_entry); - spin_unlock(&fiq->lock); - return 0; - } - fiq->ops->wake_interrupt_and_unlock(fiq); - } else { - spin_unlock(&fiq->lock); - } + fiq->ops->send_interrupt(fiq, req); + return 0; } @@ -412,21 +442,15 @@ static void __fuse_request_send(struct fuse_req *req) struct fuse_iqueue *fiq = &req->fm->fc->iq; BUG_ON(test_bit(FR_BACKGROUND, &req->flags)); - spin_lock(&fiq->lock); - if (!fiq->connected) { - spin_unlock(&fiq->lock); - req->out.h.error = -ENOTCONN; - } else { - req->in.h.unique = fuse_get_unique(fiq); - /* acquire extra reference, since request is still needed - after fuse_request_end() */ - __fuse_get_request(req); - queue_request_and_unlock(fiq, req); - request_wait_answer(req); - /* Pairs with smp_wmb() in fuse_request_end() */ - smp_rmb(); - } + /* acquire extra reference, since request is still needed after + fuse_request_end() */ + __fuse_get_request(req); + fuse_send_one(fiq, req); + + request_wait_answer(req); + /* Pairs with smp_wmb() in fuse_request_end() */ + smp_rmb(); } static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args) @@ -581,7 +605,6 @@ static int fuse_simple_notify_reply(struct fuse_mount *fm, { struct fuse_req *req; struct fuse_iqueue *fiq = &fm->fc->iq; - int err = 0; req = fuse_get_req(fm, false); if (IS_ERR(req)) @@ -592,16 +615,9 @@ static int fuse_simple_notify_reply(struct fuse_mount *fm, fuse_args_to_req(req, args); - spin_lock(&fiq->lock); - if (fiq->connected) { - queue_request_and_unlock(fiq, req); - } else { - err = -ENODEV; - spin_unlock(&fiq->lock); - fuse_put_request(req); - } + fuse_send_one(fiq, req); - return err; + return 0; } /* @@ -1076,9 +1092,9 @@ __releases(fiq->lock) return err ? err : reqsize; } -struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, - unsigned int max, - unsigned int *countp) +static struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, + unsigned int max, + unsigned int *countp) { struct fuse_forget_link *head = fiq->forget_list_head.next; struct fuse_forget_link **newhead = &head; @@ -1097,7 +1113,6 @@ struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, return head; } -EXPORT_SYMBOL(fuse_dequeue_forget); static int fuse_read_single_forget(struct fuse_iqueue *fiq, struct fuse_copy_state *cs, @@ -1112,7 +1127,7 @@ __releases(fiq->lock) struct fuse_in_header ih = { .opcode = FUSE_FORGET, .nodeid = forget->forget_one.nodeid, - .unique = fuse_get_unique(fiq), + .unique = fuse_get_unique_locked(fiq), .len = sizeof(ih) + sizeof(arg), }; @@ -1143,7 +1158,7 @@ __releases(fiq->lock) struct fuse_batch_forget_in arg = { .count = 0 }; struct fuse_in_header ih = { .opcode = FUSE_BATCH_FORGET, - .unique = fuse_get_unique(fiq), + .unique = fuse_get_unique_locked(fiq), .len = sizeof(ih) + sizeof(arg), }; diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 1bb136bcbe9e..8d702f96b9e5 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -416,22 +416,19 @@ struct fuse_iqueue; */ struct fuse_iqueue_ops { /** - * Signal that a forget has been queued + * Send one forget */ - void (*wake_forget_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_forget)(struct fuse_iqueue *fiq, struct fuse_forget_link *link); /** - * Signal that an INTERRUPT request has been queued + * Send interrupt for request */ - void (*wake_interrupt_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_interrupt)(struct fuse_iqueue *fiq, struct fuse_req *req); /** - * Signal that a request has been queued + * Send one request */ - void (*wake_pending_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_req)(struct fuse_iqueue *fiq, struct fuse_req *req); /** * Clean up when fuse_iqueue is destroyed @@ -1019,10 +1016,6 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, struct fuse_forget_link *fuse_alloc_forget(void); -struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, - unsigned int max, - unsigned int *countp); - /* * Initialize READ or READDIR request */ diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index ba816b50c1d4..a6e31e68906a 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1083,22 +1083,13 @@ static struct virtio_driver virtio_fs_driver = { #endif }; -static void virtio_fs_wake_forget_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_forget(struct fuse_iqueue *fiq, struct fuse_forget_link *link) { - struct fuse_forget_link *link; struct virtio_fs_forget *forget; struct virtio_fs_forget_req *req; - struct virtio_fs *fs; - struct virtio_fs_vq *fsvq; - u64 unique; - - link = fuse_dequeue_forget(fiq, 1, NULL); - unique = fuse_get_unique(fiq); - - fs = fiq->priv; - fsvq = &fs->vqs[VQ_HIPRIO]; - spin_unlock(&fiq->lock); + struct virtio_fs *fs = fiq->priv; + struct virtio_fs_vq *fsvq = &fs->vqs[VQ_HIPRIO]; + u64 unique = fuse_get_unique(fiq); /* Allocate a buffer for the request */ forget = kmalloc(sizeof(*forget), GFP_NOFS | __GFP_NOFAIL); @@ -1118,8 +1109,7 @@ __releases(fiq->lock) kfree(link); } -static void virtio_fs_wake_interrupt_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) { /* * TODO interrupts. @@ -1128,7 +1118,6 @@ __releases(fiq->lock) * Exceptions are blocking lock operations; for example fcntl(F_SETLKW) * with shared lock between host and guest. */ - spin_unlock(&fiq->lock); } /* Count number of scatter-gather elements required */ @@ -1333,21 +1322,17 @@ static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq, return ret; } -static void virtio_fs_wake_pending_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_req(struct fuse_iqueue *fiq, struct fuse_req *req) { unsigned int queue_id; struct virtio_fs *fs; - struct fuse_req *req; struct virtio_fs_vq *fsvq; int ret; - WARN_ON(list_empty(&fiq->pending)); - req = list_last_entry(&fiq->pending, struct fuse_req, list); + if (req->in.h.opcode != FUSE_NOTIFY_REPLY) + req->in.h.unique = fuse_get_unique(fiq); + clear_bit(FR_PENDING, &req->flags); - list_del_init(&req->list); - WARN_ON(!list_empty(&fiq->pending)); - spin_unlock(&fiq->lock); fs = fiq->priv; queue_id = VQ_REQUEST + fs->mq_map[raw_smp_processor_id()]; @@ -1387,10 +1372,10 @@ __releases(fiq->lock) } static const struct fuse_iqueue_ops virtio_fs_fiq_ops = { - .wake_forget_and_unlock = virtio_fs_wake_forget_and_unlock, - .wake_interrupt_and_unlock = virtio_fs_wake_interrupt_and_unlock, - .wake_pending_and_unlock = virtio_fs_wake_pending_and_unlock, - .release = virtio_fs_fiq_release, + .send_forget = virtio_fs_send_forget, + .send_interrupt = virtio_fs_send_interrupt, + .send_req = virtio_fs_send_req, + .release = virtio_fs_fiq_release, }; static inline void virtio_fs_ctx_set_defaults(struct fuse_fs_context *ctx) -- 2.39.2

1 1