- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 4d69fb4cf803..bb37e8f08ae5 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1090,6 +1090,7 @@ static struct file *io_file_get(struct io_ring_ctx *ctx, unsigned int issue_flags); static void __io_queue_sqe(struct io_kiocb *req); static void io_rsrc_put_work(struct work_struct *work); +static void io_req_task_queue_fail(struct io_kiocb *req, int ret); static void io_req_task_queue(struct io_kiocb *req); static void io_submit_flush_completions(struct io_ring_ctx *ctx); @@ -1459,7 +1460,11 @@ static void io_queue_async_work(struct io_kiocb *req, bool *locked) locked = NULL; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 5

[PATCH OLK-5.10] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 6e5e00a7692c..3a1eee5bac77 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -1096,6 +1096,7 @@ static struct file *io_file_get(struct io_ring_ctx *ctx, unsigned int issue_flags); static void __io_queue_sqe(struct io_kiocb *req); static void io_rsrc_put_work(struct work_struct *work); +static void io_req_task_queue_fail(struct io_kiocb *req, int ret); static void io_req_task_queue(struct io_kiocb *req); static void io_submit_flush_completions(struct io_ring_ctx *ctx); @@ -1465,7 +1466,11 @@ static void io_queue_async_work(struct io_kiocb *req, bool *locked) locked = NULL; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 5

[PATCH OLK-6.6] drm/loongson: compile loongson drm driver as module
by Hongchen Zhang 30 Dec '24

30 Dec '24

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB8U6Q CVE: NA -------------------------------- loongson drm driver will not be used in the future, use loongson drm dkms package instead. Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 4 ++-- drivers/gpu/drm/Makefile | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index d39551df782b..0b8f8b23b7de 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -1471,11 +1471,11 @@ CONFIG_DRM_AMDGPU_USERPTR=y CONFIG_DRM_NOUVEAU=m CONFIG_DRM_VKMS=m CONFIG_DRM_UDL=m -CONFIG_DRM_AST_LOONGSON=y CONFIG_DRM_MGAG200=m CONFIG_DRM_QXL=m CONFIG_DRM_VIRTIO_GPU=m -CONFIG_DRM_LOONGSON=y +CONFIG_DRM_LOONGSON=m +CONFIG_DRM_AST_LOONGSON=y CONFIG_DRM_BOCHS=m CONFIG_DRM_CIRRUS_QEMU=m CONFIG_FB=y diff --git a/drivers/gpu/drm/Makefile b/drivers/gpu/drm/Makefile index b120267fbe40..7ba2ec90c3f7 100644 --- a/drivers/gpu/drm/Makefile +++ b/drivers/gpu/drm/Makefile @@ -197,6 +197,6 @@ obj-y += gud/ obj-$(CONFIG_DRM_HYPERV) += hyperv/ obj-y += solomon/ obj-$(CONFIG_DRM_SPRD) += sprd/ -obj-$(CONFIG_DRM_LOONGSON) += loongson/ +obj-y += loongson/ obj-$(CONFIG_DRM_PHYTIUM) += phytium/ obj-$(CONFIG_HYDCU_FIXUP_HEADER) += hygon/hydcu-fixup-header/ -- 2.33.0

2 5

[PATCH OLK-6.6] LoongArch: Add CPU HWMon platform driver
by Hongchen Zhang 30 Dec '24

30 Dec '24

From: gaojuxin <gaojuxin(a)loongson.cn> LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBEN7V CVE: NA -------------------------------- This add CPU HWMon (temperature sensor) platform driver for Loongson-3. Change-Id: I1d4c0e0a305f25f2b1ddfe27f371b40fa1689f9e Tested-by: Xi Ruoyao <xry111(a)xry111.site> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Kexy Biscuit <kexybiscuit(a)aosc.io> Signed-off-by: gaojuxin <gaojuxin(a)loongson.cn> --- drivers/platform/loongarch/Kconfig | 8 + drivers/platform/loongarch/Makefile | 1 + drivers/platform/loongarch/cpu_hwmon.c | 194 +++++++++++++++++++++++++ 3 files changed, 203 insertions(+) create mode 100644 drivers/platform/loongarch/cpu_hwmon.c diff --git a/drivers/platform/loongarch/Kconfig b/drivers/platform/loongarch/Kconfig index 5633e4d73991..9ec1a86ef7fa 100644 --- a/drivers/platform/loongarch/Kconfig +++ b/drivers/platform/loongarch/Kconfig @@ -16,6 +16,14 @@ menuconfig LOONGARCH_PLATFORM_DEVICES if LOONGARCH_PLATFORM_DEVICES +config CPU_HWMON + bool "Loongson CPU HWMon Driver" + depends on MACH_LOONGSON64 + select HWMON + default y + help + Loongson-3A/3B/3C CPU HWMon (temperature sensor) driver. + config LOONGSON_LAPTOP tristate "Generic Loongson-3 Laptop Driver" depends on ACPI diff --git a/drivers/platform/loongarch/Makefile b/drivers/platform/loongarch/Makefile index f43ab03db1a2..695688bed423 100644 --- a/drivers/platform/loongarch/Makefile +++ b/drivers/platform/loongarch/Makefile @@ -1 +1,2 @@ obj-$(CONFIG_LOONGSON_LAPTOP) += loongson-laptop.o +obj-$(CONFIG_CPU_HWMON) += cpu_hwmon.o diff --git a/drivers/platform/loongarch/cpu_hwmon.c b/drivers/platform/loongarch/cpu_hwmon.c new file mode 100644 index 000000000000..93a05993745a --- /dev/null +++ b/drivers/platform/loongarch/cpu_hwmon.c @@ -0,0 +1,194 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2022 Loongson Technology Corporation Limited + */ +#include <linux/module.h> +#include <linux/reboot.h> +#include <linux/jiffies.h> +#include <linux/hwmon.h> +#include <linux/hwmon-sysfs.h> + +#include <asm/loongson.h> + +static int nr_packages; +static struct device *cpu_hwmon_dev; + +static int loongson3_cpu_temp(int cpu) +{ + u32 reg; + + reg = iocsr_read32(LOONGARCH_IOCSR_CPUTEMP) & 0xff; + + return (int)((s8)reg) * 1000; +} + +static ssize_t cpu_temp_label(struct device *dev, + struct device_attribute *attr, char *buf) +{ + int id = (to_sensor_dev_attr(attr))->index - 1; + return sprintf(buf, "CPU %d Temperature\n", id); +} + +static ssize_t get_cpu_temp(struct device *dev, + struct device_attribute *attr, char *buf) +{ + int id = (to_sensor_dev_attr(attr))->index - 1; + int value = loongson3_cpu_temp(id); + return sprintf(buf, "%d\n", value); +} + +static SENSOR_DEVICE_ATTR(temp1_input, 0444, get_cpu_temp, NULL, 1); +static SENSOR_DEVICE_ATTR(temp1_label, 0444, cpu_temp_label, NULL, 1); +static SENSOR_DEVICE_ATTR(temp2_input, 0444, get_cpu_temp, NULL, 2); +static SENSOR_DEVICE_ATTR(temp2_label, 0444, cpu_temp_label, NULL, 2); +static SENSOR_DEVICE_ATTR(temp3_input, 0444, get_cpu_temp, NULL, 3); +static SENSOR_DEVICE_ATTR(temp3_label, 0444, cpu_temp_label, NULL, 3); +static SENSOR_DEVICE_ATTR(temp4_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp4_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp5_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp5_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp6_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp6_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp7_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp7_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp8_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp8_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp9_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp9_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp10_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp10_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp11_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp11_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp12_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp12_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp13_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp13_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp14_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp14_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp15_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp15_label, 0444, cpu_temp_label, NULL, 4); +static SENSOR_DEVICE_ATTR(temp16_input, 0444, get_cpu_temp, NULL, 4); +static SENSOR_DEVICE_ATTR(temp16_label, 0444, cpu_temp_label, NULL, 4); + +static struct attribute *cpu_hwmon_attributes[] = { + &sensor_dev_attr_temp1_input.dev_attr.attr, + &sensor_dev_attr_temp1_label.dev_attr.attr, + &sensor_dev_attr_temp2_input.dev_attr.attr, + &sensor_dev_attr_temp2_label.dev_attr.attr, + &sensor_dev_attr_temp3_input.dev_attr.attr, + &sensor_dev_attr_temp3_label.dev_attr.attr, + &sensor_dev_attr_temp4_input.dev_attr.attr, + &sensor_dev_attr_temp4_label.dev_attr.attr, + &sensor_dev_attr_temp5_input.dev_attr.attr, + &sensor_dev_attr_temp5_label.dev_attr.attr, + &sensor_dev_attr_temp6_input.dev_attr.attr, + &sensor_dev_attr_temp6_label.dev_attr.attr, + &sensor_dev_attr_temp7_input.dev_attr.attr, + &sensor_dev_attr_temp7_label.dev_attr.attr, + &sensor_dev_attr_temp8_input.dev_attr.attr, + &sensor_dev_attr_temp8_label.dev_attr.attr, + &sensor_dev_attr_temp9_input.dev_attr.attr, + &sensor_dev_attr_temp9_label.dev_attr.attr, + &sensor_dev_attr_temp10_input.dev_attr.attr, + &sensor_dev_attr_temp10_label.dev_attr.attr, + &sensor_dev_attr_temp11_input.dev_attr.attr, + &sensor_dev_attr_temp11_label.dev_attr.attr, + &sensor_dev_attr_temp12_input.dev_attr.attr, + &sensor_dev_attr_temp12_label.dev_attr.attr, + &sensor_dev_attr_temp13_input.dev_attr.attr, + &sensor_dev_attr_temp13_label.dev_attr.attr, + &sensor_dev_attr_temp14_input.dev_attr.attr, + &sensor_dev_attr_temp14_label.dev_attr.attr, + &sensor_dev_attr_temp15_input.dev_attr.attr, + &sensor_dev_attr_temp15_label.dev_attr.attr, + &sensor_dev_attr_temp16_input.dev_attr.attr, + &sensor_dev_attr_temp16_label.dev_attr.attr, + NULL +}; +static umode_t cpu_hwmon_is_visible(struct kobject *kobj, + struct attribute *attr, int i) +{ + int id = i / 2; + + if (id < nr_packages) + return attr->mode; + return 0; +} + +static struct attribute_group cpu_hwmon_group = { + .attrs = cpu_hwmon_attributes, + .is_visible = cpu_hwmon_is_visible, +}; + +static const struct attribute_group *cpu_hwmon_groups[] = { + &cpu_hwmon_group, + NULL +}; + +static int cpu_initial_threshold = 72000; +static int cpu_thermal_threshold = 96000; +module_param(cpu_thermal_threshold, int, 0644); +MODULE_PARM_DESC(cpu_thermal_threshold, "cpu thermal threshold (96000 (default))"); + +static struct delayed_work thermal_work; + +static void do_thermal_timer(struct work_struct *work) +{ + int i, value, temp_max = 0; + + for (i=0; i<nr_packages; i++) { + value = loongson3_cpu_temp(i); + if (value > temp_max) + temp_max = value; + } + + if (temp_max <= cpu_thermal_threshold) + schedule_delayed_work(&thermal_work, msecs_to_jiffies(5000)); + else + orderly_poweroff(true); +} + +static int __init loongson_hwmon_init(void) +{ + int i, value, temp_max = 0; + + pr_info("Loongson Hwmon Enter...\n"); + + nr_packages = loongson_sysconf.nr_cpus / + loongson_sysconf.cores_per_package; + + cpu_hwmon_dev = hwmon_device_register_with_groups(NULL, "cpu_hwmon", + NULL, cpu_hwmon_groups); + if (IS_ERR(cpu_hwmon_dev)) { + pr_err("Hwmon register fail with %ld!\n", PTR_ERR(cpu_hwmon_dev)); + return PTR_ERR(cpu_hwmon_dev); + } + + for (i = 0; i < nr_packages; i++) { + value = loongson3_cpu_temp(i); + if (value > temp_max) + temp_max = value; + } + + pr_info("Initial CPU temperature is %d (highest).\n", temp_max); + if (temp_max > cpu_initial_threshold) + cpu_thermal_threshold += temp_max - cpu_initial_threshold; + + INIT_DEFERRABLE_WORK(&thermal_work, do_thermal_timer); + schedule_delayed_work(&thermal_work, msecs_to_jiffies(20000)); + + return 0; +} + +static void __exit loongson_hwmon_exit(void) +{ + cancel_delayed_work_sync(&thermal_work); + hwmon_device_unregister(cpu_hwmon_dev); +} + +module_init(loongson_hwmon_init); +module_exit(loongson_hwmon_exit); + +MODULE_AUTHOR("Huacai Chen <chenhuacai(a)loongson.cn>"); +MODULE_DESCRIPTION("Loongson CPU Hwmon driver"); +MODULE_LICENSE("GPL"); -- 2.33.0

2 1

[openeuler:openEuler-1.0-LTS 1356/1356] drivers/mfd/rohm-bd718x7.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 30 Dec '24

30 Dec '24

Hi Matti, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 30107fa6908b6c2747ee9100b40af813f99483c3 [1356/1356] mfd: bd71837: Core driver for ROHM BD71837 PMIC config: x86_64-buildonly-randconfig-003-20241228 (https://download.01.org/0day-ci/archive/20241230/202412301525.GctcPXAM-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241230/202412301525.GctcPXAM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412301525.GctcPXAM-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/mfd/rohm-bd718x7.c:15: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'bd71837_i2c_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ drivers/mfd/rohm-bd718x7.c:207:1: note: in expansion of macro 'module_exit' 207 | module_exit(bd71837_i2c_exit); | ^~~~~~~~~~~ drivers/mfd/rohm-bd718x7.c:203:20: note: 'cleanup_module' target declared here 203 | static void __exit bd71837_i2c_exit(void) | ^~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'bd71837_i2c_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/module.h:115:41: note: in expansion of macro 'module_init' 115 | #define subsys_initcall(fn) module_init(fn) | ^~~~~~~~~~~ drivers/mfd/rohm-bd718x7.c:201:1: note: in expansion of macro 'subsys_initcall' 201 | subsys_initcall(bd71837_i2c_init); | ^~~~~~~~~~~~~~~ drivers/mfd/rohm-bd718x7.c:195:19: note: 'init_module' target declared here 195 | static int __init bd71837_i2c_init(void) | ^~~~~~~~~~~~~~~~ >> drivers/mfd/rohm-bd718x7.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] printk: Skip log flush in NMI context when logbuf_lock is held
by Xiaomeng Zhang 30 Dec '24

30 Dec '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB963V CVE: NA -------------------------------- In nmi_trigger_cpumask_backtrace(), printk_safe_flush() is called after sending NMI to flush the logs. When logbuf_lock is already held and the current CPU is in printk-safe context (e.g., NMI context), attempting to acquire the lock again can lead to deadlock. Modify the function to return early when detecting logbuf_lock is held and current CPU is in printk-safe context. This prevents deadlock scenarios where CPU0 holds the lock while other CPUs try to acquire it in NMI context. Fixes: 099f1c84c005 ("printk: introduce per-cpu safe_print seq buffer") Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/printk/printk_safe.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c index 809f92492ec7..c97845688fe1 100644 --- a/kernel/printk/printk_safe.c +++ b/kernel/printk/printk_safe.c @@ -256,6 +256,10 @@ void printk_safe_flush(void) { int cpu; + if (raw_spin_is_locked(&logbuf_lock) && + (this_cpu_read(printk_context) & PRINTK_SAFE_CONTEXT_MASK)) + return; + for_each_possible_cpu(cpu) { #ifdef CONFIG_PRINTK_NMI __printk_safe_flush(&per_cpu(nmi_print_seq, cpu).work); -- 2.34.1

2 5

[PATCH OLK-6.6] crypto: qat/qat_420xx - fix off by one in uof_get_name()
by Ye Bin 30 Dec '24

30 Dec '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.13-rc1 commit 93a11608fb3720e1bc2b19a2649ac2b49cca1921 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGV CVE: CVE-2024-53163 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- This is called from uof_get_name_420xx() where "num_objs" is the ARRAY_SIZE() of fw_objs[]. The > needs to be >= to prevent an out of bounds access. Fixes: fcf60f4bcf54 ("crypto: qat - add support for 420xx devices") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Acked-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c b/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c index 78f0ea49254d..9faef33e54bd 100644 --- a/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c +++ b/drivers/crypto/intel/qat/qat_420xx/adf_420xx_hw_data.c @@ -375,7 +375,7 @@ static const char *uof_get_name(struct adf_accel_dev *accel_dev, u32 obj_num, else id = -EINVAL; - if (id < 0 || id > num_objs) + if (id < 0 || id >= num_objs) return NULL; return fw_objs[id]; -- 2.34.1

2 1

[PATCH OLK-6.6] EDAC/igen6: Avoid segmentation fault on module unload
by Ye Bin 30 Dec '24

30 Dec '24

From: Orange Kao <orange(a)aiven.io> stable inclusion from stable-v6.6.64 commit 830cabb61113d92a425dd3038ccedbdfb3c8d079 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBEDPH CVE: CVE-2024-56708 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fefaae90398d38a1100ccd73b46ab55ff4610fba ] The segmentation fault happens because: During modprobe: 1. In igen6_probe(), igen6_pvt will be allocated with kzalloc() 2. In igen6_register_mci(), mci->pvt_info will point to &igen6_pvt->imc[mc] During rmmod: 1. In mci_release() in edac_mc.c, it will kfree(mci->pvt_info) 2. In igen6_remove(), it will kfree(igen6_pvt); Fix this issue by setting mci->pvt_info to NULL to avoid the double kfree. Fixes: 10590a9d4f23 ("EDAC/igen6: Add EDAC driver for Intel client SoCs using IBECC") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219360 Signed-off-by: Orange Kao <orange(a)aiven.io> Signed-off-by: Tony Luck <tony.luck(a)intel.com> Link: https://lore.kernel.org/r/20241104124237.124109-2-orange@aiven.io Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/edac/igen6_edac.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/edac/igen6_edac.c b/drivers/edac/igen6_edac.c index a0edb61a5a01..0b408299699a 100644 --- a/drivers/edac/igen6_edac.c +++ b/drivers/edac/igen6_edac.c @@ -1075,6 +1075,7 @@ static int igen6_register_mci(int mc, u64 mchbar, struct pci_dev *pdev) imc->mci = mci; return 0; fail3: + mci->pvt_info = NULL; kfree(mci->ctl_name); fail2: edac_mc_free(mci); @@ -1099,6 +1100,7 @@ static void igen6_unregister_mcis(void) edac_mc_del_mc(mci->pdev); kfree(mci->ctl_name); + mci->pvt_info = NULL; edac_mc_free(mci); iounmap(imc->window); } -- 2.34.1

2 1

[PATCH OLK-6.6] io_uring: check if iowq is killed before queuing
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.68 commit 2ca94c8de36091067b9ce7527ae8db3812d38781 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEG43 CVE: CVE-2024-56709 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dbd2ca9367eb19bc5e269b8c58b0b1514ada9156 upstream. task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In this case, task work will find ->io_wq being already killed and null'ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case. Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case ->iowq check would race. Cc: stable(a)vger.kernel.org Fixes: 50c52250e2d74 ("block: implement async io_uring discard cmd") Fixes: 773af69121ecc ("io_uring: always reissue from task_work context") Reported-by: Will <willsroot(a)protonmail.com> Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Link: https://lore.kernel.org/r/63312b4a2c2bb67ad67b857d17a300e1d3b078e8.17346379… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/io_uring.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 69f5b73a609e..65dc2e344004 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -498,7 +498,11 @@ void io_queue_iowq(struct io_kiocb *req, struct io_tw_state *ts_dont_use) struct io_uring_task *tctx = req->task->io_uring; BUG_ON(!tctx); - BUG_ON(!tctx->io_wq); + + if ((current->flags & PF_KTHREAD) || !tctx->io_wq) { + io_req_task_queue_fail(req, -ECANCELED); + return; + } /* init ->work of the whole link before punting */ io_prep_async_link(req); -- 2.39.2

2 1

[PATCH OLK-5.10] EDAC/bluefield: Fix potential integer overflow
by liukai 30 Dec '24

30 Dec '24

From: David Thompson <davthompson(a)nvidia.com> stable inclusion from stable-v5.10.231 commit e0269ea7a628fdeddd65b92fe29c09655dbb80b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGU CVE: CVE-2024-53161 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ] The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. Fixes: 82413e562ea6 ("EDAC, mellanox: Add ECC support for BlueField DDR4") Signed-off-by: David Thompson <davthompson(a)nvidia.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Shravan Kumar Ramani <shravankr(a)nvidia.com> Link: https://lore.kernel.org/r/20240930151056.10158-1-davthompson@nvidia.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/edac/bluefield_edac.c b/drivers/edac/bluefield_edac.c index e4736eb37bfb..0ef048982768 100644 --- a/drivers/edac/bluefield_edac.c +++ b/drivers/edac/bluefield_edac.c @@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci) static void bluefield_edac_init_dimms(struct mem_ctl_info *mci) { struct bluefield_edac_priv *priv = mci->pvt_info; - int mem_ctrl_idx = mci->mc_idx; + u64 mem_ctrl_idx = mci->mc_idx; struct dimm_info *dimm; u64 smc_info, smc_arg; int is_empty = 1, i; -- 2.34.1

2 1

[PATCH OLK-6.6] EDAC/bluefield: Fix potential integer overflow
by liukai 30 Dec '24

30 Dec '24

From: David Thompson <davthompson(a)nvidia.com> stable inclusion from stable-v6.6.64 commit ac6ebb9edcdb7077e841862c402697c4c48a7c0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGU CVE: CVE-2024-53161 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ] The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. Fixes: 82413e562ea6 ("EDAC, mellanox: Add ECC support for BlueField DDR4") Signed-off-by: David Thompson <davthompson(a)nvidia.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Shravan Kumar Ramani <shravankr(a)nvidia.com> Link: https://lore.kernel.org/r/20240930151056.10158-1-davthompson@nvidia.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/edac/bluefield_edac.c b/drivers/edac/bluefield_edac.c index e4736eb37bfb..0ef048982768 100644 --- a/drivers/edac/bluefield_edac.c +++ b/drivers/edac/bluefield_edac.c @@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci) static void bluefield_edac_init_dimms(struct mem_ctl_info *mci) { struct bluefield_edac_priv *priv = mci->pvt_info; - int mem_ctrl_idx = mci->mc_idx; + u64 mem_ctrl_idx = mci->mc_idx; struct dimm_info *dimm; u64 smc_info, smc_arg; int is_empty = 1, i; -- 2.34.1

2 1

[PATCH OLK-6.6] clk: clk-apple-nco: Add NULL check in applnco_probe
by liukai 30 Dec '24

30 Dec '24

From: Charles Han <hanchunchao(a)inspur.com> stable inclusion from stable-v6.6.64 commit 72ea9a7e9e260aa39f9d1c9254cf92adfb05c4f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGX CVE: CVE-2024-53154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 969c765e2b508cca9099d246c010a1e48dcfd089 ] Add NULL check in applnco_probe, to handle kernel NULL pointer dereference error. Fixes: 6641057d5dba ("clk: clk-apple-nco: Add driver for Apple NCO") Signed-off-by: Charles Han <hanchunchao(a)inspur.com> Link: https://lore.kernel.org/r/20241114072820.3071-1-hanchunchao@inspur.com Reviewed-by: Martin Povišer <povik+lin(a)cutebit.org> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed—off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/clk/clk-apple-nco.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/clk/clk-apple-nco.c b/drivers/clk/clk-apple-nco.c index 39472a51530a..457a48d48941 100644 --- a/drivers/clk/clk-apple-nco.c +++ b/drivers/clk/clk-apple-nco.c @@ -297,6 +297,9 @@ static int applnco_probe(struct platform_device *pdev) memset(&init, 0, sizeof(init)); init.name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%s-%d", np->name, i); + if (!init.name) + return -ENOMEM; + init.ops = &applnco_ops; init.parent_data = &pdata; init.num_parents = 1; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-53217
by Li Lingfeng 30 Dec '24

30 Dec '24

Chuck Lever (1): NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NeilBrown (1): nfsd: restore callback functionality for NFSv4.0 fs/nfsd/nfs4callback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-53217
by Li Lingfeng 30 Dec '24

30 Dec '24

Chuck Lever (1): NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NeilBrown (1): nfsd: restore callback functionality for NFSv4.0 fs/nfsd/nfs4callback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-53217
by Li Lingfeng 30 Dec '24

30 Dec '24

Chuck Lever (1): NFSD: Prevent NULL dereference in nfsd4_process_cb_update() NeilBrown (1): nfsd: restore callback functionality for NFSv4.0 fs/nfsd/nfs4callback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS] nfs: nfs4_callback_compound should put client with async mode
by Li Lingfeng 30 Dec '24

30 Dec '24

From: Yang Erkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB4H3O CVE: NA -------------------------------- Our syztester report hungtask as below: INFO: task NFSv4 callback:93188 blocked for more than 1310 seconds. Not tainted 5.10.0-00574-gc310db27923f-dirty #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:NFSv4 callback state:D stack: 0 pid:93188 ppid: 2 flags:0x00000208 Call trace: __switch_to+0x98/0xdc arch/arm64/kernel/process.c:639 context_switch kernel/sched/core.c:4055 [inline] __schedule+0x690/0xf0c kernel/sched/core.c:5003 schedule+0xd8/0x220 kernel/sched/core.c:5139 schedule_timeout+0x390/0x42c kernel/time/timer.c:2126 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common+0x148/0x240 kernel/sched/completion.c:117 wait_for_completion+0x20/0x30 kernel/sched/completion.c:138 kthread_stop+0xf8/0x39c kernel/kthread.c:671 svc_stop_kthreads+0x138/0x260 net/sunrpc/svc.c:797 svc_set_num_threads+0xc8/0xe4 net/sunrpc/svc.c:818 nfs_callback_down+0x120/0x200 fs/nfs/callback.c:325 nfs4_destroy_callback fs/nfs/nfs4client.c:279 [inline] nfs4_shutdown_client+0x138/0x150 fs/nfs/nfs4client.c:287 nfs4_free_client+0x20/0x40 fs/nfs/nfs4client.c:303 nfs_put_client+0x238/0x340 fs/nfs/client.c:273 nfs4_callback_compound+0x2cc/0x630 fs/nfs/callback_xdr.c:981 nfs_callback_dispatch+0x44/0x6c fs/nfs/callback_xdr.c:995 svc_process_common+0x9a0/0xdf0 net/sunrpc/svc.c:1400 svc_process+0x138/0x1c4 net/sunrpc/svc.c:1542 nfs4_callback_svc+0x58/0x90 fs/nfs/callback.c:89 kthread+0x1e0/0x220 kernel/kthread.c:328 ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1727 When cl_count for nfs_client down to zero, nfs_put_client will trigger nfs4_free_client, then svc_set_num_threads in nfs_callback_down will signal all callback threads and wait until they success exist. So if the last cl_count was put from nfs4_callback_compound, we will deadlock. Fix it using async mode to do this. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Conflicts: fs/nfs/callback_xdr.c fs/nfs/internal.h [Commit 2bb50aabb6f3("NFS4: Report callback authentication errors") separates the judgment of cps.clp and check_gss_callback_principal; commit 10b7a70cbb81("NFS: Cleanup - add nfs_clients_exit to mirror nfs_clients_init") remove nfs_cleanup_cb_ident_idr from fs/nfs/internal.h.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/nfs/callback_xdr.c | 6 +++--- fs/nfs/client.c | 33 +++++++++++++++++++++++++++++++++ fs/nfs/internal.h | 1 + include/linux/nfs_fs_sb.h | 1 + 4 files changed, 38 insertions(+), 3 deletions(-) diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c index 2f84c612838c..2d7dd9b65a8c 100644 --- a/fs/nfs/callback_xdr.c +++ b/fs/nfs/callback_xdr.c @@ -952,7 +952,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp) cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident); if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) { if (cps.clp) - nfs_put_client(cps.clp); + nfs_async_put_client(cps.clp); goto out_invalidcred; } } @@ -962,7 +962,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp) hdr_res.tag = hdr_arg.tag; if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) { if (cps.clp) - nfs_put_client(cps.clp); + nfs_async_put_client(cps.clp); return rpc_system_err; } while (status == 0 && nops != hdr_arg.nops) { @@ -982,7 +982,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp) *hdr_res.status = status; *hdr_res.nops = htonl(nops); nfs4_cb_free_slot(&cps); - nfs_put_client(cps.clp); + nfs_async_put_client(cps.clp); return rpc_success; out_invalidcred: diff --git a/fs/nfs/client.c b/fs/nfs/client.c index 7d02dc52209d..a05ee74d6443 100644 --- a/fs/nfs/client.c +++ b/fs/nfs/client.c @@ -283,6 +283,39 @@ void nfs_put_client(struct nfs_client *clp) } EXPORT_SYMBOL_GPL(nfs_put_client); +static void nfs_free_client_work(struct work_struct *work) +{ + struct nfs_client *clp = + container_of(work, struct nfs_client, free_work); + + clp->rpc_ops->free_client(clp); +} + +/* + * Similar to nfs_put_client, but call free_client with async mode + */ +void nfs_async_put_client(struct nfs_client *clp) +{ + struct nfs_net *nn; + + if (!clp) + return; + + nn = net_generic(clp->cl_net, nfs_net_id); + + if (refcount_dec_and_lock(&clp->cl_count, &nn->nfs_client_lock)) { + list_del(&clp->cl_share_link); + nfs_cb_idr_remove_locked(clp); + spin_unlock(&nn->nfs_client_lock); + + WARN_ON_ONCE(!list_empty(&clp->cl_superblocks)); + + INIT_WORK(&clp->free_work, nfs_free_client_work); + queue_work(nfsiod_workqueue, &clp->free_work); + } +} +EXPORT_SYMBOL_GPL(nfs_async_put_client); + /* * Find an nfs_client on the list that matches the initialisation data * that is supplied. diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h index ad938771813c..44ca5300e6e2 100644 --- a/fs/nfs/internal.h +++ b/fs/nfs/internal.h @@ -180,6 +180,7 @@ void nfs_server_copy_userdata(struct nfs_server *, struct nfs_server *); extern void nfs_cleanup_cb_ident_idr(struct net *); extern void nfs_put_client(struct nfs_client *); +extern void nfs_async_put_client(struct nfs_client *clp); extern void nfs_free_client(struct nfs_client *); extern struct nfs_client *nfs4_find_client_ident(struct net *, int); extern struct nfs_client * diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h index 7023ae64e3d7..14a40789be5d 100644 --- a/include/linux/nfs_fs_sb.h +++ b/include/linux/nfs_fs_sb.h @@ -52,6 +52,7 @@ struct nfs_client { char * cl_acceptor; /* GSSAPI acceptor name */ struct list_head cl_share_link; /* link in global client list */ struct list_head cl_superblocks; /* List of nfs_server structs */ + struct work_struct free_work; struct rpc_clnt * cl_rpcclient; const struct nfs_rpc_ops *rpc_ops; /* NFS protocol vector */ -- 2.31.1

2 1

[openEuler-22.03-LTS-SP1] EDAC/bluefield: Fix potential integer overflow
by liukai 30 Dec '24

30 Dec '24

From: David Thompson <davthompson(a)nvidia.com> stable inclusion from stable-v5.10.231 commit e0269ea7a628fdeddd65b92fe29c09655dbb80b9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGU CVE: CVE-2024-53161 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 1fe774a93b46bb029b8f6fa9d1f25affa53f06c6 ] The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. Fixes: 82413e562ea6 ("EDAC, mellanox: Add ECC support for BlueField DDR4") Signed-off-by: David Thompson <davthompson(a)nvidia.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Shravan Kumar Ramani <shravankr(a)nvidia.com> Link: https://lore.kernel.org/r/20240930151056.10158-1-davthompson@nvidia.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/edac/bluefield_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/edac/bluefield_edac.c b/drivers/edac/bluefield_edac.c index e4736eb37bfb..0ef048982768 100644 --- a/drivers/edac/bluefield_edac.c +++ b/drivers/edac/bluefield_edac.c @@ -180,7 +180,7 @@ static void bluefield_edac_check(struct mem_ctl_info *mci) static void bluefield_edac_init_dimms(struct mem_ctl_info *mci) { struct bluefield_edac_priv *priv = mci->pvt_info; - int mem_ctrl_idx = mci->mc_idx; + u64 mem_ctrl_idx = mci->mc_idx; struct dimm_info *dimm; u64 smc_info, smc_arg; int is_empty = 1, i; -- 2.34.1

1 0

[PATCH OLK-5.10] dm cache: fix flushing uninitialized delayed_work on cache_ctr error
by Kaixiong Yu 30 Dec '24

30 Dec '24

From: Ming-Hung Tsai <mtsai(a)redhat.com> stable inclusion from stable-v6.6.61 commit 8cc12dab635333c4ea28e72d7b947be7d0543c2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVP CVE: CVE-2024-50280 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 135496c208ba26fd68cdef10b64ed7a91ac9a7ff upstream. An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delayed_work waker in the error path of cache_create(). For example, the warning appears on the superblock checksum error. Reproduce steps: dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is not changed. Signed-off-by: Ming-Hung Tsai <mtsai(a)redhat.com> Fixes: 6a459d8edbdb ("dm cache: Fix UAF in destroy()") Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Acked-by: Joe Thornber <thornber(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/dm-cache-target.c [Because HULK-5.10 don't merge mainline patch 86a3238c7b9b759cb864f4f768ab2e24687dc0e6("dm: change "unsigned" to "unsigned int" ")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/md/dm-cache-target.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c index e94409aa2f40..d3821837641b 100644 --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -1960,16 +1960,13 @@ static void check_migrations(struct work_struct *ws) * This function gets called on the error paths of the constructor, so we * have to cope with a partially initialised struct. */ -static void destroy(struct cache *cache) +static void __destroy(struct cache *cache) { - unsigned i; - mempool_exit(&cache->migration_pool); if (cache->prison) dm_bio_prison_destroy_v2(cache->prison); - cancel_delayed_work_sync(&cache->waker); if (cache->wq) destroy_workqueue(cache->wq); @@ -1997,13 +1994,22 @@ static void destroy(struct cache *cache) if (cache->policy) dm_cache_policy_destroy(cache->policy); + bioset_exit(&cache->bs); + + kfree(cache); +} + +static void destroy(struct cache *cache) +{ + unsigned int i; + + cancel_delayed_work_sync(&cache->waker); + for (i = 0; i < cache->nr_ctr_args ; i++) kfree(cache->ctr_args[i]); kfree(cache->ctr_args); - bioset_exit(&cache->bs); - - kfree(cache); + __destroy(cache); } static void cache_dtr(struct dm_target *ti) @@ -2616,7 +2622,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) *result = cache; return 0; bad: - destroy(cache); + __destroy(cache); return r; } @@ -2667,7 +2673,7 @@ static int cache_ctr(struct dm_target *ti, unsigned argc, char **argv) r = copy_ctr_args(cache, argc - 3, (const char **)argv + 3); if (r) { - destroy(cache); + __destroy(cache); goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6] firmware_loader: Fix possible resource leak in fw_log_firmware_info()
by dinglongwei 30 Dec '24

30 Dec '24

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v6.6.64 commit 789a72498d32f88d24371c10985aceb46397056c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFY CVE: CVE-2024-53202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- firmware_loader: Fix possible resource leak in fw_log_firmware_info() [ Upstream commit 369a9c046c2fdfe037f05b43b84c386bdbccc103 ] The alg instance should be released under the exception path, otherwise there may be resource leak here. To mitigate this, free the alg instance with crypto_free_shash when kmalloc fails. Fixes: 02fe26f25325 ("firmware_loader: Add debug message with checksum for FW file") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Reviewed-by: Russ Weight <russ.weight(a)linux.dev> Link: https://lore.kernel.org/r/20241016110335.3677924-1-cuigaosheng1@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/base/firmware_loader/main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index 0b18c6b46e65..f3133ba831c5 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -824,19 +824,18 @@ static void fw_log_firmware_info(const struct firmware *fw, const char *name, st shash->tfm = alg; if (crypto_shash_digest(shash, fw->data, fw->size, sha256buf) < 0) - goto out_shash; + goto out_free; for (int i = 0; i < SHA256_DIGEST_SIZE; i++) sprintf(&outbuf[i * 2], "%02x", sha256buf[i]); outbuf[SHA256_BLOCK_SIZE] = 0; dev_dbg(device, "Loaded FW: %s, sha256: %s\n", name, outbuf); -out_shash: - crypto_free_shash(alg); out_free: kfree(shash); kfree(outbuf); kfree(sha256buf); + crypto_free_shash(alg); } #else static void fw_log_firmware_info(const struct firmware *fw, const char *name, -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
by Zhang Zekun 30 Dec '24

30 Dec '24

From: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> stable inclusion from stable-v4.19.323 commit 4afab2197e530b480c4cc099255d12a08c6a1f93 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBBN6V Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------------- commit 599f6899051cb70c4e0aa9fd591b9ee220cb6f14 upstream. The cec_msg_set_reply_to() helper function never zeroed the struct cec_msg flags field, this can cause unexpected behavior if flags was uninitialized to begin with. Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Fixes: 0dbacebede1e ("[media] cec: move the CEC framework out of staging and to media") Cc: <stable(a)vger.kernel.org> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- include/uapi/linux/cec.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h index d6ba68880cef..8b7085c7577d 100644 --- a/include/uapi/linux/cec.h +++ b/include/uapi/linux/cec.h @@ -132,6 +132,8 @@ static inline void cec_msg_init(struct cec_msg *msg, * Set the msg destination to the orig initiator and the msg initiator to the * orig destination. Note that msg and orig may be the same pointer, in which * case the change is done in place. + * + * It also zeroes the reply, timeout and flags fields. */ static inline void cec_msg_set_reply_to(struct cec_msg *msg, struct cec_msg *orig) @@ -139,7 +141,9 @@ static inline void cec_msg_set_reply_to(struct cec_msg *msg, /* The destination becomes the initiator and vice versa */ msg->msg[0] = (cec_msg_destination(orig) << 4) | cec_msg_initiator(orig); - msg->reply = msg->timeout = 0; + msg->reply = 0; + msg->timeout = 0; + msg->flags = 0; } /* cec_msg flags field */ -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] btrfs: ref-verify: fix use-after-free after invalid ref action
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc2 commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOH CVE: CVE-2024-56581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 ================================================================== BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473 Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329 CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rb_first+0x69/0x70 lib/rbtree.c:473 free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248 btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917 btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f996df7e719 RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719 RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004 RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68 </TASK> Allocated by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 btrfs_ref_tree_mod+0x136c/0x15e0 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888042d1af00 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of freed 64-byte region [ffff888042d1af00, ffff888042d1af40) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541 prep_new_page mm/page_alloc.c:1549 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 page last free pid 5055 tgid 5055 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642 free_pipe_info+0x300/0x390 fs/pipe.c:860 put_pipe_info fs/pipe.c:719 [inline] pipe_release+0x245/0x320 fs/pipe.c:742 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 Reported-by: syzbot+7325f164162e200000c1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@googl… Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c index cd2a5864e103..440236f44636 100644 --- a/fs/btrfs/ref-verify.c +++ b/fs/btrfs/ref-verify.c @@ -822,6 +822,7 @@ int btrfs_ref_tree_mod(struct btrfs_root *root, u64 bytenr, u64 num_bytes, "dropping a ref for a existing root that doesn't have a ref on the block"); dump_block_entry(fs_info, be); dump_ref_action(fs_info, ra); + rb_erase(&ref->node, &be->refs); kfree(ra); goto out_unlock; } -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: ref-verify: fix use-after-free after invalid ref action
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc2 commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOH CVE: CVE-2024-56581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 ================================================================== BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473 Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329 CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rb_first+0x69/0x70 lib/rbtree.c:473 free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248 btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917 btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f996df7e719 RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719 RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004 RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68 </TASK> Allocated by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 btrfs_ref_tree_mod+0x136c/0x15e0 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888042d1af00 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of freed 64-byte region [ffff888042d1af00, ffff888042d1af40) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541 prep_new_page mm/page_alloc.c:1549 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 page last free pid 5055 tgid 5055 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642 free_pipe_info+0x300/0x390 fs/pipe.c:860 put_pipe_info fs/pipe.c:719 [inline] pipe_release+0x245/0x320 fs/pipe.c:742 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 Reported-by: syzbot+7325f164162e200000c1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@googl… Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c index 1ea5bfb8876e..28ac7995716e 100644 --- a/fs/btrfs/ref-verify.c +++ b/fs/btrfs/ref-verify.c @@ -849,6 +849,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info, "dropping a ref for a root that doesn't have a ref on the block"); dump_block_entry(fs_info, be); dump_ref_action(fs_info, ra); + rb_erase(&ref->node, &be->refs); kfree(ref); kfree(ra); goto out_unlock; -- 2.39.2

2 1

[PATCH OLK-5.10] btrfs: ref-verify: fix use-after-free after invalid ref action
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc2 commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOH CVE: CVE-2024-56581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 ================================================================== BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473 Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329 CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rb_first+0x69/0x70 lib/rbtree.c:473 free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248 btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917 btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f996df7e719 RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719 RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004 RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68 </TASK> Allocated by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 btrfs_ref_tree_mod+0x136c/0x15e0 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888042d1af00 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of freed 64-byte region [ffff888042d1af00, ffff888042d1af40) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541 prep_new_page mm/page_alloc.c:1549 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 page last free pid 5055 tgid 5055 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642 free_pipe_info+0x300/0x390 fs/pipe.c:860 put_pipe_info fs/pipe.c:719 [inline] pipe_release+0x245/0x320 fs/pipe.c:742 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 Reported-by: syzbot+7325f164162e200000c1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@googl… Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c index c3711598a9be..38e1ed4dc2a9 100644 --- a/fs/btrfs/ref-verify.c +++ b/fs/btrfs/ref-verify.c @@ -862,6 +862,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info, "dropping a ref for a root that doesn't have a ref on the block"); dump_block_entry(fs_info, be); dump_ref_action(fs_info, ra); + rb_erase(&ref->node, &be->refs); kfree(ref); kfree(ra); goto out_unlock; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] btrfs: ref-verify: fix use-after-free after invalid ref action
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.13-rc2 commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOH CVE: CVE-2024-56581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 ================================================================== BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473 Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329 CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rb_first+0x69/0x70 lib/rbtree.c:473 free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248 btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917 btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f996df7e719 RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719 RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004 RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68 </TASK> Allocated by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5329: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 btrfs_ref_tree_mod+0x136c/0x15e0 btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888042d1af00 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 56 bytes inside of freed 64-byte region [ffff888042d1af00, ffff888042d1af40) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541 prep_new_page mm/page_alloc.c:1549 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __do_kmalloc_node mm/slub.c:4263 [inline] __kmalloc_noprof+0x25a/0x400 mm/slub.c:4276 kmalloc_noprof include/linux/slab.h:882 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] tomoyo_encode2 security/tomoyo/realpath.c:45 [inline] tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x777/0x990 security/security.c:3109 do_dentry_open+0x369/0x1460 fs/open.c:945 vfs_open+0x3e/0x330 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x2c84/0x3590 fs/namei.c:3933 page last free pid 5055 tgid 5055 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1112 [inline] free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642 free_pipe_info+0x300/0x390 fs/pipe.c:860 put_pipe_info fs/pipe.c:719 [inline] pipe_release+0x245/0x320 fs/pipe.c:742 __fput+0x23f/0x880 fs/file_table.c:431 __do_sys_close fs/open.c:1567 [inline] __se_sys_close fs/open.c:1552 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1552 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00 Reported-by: syzbot+7325f164162e200000c1(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@googl… Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool") CC: stable(a)vger.kernel.org # 4.19+ Reviewed-by: Johannes Thumshirn <johannes.thumshirn(a)wdc.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/ref-verify.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c index 78693d3dd15b..b623df5eb579 100644 --- a/fs/btrfs/ref-verify.c +++ b/fs/btrfs/ref-verify.c @@ -860,6 +860,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info, "dropping a ref for a root that doesn't have a ref on the block"); dump_block_entry(fs_info, be); dump_ref_action(fs_info, ra); + rb_erase(&ref->node, &be->refs); kfree(ref); kfree(ra); goto out_unlock; -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] jfs: array-index-out-of-bounds fix in dtReadFirst
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit ca84a2c9be482836b86d780244f0357e5a778c46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP0 CVE: CVE-2024-56598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index defa82acb432..6bc8011b1c9a 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3384,6 +3384,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) /* get the leftmost entry */ stbl = DT_GETSTBL(p); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + xd = (pxd_t *) & p->slot[stbl[0]]; /* get the child page block address */ -- 2.39.2

2 1

[PATCH OLK-5.10] jfs: array-index-out-of-bounds fix in dtReadFirst
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit ca84a2c9be482836b86d780244f0357e5a778c46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP0 CVE: CVE-2024-56598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index defa82acb432..6bc8011b1c9a 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3384,6 +3384,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) /* get the leftmost entry */ stbl = DT_GETSTBL(p); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + xd = (pxd_t *) & p->slot[stbl[0]]; /* get the child page block address */ -- 2.39.2

2 1

[PATCH OLK-6.6] jfs: array-index-out-of-bounds fix in dtReadFirst
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit ca84a2c9be482836b86d780244f0357e5a778c46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP0 CVE: CVE-2024-56598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index 5d3127ca68a4..69fd936fbdb3 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3086,6 +3086,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) /* get the leftmost entry */ stbl = DT_GETSTBL(p); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + xd = (pxd_t *) & p->slot[stbl[0]]; /* get the child page block address */ -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] jfs: array-index-out-of-bounds fix in dtReadFirst
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit ca84a2c9be482836b86d780244f0357e5a778c46 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAP0 CVE: CVE-2024-56598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Reported-by: syzbot+65fa06e29859e41a83f3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=65fa06e29859e41a83f3 Signed-off-by: Ghanshyam Agrawal <ghanshyam1898(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c index ea2c8f0fe832..a2186b6f274a 100644 --- a/fs/jfs/jfs_dtree.c +++ b/fs/jfs/jfs_dtree.c @@ -3395,6 +3395,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack) /* get the leftmost entry */ stbl = DT_GETSTBL(p); + + if (stbl[0] < 0 || stbl[0] > 127) { + DT_PUTPAGE(mp); + jfs_error(ip->i_sb, "stbl[0] out of bound\n"); + return -EIO; + } + xd = (pxd_t *) & p->slot[stbl[0]]; /* get the child page block address */ -- 2.39.2

2 1

[PATCH OLK-6.6] ksmbd: fix use-after-free in SMB request handling
by Yifan Qiao 30 Dec '24

30 Dec '24

From: Yunseong Kim <yskelg(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit 9a8c5d89d327ff58e9b2517f8a6afb4181d32c6e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAF6 CVE: CVE-2024-53186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work()`. This leads to a UAF. - KASAN: slab-use-after-free Read in handle_ksmbd_work - KASAN: slab-use-after-free in rtlock_slowlock_locked This race condition arises as follows: - `ksmbd_conn_handler_loop()` waits for `conn->r_count` to reach zero: `wait_event(conn->r_count_q, atomic_read(&conn->r_count) == 0);` - Meanwhile, `handle_ksmbd_work()` decrements `conn->r_count` using `atomic_dec_return(&conn->r_count)`, and if it reaches zero, calls `ksmbd_conn_free()`, which frees `conn`. - However, after `handle_ksmbd_work()` decrements `conn->r_count`, it may still access `conn->r_count_q` in the following line: `waitqueue_active(&conn->r_count_q)` or `wake_up(&conn->r_count_q)` This results in a UAF, as `conn` has already been freed. The discovery of this UAF can be referenced in the following PR for syzkaller's support for SMB requests. Link: https://github.com/google/syzkaller/pull/5524 Fixes: ee426bfb9d09 ("ksmbd: add refcnt to ksmbd_conn struct") Cc: linux-cifs(a)vger.kernel.org Cc: stable(a)vger.kernel.org # v6.6.55+, v6.10.14+, v6.11.3+ Cc: syzkaller(a)googlegroups.com Signed-off-by: Yunseong Kim <yskelg(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/server/server.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c index b6e0b71c281d..1450e007ac70 100644 --- a/fs/smb/server/server.c +++ b/fs/smb/server/server.c @@ -276,8 +276,12 @@ static void handle_ksmbd_work(struct work_struct *wk) * disconnection. waitqueue_active is safe because it * uses atomic operation for condition. */ + atomic_inc(&conn->refcnt); if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) wake_up(&conn->r_count_q); + + if (atomic_dec_and_test(&conn->refcnt)) + kfree(conn); } /** -- 2.39.2

2 1

[PATCH OLK-6.6] drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new()
by Ye Bin 30 Dec '24

30 Dec '24

From: Li Huafei <lihuafei1(a)huawei.com> stable inclusion from stable-v6.6.64 commit 237f2dbfa00576bb1aa8dc2dce403c64e53270e6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBEGFJ CVE: CVE-2024-56752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a2f599046c671d6b46d93aed95b37241ce4504cf ] When the call to gf100_grctx_generate() fails, unlock gr->fecs.mutex before returning the error. Fixes smatch warning: drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480 gf100_gr_chan_new() warn: inconsistent returns '&gr->fecs.mutex'. Fixes: ca081fff6ecc ("drm/nouveau/gr/gf100-: generate golden context during first object alloc") Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> Reviewed-by: Lyude Paul <lyude(a)redhat.com> Signed-off-by: Lyude Paul <lyude(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20241026173844.2392679-1-lihu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c index 3648868bb9fc..cd533d16b966 100644 --- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c @@ -443,6 +443,7 @@ gf100_gr_chan_new(struct nvkm_gr *base, struct nvkm_chan *fifoch, ret = gf100_grctx_generate(gr, chan, fifoch->inst); if (ret) { nvkm_error(&base->engine.subdev, "failed to construct context\n"); + mutex_unlock(&gr->fecs.mutex); return ret; } } -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
by Bowen You 30 Dec '24

30 Dec '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 63de35a8fcfca59ae8750d469a7eb220c7557baf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOC CVE: CVE-2024-56608 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior. References: [ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [ 65.920527] Call Trace: [ 65.920529] <TASK> [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] create_links+0x18a/0x4e0 [amdgpu] [ 65.921679] dc_create+0x360/0x720 [amdgpu] [ 65.921999] ? dmi_matches+0xa0/0x220 [ 65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [ 65.922342] ? console_unlock+0x77/0x120 [ 65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] really_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_for_each_dev+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] do_one_initcall+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] do_init_module+0x6a/0x270 [ 65.923087] load_module+0x1fce/0x23a0 [ 65.923087] init_module_from_file+0x9c/0xe0 [ 65.923087] ? init_module_from_file+0x9c/0xe0 [ 65.923087] idempotent_init_module+0x179/0x230 [ 65.923087] __x64_sys_finit_module+0x5d/0xa0 [ 65.923087] do_syscall_64+0x76/0x120 [ 65.923087] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087] </TASK> [ 65.923927] ---[ end trace ]--- Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Roman Li <roman.li(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c [file moved in commit 8b8eed05a1c6 drm/amd/display: Refactor resource into component directory] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c index c1a1ca755f26..24105a5b9f2a 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c @@ -1316,7 +1316,7 @@ static struct link_encoder *dcn21_link_encoder_create( kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL); int link_regs_id; - if (!enc21) + if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) return NULL; link_regs_id = -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
by Bowen You 30 Dec '24

30 Dec '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 63de35a8fcfca59ae8750d469a7eb220c7557baf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOC CVE: CVE-2024-56608 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior. References: [ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [ 65.920527] Call Trace: [ 65.920529] <TASK> [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] create_links+0x18a/0x4e0 [amdgpu] [ 65.921679] dc_create+0x360/0x720 [amdgpu] [ 65.921999] ? dmi_matches+0xa0/0x220 [ 65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [ 65.922342] ? console_unlock+0x77/0x120 [ 65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] really_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_for_each_dev+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] do_one_initcall+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] do_init_module+0x6a/0x270 [ 65.923087] load_module+0x1fce/0x23a0 [ 65.923087] init_module_from_file+0x9c/0xe0 [ 65.923087] ? init_module_from_file+0x9c/0xe0 [ 65.923087] idempotent_init_module+0x179/0x230 [ 65.923087] __x64_sys_finit_module+0x5d/0xa0 [ 65.923087] do_syscall_64+0x76/0x120 [ 65.923087] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087] </TASK> [ 65.923927] ---[ end trace ]--- Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Roman Li <roman.li(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c [file moved in commit 8b8eed05a1c6 drm/amd/display: Refactor resource into component directory] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c index 01c4e8753294..f02305089b56 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c @@ -1698,7 +1698,7 @@ static struct link_encoder *dcn21_link_encoder_create( kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL); int link_regs_id; - if (!enc21) + if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) return NULL; link_regs_id = -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
by Bowen You 30 Dec '24

30 Dec '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit 63de35a8fcfca59ae8750d469a7eb220c7557baf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAOC CVE: CVE-2024-56608 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior. References: [ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [ 65.920527] Call Trace: [ 65.920529] <TASK> [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] create_links+0x18a/0x4e0 [amdgpu] [ 65.921679] dc_create+0x360/0x720 [amdgpu] [ 65.921999] ? dmi_matches+0xa0/0x220 [ 65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [ 65.922342] ? console_unlock+0x77/0x120 [ 65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] really_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_for_each_dev+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] do_one_initcall+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] do_init_module+0x6a/0x270 [ 65.923087] load_module+0x1fce/0x23a0 [ 65.923087] init_module_from_file+0x9c/0xe0 [ 65.923087] ? init_module_from_file+0x9c/0xe0 [ 65.923087] idempotent_init_module+0x179/0x230 [ 65.923087] __x64_sys_finit_module+0x5d/0xa0 [ 65.923087] do_syscall_64+0x76/0x120 [ 65.923087] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087] </TASK> [ 65.923927] ---[ end trace ]--- Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Roman Li <roman.li(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c [file moved in commit 8b8eed05a1c6 drm/amd/display: Refactor resource into component directory] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c index 01c4e8753294..f02305089b56 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c @@ -1698,7 +1698,7 @@ static struct link_encoder *dcn21_link_encoder_create( kzalloc(sizeof(struct dcn21_link_encoder), GFP_KERNEL); int link_regs_id; - if (!enc21) + if (!enc21 || enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) return NULL; link_regs_id = -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/4] CVE merge openEuler-22.03-LTS-SP1
by Kaixiong Yu 30 Dec '24

30 Dec '24

the patches' CVE number as listed: CVE-2024-50272 CVE-2024-50187 CVE-2024-50116 CVE-2024-49991 Maíra Canal (1): drm/vc4: Stop the active perfmon before being destroyed Philip Yang (1): drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer Ryusuke Konishi (1): nilfs2: fix kernel bug due to missing clearing of buffer delay flag Trond Myklebust (1): filemap: Fix bounds checking in filemap_read() drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 14 +++++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 ++-- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 2 +- drivers/gpu/drm/vc4/vc4_drv.h | 2 ++ drivers/gpu/drm/vc4/vc4_perfmon.c | 7 ++++++- fs/nilfs2/page.c | 6 ++++-- mm/filemap.c | 2 +- mm/shmem.c | 2 ++ 10 files changed, 27 insertions(+), 16 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 1/2] dm cache: fix flushing uninitialized delayed_work on cache_ctr error
by Kaixiong Yu 30 Dec '24

30 Dec '24

From: Ming-Hung Tsai <mtsai(a)redhat.com> stable inclusion from stable-v6.6.61 commit 8cc12dab635333c4ea28e72d7b947be7d0543c2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVP CVE: CVE-2024-50280 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 135496c208ba26fd68cdef10b64ed7a91ac9a7ff upstream. An unexpected WARN_ON from flush_work() may occur when cache creation fails, caused by destroying the uninitialized delayed_work waker in the error path of cache_create(). For example, the warning appears on the superblock checksum error. Reproduce steps: dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is not changed. Signed-off-by: Ming-Hung Tsai <mtsai(a)redhat.com> Fixes: 6a459d8edbdb ("dm cache: Fix UAF in destroy()") Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Acked-by: Joe Thornber <thornber(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/dm-cache-target.c [Because HULK-5.10 don't merge mainline patch 86a3238c7b9b759cb864f4f768ab2e24687dc0e6("dm: change "unsigned" to "unsigned int" ")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/md/dm-cache-target.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c index e94409aa2f40..d3821837641b 100644 --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -1960,16 +1960,13 @@ static void check_migrations(struct work_struct *ws) * This function gets called on the error paths of the constructor, so we * have to cope with a partially initialised struct. */ -static void destroy(struct cache *cache) +static void __destroy(struct cache *cache) { - unsigned i; - mempool_exit(&cache->migration_pool); if (cache->prison) dm_bio_prison_destroy_v2(cache->prison); - cancel_delayed_work_sync(&cache->waker); if (cache->wq) destroy_workqueue(cache->wq); @@ -1997,13 +1994,22 @@ static void destroy(struct cache *cache) if (cache->policy) dm_cache_policy_destroy(cache->policy); + bioset_exit(&cache->bs); + + kfree(cache); +} + +static void destroy(struct cache *cache) +{ + unsigned int i; + + cancel_delayed_work_sync(&cache->waker); + for (i = 0; i < cache->nr_ctr_args ; i++) kfree(cache->ctr_args[i]); kfree(cache->ctr_args); - bioset_exit(&cache->bs); - - kfree(cache); + __destroy(cache); } static void cache_dtr(struct dm_target *ti) @@ -2616,7 +2622,7 @@ static int cache_create(struct cache_args *ca, struct cache **result) *result = cache; return 0; bad: - destroy(cache); + __destroy(cache); return r; } @@ -2667,7 +2673,7 @@ static int cache_ctr(struct dm_target *ti, unsigned argc, char **argv) r = copy_ctr_args(cache, argc - 3, (const char **)argv + 3); if (r) { - destroy(cache); + __destroy(cache); goto out; } -- 2.34.1

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] drivers/spi/spi-uniphier.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 29 Dec '24

29 Dec '24

Hi Mark, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: c1acb21b32a3bb601453764c9eac9fc8fbb3a81d [1356/1356] Merge branch 'spi-4.19' into spi-next config: x86_64-buildonly-randconfig-003-20241228 (https://download.01.org/0day-ci/archive/20241229/202412292119.3SvvfIct-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412292119.3SvvfIct-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412292119.3SvvfIct-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/spi/spi-uniphier.c:12: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'uniphier_spi_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1558:1: note: in expansion of macro 'module_exit' 1558 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/platform_device.h:14, from drivers/spi/spi-uniphier.c:13: drivers/spi/spi-uniphier.c:518:24: note: 'cleanup_module' target declared here 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~ include/linux/device.h:1554:20: note: in definition of macro 'module_driver' 1554 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'uniphier_spi_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1553:1: note: in expansion of macro 'module_init' 1553 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/platform_device.h:228:9: note: in expansion of macro 'module_driver' 228 | module_driver(__platform_driver, platform_driver_register, \ | ^~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ drivers/spi/spi-uniphier.c:518:24: note: 'init_module' target declared here 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~ include/linux/device.h:1549:19: note: in definition of macro 'module_driver' 1549 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/spi/spi-uniphier.c:518:1: note: in expansion of macro 'module_platform_driver' 518 | module_platform_driver(uniphier_spi_driver); | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/spi/spi-uniphier.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] kernel/seccomp.o: warning: objtool: __secure_computing()+0x164: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: e5d58f5ee731b2ff4e5c801cb875c804c63593e4 [1356/1356] seccomp: Invalidate seccomp mode to catch death failures config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412292126.8dsmJnAO-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412292126.8dsmJnAO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412292126.8dsmJnAO-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/seccomp.c:190: warning: Function parameter or member 'ret' not described in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'sd' description in 'ACTION_ONLY' kernel/seccomp.c:190: warning: Excess function parameter 'match' description in 'ACTION_ONLY' kernel/seccomp.c:320: warning: Function parameter or member 'flags' not described in 'seccomp_sync_threads' >> kernel/seccomp.o: warning: objtool: __secure_computing()+0x164: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] mm/vmalloc.o: warning: objtool: vmap_range_noflush()+0x822: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 2facb5901ceebe6736c0d192ca50be5d26c70ad9 [1356/1356] ascend: vmalloc: export new function for share pool config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412291858.fE0rwXZl-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291858.fE0rwXZl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291858.fE0rwXZl-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/vmalloc.c:43: In file included from mm/internal.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/vmalloc.c:231:16: warning: variable 'start' set but not used [-Wunused-but-set-variable] 231 | unsigned long start; | ^ mm/vmalloc.c:628:14: warning: no previous prototype for function 'vmalloc_to_hugepage' [-Wmissing-prototypes] 628 | struct page *vmalloc_to_hugepage(const void *vmalloc_addr) | ^ mm/vmalloc.c:628:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 628 | struct page *vmalloc_to_hugepage(const void *vmalloc_addr) | ^ | static 3 warnings generated. mm/vmalloc.c:3504: warning: Function parameter or member 'align' not described in 'pvm_determine_end_from_reverse' >> mm/vmalloc.o: warning: objtool: vmap_range_noflush()+0x822: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] lib/sbitmap.o: warning: objtool: sbitmap_get()+0xa4: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: e798f29c1c5233281940f742f29e4fad5d30fa80 [2589/2589] scsi: sbitmap: Move allocation hint into sbitmap config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412291800.CLkIl8Wr-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291800.CLkIl8Wr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291800.CLkIl8Wr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> lib/sbitmap.o: warning: objtool: sbitmap_get()+0xa4: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] drivers/cpuidle/cpuidle.o: warning: objtool: cpuidle_enter_s2idle()+0x2ce: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: c6c4145900fc6828c25ccce943ac3a7ae5de2739 [1356/1356] cpuidle: Fixup IRQ state config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412291655.V0U37u8Q-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291655.V0U37u8Q-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291655.V0U37u8Q-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/cpuidle/cpuidle.o: warning: objtool: cpuidle_enter_s2idle()+0x2ce: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] drivers/gpu/drm/drm_mipi_dsi.o: warning: objtool: mipi_dsi_detach()+0x7b: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: 98a38084c13000416219d8b38fb60f874185f79c [2589/2589] drm/mipi-dsi: Fix detach call without attach config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412291615.DMQ4kEKA-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291615.DMQ4kEKA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291615.DMQ4kEKA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/gpu/drm/drm_mipi_dsi.o: warning: objtool: mipi_dsi_detach()+0x7b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] fs/dcache.o: warning: objtool: dput()+0x7fe: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: 54abad829e47a4429c491486bb2d8da79de8f5b9 [2589/2589] fast_dput(): handle underflows gracefully config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412291332.ZZ1UpSAJ-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291332.ZZ1UpSAJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291332.ZZ1UpSAJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/dcache.o: warning: objtool: dput()+0x7fe: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] mm/memory_hotplug.o: warning: objtool: __remove_pages()+0x149: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: b9f9a54ea6ea41d0e00c19fadf6ff3f42ba32a86 [1356/1356] mm/memory_hotplug: make __remove_section() never fail config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412291322.70sEUMki-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291322.70sEUMki-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291322.70sEUMki-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memory_hotplug.c:12: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/memory_hotplug.c:31: include/linux/mm_inline.h:32:43: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_node_page_state(pgdat, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ 3 warnings generated. >> mm/memory_hotplug.o: warning: objtool: __remove_pages()+0x149: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] fs/ext4/xattr.o: warning: objtool: ext4_xattr_inode_lookup_create()+0x3f1: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: b54fa08a1495ec807a8fa5a4bcab38baf536ec65 [2589/2589] ext4: do not create EA inode under buffer lock config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412291044.42VlRDrU-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412291044.42VlRDrU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412291044.42VlRDrU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/ext4/xattr.o: warning: objtool: ext4_xattr_inode_lookup_create()+0x3f1: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1356/1356] kernel/trace/trace_events.o: warning: objtool: trace_add_event_call_nolock()+0x20d: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 474685382aab1e2263cb1a6161623cd8cbf758ed [1356/1356] tracing: Lock event_mutex before synth_event_mutex config: x86_64-buildonly-randconfig-002-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290943.ju9ShqOs-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290943.ju9ShqOs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290943.ju9ShqOs-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/trace_events.o: warning: objtool: trace_add_event_call_nolock()+0x20d: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2589/2589] fs/iomap/direct-io.o: warning: objtool: iomap_dio_actor()+0xde: unreachable instruction
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4848f81edc2027721953fee5ded81f909a833e26 commit: adad6411399ac34c26ff8a07233e0ecd8cbb86f7 [2589/2589] iomap: pass a flags argument to iomap_dio_rw config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241229/202412290825.A4xfCPjV-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290825.A4xfCPjV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290825.A4xfCPjV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/iomap/direct-io.o: warning: objtool: iomap_dio_actor()+0xde: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1358/1358] drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2567:5: sparse: sparse: symbol 'ngbe_flash_write_cab' was not declared. Should it be static?
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [1358/1358] net: ngbe: Add Netswift Giga NIC driver config: x86_64-randconfig-r113-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290834.rDSvv47F-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290834.rDSvv47F-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290834.rDSvv47F-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:438:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:438:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:438:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:816:6: sparse: sparse: symbol 'ngbe_add_uc_addr' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:960:6: sparse: sparse: symbol 'ngbe_set_mta' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2082:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2236:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2236:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2236:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2344:5: sparse: sparse: symbol 'ngbe_setup_mac_link_hostif' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2382:5: sparse: sparse: symbol 'ngbe_crc16_ccitt' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2542:5: sparse: sparse: symbol 'flash_read_dword' was not declared. Should it be static? >> drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2567:5: sparse: sparse: symbol 'ngbe_flash_write_cab' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2593:5: sparse: sparse: symbol 'ngbe_flash_read_cab' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2628:5: sparse: sparse: symbol 'ngbe_flash_write_unlock' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2651:5: sparse: sparse: symbol 'ngbe_flash_write_lock' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3107:13: sparse: sparse: symbol 'ngbe_ptype_lookup' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3498:5: sparse: sparse: symbol 'ngbe_get_copper_link_capabilities' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3647:5: sparse: sparse: symbol 'ngbe_reset_misc' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3957:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3957:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3957:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3959:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3959:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:3959:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4124:5: sparse: sparse: symbol 'ngbe_read_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4240:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4240:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4240:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4324:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4324:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4324:9: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4339:5: sparse: sparse: symbol 'ngbe_read_ee_hostif_data32' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4387:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4387:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4387:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4405:5: sparse: sparse: symbol 'ngbe_write_ee_hostif_data' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4448:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4448:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4448:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4466:5: sparse: sparse: symbol 'ngbe_write_ee_hostif_data32' was not declared. Should it be static? drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4508:17: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4508:17: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4508:17: sparse: int drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4554:9: sparse: sparse: incompatible types in conditional expression (different base types): drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4554:9: sparse: void drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:4554:9: sparse: int In file included from include/linux/sctp.h:57, from drivers/net/ethernet/netswift/ngbe/ngbe.h:28, from drivers/net/ethernet/netswift/ngbe/ngbe_phy.h:22, from drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:22: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe.h: In function 'ngbe_misc_isb': drivers/net/ethernet/netswift/ngbe/ngbe.h:764:13: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c: At top level: drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:816:6: warning: no previous prototype for 'ngbe_add_uc_addr' [-Wmissing-prototypes] 816 | void ngbe_add_uc_addr(struct ngbe_hw *hw, u8 *addr, u32 vmdq) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:960:6: warning: no previous prototype for 'ngbe_set_mta' [-Wmissing-prototypes] 960 | void ngbe_set_mta(struct ngbe_hw *hw, u8 *mc_addr) | ^~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2032:5: warning: no previous prototype for 'ngbe_host_interface_pass_command' [-Wmissing-prototypes] 2032 | s32 ngbe_host_interface_pass_command(struct ngbe_hw *hw, u32 *buffer, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2344:5: warning: no previous prototype for 'ngbe_setup_mac_link_hostif' [-Wmissing-prototypes] 2344 | s32 ngbe_setup_mac_link_hostif(struct ngbe_hw *hw, u32 speed) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2382:5: warning: no previous prototype for 'ngbe_crc16_ccitt' [-Wmissing-prototypes] 2382 | u16 ngbe_crc16_ccitt(const u8 *buf, int size) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2499:4: warning: no previous prototype for 'fmgr_cmd_op' [-Wmissing-prototypes] 2499 | u8 fmgr_cmd_op(struct ngbe_hw *hw, u32 cmd, u32 cmd_addr) | ^~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2520:4: warning: no previous prototype for 'fmgr_usr_cmd_op' [-Wmissing-prototypes] 2520 | u8 fmgr_usr_cmd_op(struct ngbe_hw *hw, u32 usr_cmd) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2530:4: warning: no previous prototype for 'flash_erase_chip' [-Wmissing-prototypes] 2530 | u8 flash_erase_chip(struct ngbe_hw *hw) | ^~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2536:4: warning: no previous prototype for 'flash_erase_sector' [-Wmissing-prototypes] 2536 | u8 flash_erase_sector(struct ngbe_hw *hw, u32 sec_addr) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/netswift/ngbe/ngbe_hw.c:2542:5: warning: no previous prototype for 'flash_read_dword' [-Wmissing-prototypes] 2542 | u32 flash_read_dword(struct ngbe_hw *hw, u32 addr) | ^~~~~~~~~~~~~~~~ vim +/ngbe_flash_write_cab +2567 drivers/net/ethernet/netswift/ngbe/ngbe_hw.c 2566 > 2567 int ngbe_flash_write_cab(struct ngbe_hw *hw, u32 addr, u32 value, u16 lan_id) 2568 { 2569 int status; 2570 struct ngbe_hic_read_cab buffer; 2571 2572 buffer.hdr.req.cmd = 0xE2; 2573 buffer.hdr.req.buf_lenh = 0x6; 2574 buffer.hdr.req.buf_lenl = 0x0; 2575 buffer.hdr.req.checksum = 0xFF; 2576 2577 /* convert offset from words to bytes */ 2578 buffer.dbuf.d16[0] = cpu_to_le16(lan_id); 2579 /* one word */ 2580 buffer.dbuf.d32[0] = htonl(addr); 2581 buffer.dbuf.d32[1] = htonl(value); 2582 2583 status = ngbe_host_interface_command(hw, (u32 *)&buffer, 2584 sizeof(buffer), 5000, true); 2585 printk("0x1e100 :%08x\n", rd32(hw, 0x1e100)); 2586 printk("0x1e104 :%08x\n", rd32(hw, 0x1e104)); 2587 printk("0x1e108 :%08x\n", rd32(hw, 0x1e108)); 2588 printk("0x1e10c :%08x\n", rd32(hw, 0x1e10c)); 2589 2590 return status; 2591 } 2592 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 4848f81edc2027721953fee5ded81f909a833e26
by kernel test robot 29 Dec '24

29 Dec '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4848f81edc2027721953fee5ded81f909a833e26 !14333 ALSA: usb-audio: Fix out of bounds reads when finding clock sources Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202412282222.K2wXdQAA-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412290220.89K1KTZx-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202412290447.CV8oCAhR-lkp@intel.com fs/dirty_pages.o: warning: objtool: seq_read_dirty()+0x112: unreachable instruction kernel/futex/core.o: warning: objtool: futex_lock_pi()+0x6ec: unreachable instruction kernel/rcu/tree.o: warning: objtool: call_rcu()+0x105: unreachable instruction lib/crypto/curve25519.o: warning: objtool: mod_init()+0x32: unreachable instruction net/bridge/br_vlan_options.o: warning: objtool: br_vlan_process_options()+0x301: unreachable instruction net/sched/sch_qfq.o: warning: objtool: qfq_graft_class()+0xbd: unreachable instruction Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | `-- kismet:WARNING:unmet-direct-dependencies-detected-for-CPPC_CPUFREQ_SYSFS_INTERFACE-when-selected-by-CPU_FREQ_GOV_SEEP |-- arm64-defconfig | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_pmu | |-- arch-arm64-kvm-cvm.c:warning:no-previous-prototype-for-kvm_cvm_supports_sve | |-- arch-arm64-kvm-hyp-nvhe-..-aarch32.c:warning:Function-parameter-or-member-is_wide_instr-not-described-in-kvm_skip_instr32 | |-- arch-arm64-kvm-hyp-vhe-..-aarch32.c:warning:Function-parameter-or-member-is_wide_instr-not-described-in-kvm_skip_instr32 | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-crypto-hisilicon-qm.c:warning:strncpy-specified-bound-depends-on-the-length-of-the-source-argument | |-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:label-err_init_guid_fail-defined-but-not-used | `-- drivers-net-ethernet-hisilicon-hns3-hns3_enet.c:warning:label-out_dbg_init-defined-but-not-used |-- arm64-randconfig-002-20241228 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- arm64-randconfig-003-20241228 | |-- arch-arm64-kvm-hyp-nvhe-..-aarch32.c:warning:Function-parameter-or-member-is_wide_instr-not-described-in-kvm_skip_instr32 | |-- arch-arm64-kvm-hyp-vhe-..-aarch32.c:warning:Function-parameter-or-member-is_wide_instr-not-described-in-kvm_skip_instr32 | |-- drivers-misc-virt_plat_dev.c:warning:initialization-of-struct-irq_domain-from-int-makes-pointer-from-integer-without-a-cast | `-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement |-- arm64-randconfig-r062-20241228 | |-- lib-..-mm-kasan-kasan.h:warning:return-with-a-value-in-function-returning-void | |-- mm-kasan-common.c:error:void-value-not-ignored-as-it-ought-to-be | |-- mm-kasan-common.c:warning:control-reaches-end-of-non-void-function | `-- mm-kasan-kasan.h:warning:return-with-a-value-in-function-returning-void |-- arm64-randconfig-r122-20241228 | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x0-in-asm | |-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x1-in-asm | `-- arch-arm64-include-asm-atomic_lse.h:error:unknown-register-name-x2-in-asm |-- arm64-randconfig-r123-20241228 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r0-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r1-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-x16-in-asm | `-- arch-arm64-include-asm-stack_pointer.h:error:register-sp-unsuitable-for-global-register-variables-on-this-target |-- x86_64-allnoconfig | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-allyesconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-hw-.-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-skb-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3_unic.c:warning:Function-parameter-or-member-type_cs_vlan_tso-not-described-in-hns3_unic_set_l3_type | |-- drivers-net-ethernet-hisilicon-hns3-hns3pf-hclge_unic_guid.c:warning:no-previous-prototype-for-function-hclge_unic_del_mc_guid_common | |-- drivers-net-ethernet-huawei-hinic-hinic_hwdev.c:warning:address-of-array-chip_node-rt_cmd-will-always-evaluate-to-true | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_mac-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-has_trans-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-headroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_common.h:warning:variable-tailroom-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Excess-function-parameter-pf-description-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_debugfs.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_dbg_adapter_exit | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-cmd-description-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-ec-description-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Excess-function-parameter-netdev-description-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-data-not-described-in-rnp_reg_test | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_eeprom | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_module_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_get_ts_info | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_channels | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_set_rxnfc | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-extack-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_get_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-ker-not-described-in-rnp_set_ringparam | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_get_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_ethtool.c:warning:Function-parameter-or-member-kernel_coal-not-described-in-rnp_set_coalesce | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-inner_vlan_tag-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-l4_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-mss_seg_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-rxr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-tunnel_hdr_len-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-txr_idx-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-type_tucmd-description-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Excess-function-parameter-v_count-description-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-crc_pad-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-eth_queue_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-ignore_vlan-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-inner_vlan_tunnel_len-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-mss_len_vf_num-not-described-in-rnp_tx_ctxtdesc | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_count-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-r_idx-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:Function-parameter-or-member-step-not-described-in-rnp_alloc_q_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_acquire_msix_vectors | |-- drivers-net-ethernet-mucse-rnp-rnp_lib.c:warning:no-previous-prototype-for-function-rnp_print_ring_info | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-data-description-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-ent-description-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-hw-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-link_speed-description-in-rnp_watchdog_update_link | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-maxrate-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-msix_vector-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-netdev-description-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-queue-description-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-skb-description-in-rnp_is_non_eop | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Excess-function-parameter-subdev_id-description-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_rx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_setup_tx_resources | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_tx_maxrate_own | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-adapter-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-dev-not-described-in-rnp_setup_tc | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-id-not-described-in-rnp_probe | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-napi_budget-not-described-in-rnp_clean_tx_irq | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_msix_vector-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-rnp_queue-not-described-in-rnp_set_ring_vector | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-subdevice_id-not-described-in-rnp_wol_supported | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-t-not-described-in-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:Function-parameter-or-member-txqueue-not-described-in-rnp_tx_timeout | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_assign_netdev_ops | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_can_rpu_start | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_clear_udp_tunnel_port | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_config_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_delete_knode | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_do_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_rx_ring_reinit | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_task | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_service_timer | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_setup_tc_cls_u32 | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_unmap_and_free_tx_resource | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_vlan_stags_flag | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_write_eitr_rx | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:no-previous-prototype-for-function-rnp_xmit_nop_frame_ring | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-rxctrl-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_main.c:warning:variable-xdp_xmit-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Excess-function-parameter-vf_number-description-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_ack_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_check_for_msg_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx.c:warning:Function-parameter-or-member-mbx_id-not-described-in-rnp_read_mbx_pf | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Excess-function-parameter-rnp_info-description-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-adv-not-described-in-rnp_mbx_phy_link_set | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-info-not-described-in-rnp_mbx_get_capability | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-pfvfnum-not-described-in-rnp_fw_get_macaddr | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value-not-described-in-rnp_mbx_reg_writev | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value0-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value1-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value2-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:Function-parameter-or-member-value3-not-described-in-rnp_set_lane_fun | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:no-previous-prototype-for-function-rnp_fw_reg_read | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_mbx_fw.c:warning:variable-value-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Excess-function-parameter-hw-description-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-hw-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-mac-not-described-in-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:Function-parameter-or-member-sriov_flag-not-described-in-rnp_write_uc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:equality-comparison-with-extraneous-parentheses | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_get_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp10_set_link_ksettings | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_addr_list_itr | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_check_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_clean_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_device_supports_autoneg_fc | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clear_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_all_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_mc_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_clr_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_layer2_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_rar_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tcp_sync_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_tuple5_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vfta_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_set_vmdq_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_mc_addr_list_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_key_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_eth_update_rss_table_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_permtion_mac_addr_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_get_thermal_sensor_data_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_init_thermal_sensor_thresh_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_layer2_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_fc_mode_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_mac_set_mac_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_nway_reset | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_read_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_phy_write_reg_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_reset_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_ethtool_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_set_vf_vlan_mode_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_setup_mac_link_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_start_hw_ops_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:no-previous-prototype-for-function-rnp_tuple5_pritologic_tcam_n10 | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-autoneg_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-dma_ch-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-duplex_changed-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_n10.c:warning:variable-idx-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:no-previous-prototype-for-function-rnp_ptp_setup_ptp | |-- drivers-net-ethernet-mucse-rnp-rnp_ptp.c:warning:variable-ts_event_en-set-but-not-used | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-check_ari_mode | |-- drivers-net-ethernet-mucse-rnp-rnp_sriov.c:warning:no-previous-prototype-for-function-rnp_msg_post_status_signle_link | |-- drivers-net-ethernet-mucse-rnp-rnp_sysfs.c:warning:no-previous-prototype-for-function-rnp_mbx_get_pn_sn | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-hashlen_t-is-a-C11-feature | |-- fs-eulerfs-euler_def.h:warning:redefinition-of-typedef-page_info_t-is-a-C11-feature | `-- fs-eulerfs-namei.c:warning:variable-de-is-uninitialized-when-used-here |-- x86_64-buildonly-randconfig-001-20241228 | |-- arch-x86-kernel-paravirt.c:error:use-of-undeclared-identifier-CALL_INSN_OPCODE | |-- drivers-gpu-drm-loongson-lsdc_plane.o:warning:objtool:lsdc_plane_init-falls-through-to-next-function-lsdc_plane_reset() | `-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union |-- x86_64-buildonly-randconfig-002-20241218 | |-- fs-dirty_pages.o:warning:objtool:seq_read_dirty:unreachable-instruction | |-- kernel-futex-core.o:warning:objtool:futex_lock_pi:unreachable-instruction | `-- net-sched-sch_qfq.o:warning:objtool:qfq_graft_class:unreachable-instruction |-- x86_64-buildonly-randconfig-002-20241228 | |-- arch-x86-kernel-fpu-xstate.o:warning:objtool:get_xsave_addr:unreachable-instruction | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp | |-- drivers-gpu-drm-bridge-cadence-cdns-mhdp8546-core.o:warning:objtool:cdns_mhdp_bandwidth_ok:unreachable-instruction | |-- drivers-media-cec-core-cec-core.o:warning:objtool:cec_allocate_adapter:unreachable-instruction | |-- drivers-of-unittest.o:warning:objtool:of_unittest_destroy_tracked_overlays:unreachable-instruction | |-- kernel-rcu-tree.o:warning:objtool:call_rcu:unreachable-instruction | |-- kernel-time-timer.o:warning:objtool:mod_timer_pending:unreachable-instruction | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter-Werror-Wimplicit-function-declaration | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- lib-bootconfig.o:warning:objtool:xbc_node_get_data:unreachable-instruction | |-- lib-crypto-curve25519.o:warning:objtool:mod_init:unreachable-instruction | |-- lib-iov_iter.o:warning:objtool:_copy_from_iter:unreachable-instruction | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | |-- mm-page_alloc.o:warning:objtool:__drain_all_pages:unreachable-instruction | |-- mm-page_counter.o:warning:objtool:page_counter_cancel:unreachable-instruction | |-- net-bluetooth-l2cap_core.o:warning:objtool:l2cap_chan_send:unreachable-instruction | `-- net-bridge-br_vlan_options.o:warning:objtool:br_vlan_process_options:unreachable-instruction |-- x86_64-buildonly-randconfig-004-20241228 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-005-20241228 | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-buildonly-randconfig-006-20241228 | `-- arch-x86-kernel-paravirt.c:error:CALL_INSN_SIZE-undeclared-(first-use-in-this-function) |-- x86_64-defconfig | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-cpu-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_get_auto_sel | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Excess-function-parameter-enable-description-in-cppc_set_epp | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_get_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-auto_act_window-not-described-in-cppc_set_auto_act_window | |-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-cpunum-not-described-in-cppc_get_auto_act_window | `-- drivers-acpi-cppc_acpi.c:warning:Function-parameter-or-member-epp_val-not-described-in-cppc_set_epp |-- x86_64-randconfig-101-20241228 | |-- drivers-ub-urma-ubcore-ubcore_ctp.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_device.c:warning:no-previous-prototype-for-ubcore_destroy_upi_list | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_poll_jfc | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_post_jetty_recv_wr | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_post_jetty_send_wr | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_post_jfr_wr | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_post_jfs_wr | |-- drivers-ub-urma-ubcore-ubcore_dp.c:warning:no-previous-prototype-for-ubcore_rearm_jfc | |-- drivers-ub-urma-ubcore-ubcore_main.c:warning:no-previous-prototype-for-ubcore_open | |-- drivers-ub-urma-ubcore-ubcore_msg.c:warning:no-previous-prototype-for-ubcore_asyn_send_fe2tpf_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_add_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_check_port_state | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_del_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_fill_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_lookup_sip_idx | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_lookup_sip_info_without_lock | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_new_sip_req_msg | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_notify_uvs_add_sip | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_notify_uvs_del_sip | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_put_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_set_port_netdev | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_idx_alloc | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_idx_free | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_table_init | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_sip_table_uninit | |-- drivers-ub-urma-ubcore-ubcore_netdev.c:warning:no-previous-prototype-for-ubcore_update_sip_entry | |-- drivers-ub-urma-ubcore-ubcore_netlink.c:warning:no-previous-prototype-for-ubcore_genl_unicast | |-- drivers-ub-urma-ubcore-ubcore_tp.c:warning:no-previous-prototype-for-ubcore_get_mtu | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:no-previous-prototype-for-ubcore_tpg_kref_get | |-- drivers-ub-urma-ubcore-ubcore_tpg.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_find_best_page_size | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_get | |-- drivers-ub-urma-ubcore-ubcore_umem.c:warning:no-previous-prototype-for-ubcore_umem_release | |-- drivers-ub-urma-ubcore-ubcore_utp.c:warning:the-comparison-will-always-evaluate-as-false-for-the-address-of-head-will-never-be-NULL | |-- drivers-ub-urma-ubcore-ubcore_vtp.c:warning:no-previous-prototype-for-ubcore_hash_table_rmv_vtpn | `-- kernel-stackleak.c:opportunity-for-str_enabled_disabled(state) |-- x86_64-randconfig-102-20241228 | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-103-20241228 | |-- drivers-gpu-drm-vmwgfx-ttm_object.c:error:Cannot-parse-struct-or-union | |-- ld.lld:error:version-script-assignment-of-LINUX_2.-to-symbol-__vdso_sgx_enter_enclave-failed:symbol-not-defined | |-- llvm-objcopy:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory | `-- llvm-objdump:error:arch-x86-entry-vdso-vdso64.so.dbg:No-such-file-or-directory |-- x86_64-randconfig-121-20241228 | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-from-restricted-__virtio16 | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-to-restricted-__le16 | `-- net-smc-smc_core.c:sparse:sparse:symbol-__smcr_link_clear-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-122-20241228 | |-- fs-xfs-libxfs-xfs_alloc.c:sparse:sparse:symbol-xfs_ag_fixup_aside-was-not-declared.-Should-it-be-static | |-- fs-xfs-xfs_iomap.c:sparse:sparse:symbol-xfs_iomap_page_ops-was-not-declared.-Should-it-be-static | `-- kernel-watchdog_hld.c:sparse:sparse:symbol-__hardlockup_detector_perf_init-was-not-declared.-Should-it-be-static |-- x86_64-randconfig-123-20241228 | |-- drivers-md-md.c:sparse:sparse:dereference-of-noderef-expression | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-desc-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_cmd_paddr-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_wb_resp_paddr-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-next_cell_paddr-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:symbol-hifc_get_red_info_by_rw_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:symbol-hifc_initial_dynamic_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-usertype-db_info-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:symbol-hifc_set_cmdq_ctxts-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-__cqm_bitmap_init-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-__cqm_object_table_init-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_bat_fill_cla_std_entry-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_cla_entry_init_tbl-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_cla_get-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_static_qpc_cla_get-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-desc-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:mixing-different-enum-types: | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_assign_probe_index-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_config_get_op-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_config_set_op-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_flush_root_ctx-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_flush_srq_ctx-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_fun_op-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_release_probe_index-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-service_cqm_temp-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-dev_cmd_handler-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_get_phy_init_status-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_hw_rx_buf_size-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_msg_to_mgmt_no_ack-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_ppf_ht_gpa_deinit-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_ppf_ht_gpa_init-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_read_reg-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_set_vport_enable-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-val-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-dif_protect_op_code-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-dif_sect_size-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_build_sql_by_local_sge_num-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_check_fcp_rsp_iu-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_conf_dual_sgl_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_dif_action_delete-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_dif_action_forward-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_com_err_code-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_dif_info_l1-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_dma_direction_by_fcp_cmnd-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_process_ini_fail_io-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-no_dif_sect_size-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-ref_tag_mod-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-manufacture_id-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-reason_code-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-resp_code-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:symbol-hifc_event_process-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:symbol-hifc_get_ppf_hwdev_by_pdev-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-aeq_err_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-com_up_err_event_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-err_event_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_dfx_get_rxtx_error_state-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_diag_op-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_port_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-scq_err_type-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be16 | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-assigned-usertype-dw0-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-next_page_addr_hi-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-next_page_addr_lo-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-ctrl_ch_val-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-per_xmit_data_size-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-scq_num_rcv_cmd-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-val_wd0-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-val_wd1-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-aeq_info-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-doorbell_record-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-conn_id-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-oqid_rd-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-oqid_wr-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_alloc_parent_sq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_check_all_parent_queue_free-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_clear_els_srq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_disable_queues_dispatch-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_find_parent_queue_info_by_id-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_init_parent_ctx-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_invalid_parent_sq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_map_shared_queue_qid-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_pop_delay_sqe-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_rq_irq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_rqe_analysis-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_sq_irq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_scq_irq-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_set_scq_irq_cfg-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_update_root_rq_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_all_parent_queue_free-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_all_queues_empty-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_queue_set_flush_done-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_root_sq_empty-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-cid-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-e_d_tov_timer_val-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-mfs_unaligned_bytes-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-tx_mfs-got-restricted-__be16 | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-tx_mfs-got-restricted-__be16-usertype | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-els_pld_table_map-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_get_gs_req_and_rsp_pld_len-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_rcv_abts_marker_sts-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_rcv_tmf_marker_sts-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_scqe_error_pre_process-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-scqe_handler_table-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-assigned-usertype-val32-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_rd32_clear-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr32-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr64-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr64_pair-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_clp_to_mgmt-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_is_in_host-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_physical_port_id-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-hifc_utils.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_utils.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:cast-to-restricted-__be64 | |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t | |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype | |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-tmp-got-restricted-__be32-usertype | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_end-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_gid_ft_wait-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_gid_pt_wait-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_start-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_get_free_rscn_node-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_check_event_mgr_status-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_get_free_event_node-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_init_event_msg-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_init_event_node-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_post_event-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_release_event-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_release_global_event-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_wait_event_mgr_complete-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_exchg.c:sparse:sparse:Using-plain-integer-as-NULL-pointer | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-cm_low_levle_handle-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-event_thread_exit-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-fc_event_handle_thd_comp-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-unf_event_process-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-unf_free_port_feature_pool-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_io.c:sparse:sparse:symbol-ini_error_handler_table-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_io.c:sparse:sparse:symbol-unf_prefer_to_send_scsi_cmnd-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_io_abnormal.c:sparse:sparse:symbol-unf_send_scsi_mgmt_cmnd-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_get_port_params-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_enter_sns_logo-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_name_server_register-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_retry_flogi-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_alloc_vp_index-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_check_vport_pool_status-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_free_vp_index-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_get_free_vport-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_init_vport_from_lport-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_process_vports_linkup-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_all_exch-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_all_sfs_exch-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_ini_io_exch-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_back_to_pool-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_deinit-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_init-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_wait_all_exch_removed-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_wait_rports_removed-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_check_sfp_tx_fault-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_cm_get_port_info-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_get_link_lose_tmo_from_up-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_is_vport_valid-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_lport_deinit-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_port_start_work-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_root_lport_ref_dec-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_set_link_lose_tmo_to_up-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_set_port_bbscn-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_rport.c:sparse:sparse:symbol-unf_get_rport_by_wwn-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_rport.c:sparse:sparse:symbol-unf_init_rport_params-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-transfer_len-got-restricted-__le32-usertype | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-start_lba-got-restricted-__le32-usertype | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-function_template-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-function_template_v-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-ini_err_code_table_cnt1-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_host_init_attr_setting-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_scsi_create_vport-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_scsi_delete_vport-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:cast-to-restricted-__be32 | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-els_handle-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_check_plogi_params-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_lport_enter_msn_plogi-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_prli_handler_com_process-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_process_logo_in_fabric-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_rport_relogin-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_flogi_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_logo_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_logo_by_did-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_pdisc_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_plogi_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_prli_acc-was-not-declared.-Should-it-be-static | |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_prlo-was-not-declared.-Should-it-be-static | |-- drivers-scsi-mpt3sas-mpt3sas_base.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-from-restricted-__virtio16 | |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-to-restricted-__le16 | |-- fs-xfs-libxfs-xfs_alloc.c:sparse:sparse:symbol-xfs_ag_fixup_aside-was-not-declared.-Should-it-be-static | |-- fs-xfs-xfs_iomap.c:sparse:sparse:symbol-xfs_iomap_page_ops-was-not-declared.-Should-it-be-static | |-- security-integrity-ima-ima_main.c:error:too-few-arguments-to-function-ima_appraise_measurement | |-- security-integrity-ima-ima_template_lib.c:sparse:sparse:cast-to-restricted-__le16 | |-- security-integrity-ima-ima_template_lib.c:sparse:sparse:cast-to-restricted-__le64 | |-- security-integrity-ima-ima_template_lib.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-id-got-restricted-__le16-usertype | `-- security-integrity-ima-ima_template_lib.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-id-got-restricted-__le32-usertype |-- x86_64-randconfig-161-20241228 | |-- drivers-block-null_blk-main.c-null_add_dev()-warn:missing-error-code-rv | |-- drivers-leds-leds-aw2013.c-aw2013_probe()-warn:inconsistent-returns-chip-mutex-. | |-- drivers-vfio-vfio_iommu_type1.c-vfio_iommu_bind_group()-error:uninitialized-symbol-ret-. | |-- fs-udf-file.c-udf_file_write_iter()-warn:inconsistent-returns-iinfo-i_data_sem-. | |-- fs-zonefs-super.c-zonefs_file_dio_append()-error:uninitialized-symbol-size-. | `-- kernel-sched-fair.c-select_idle_cpu()-error:uninitialized-symbol-time-. `-- x86_64-randconfig-r113-20241228 |-- drivers-md-md.c:sparse:sparse:dereference-of-noderef-expression |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-desc-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_cmd_paddr-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-hw_wb_resp_paddr-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_api_cmd.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-next_cell_paddr-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:Using-plain-integer-as-NULL-pointer |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:symbol-hifc_get_red_info_by_rw_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_chipitf.c:sparse:sparse:symbol-hifc_initial_dynamic_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-usertype-db_info-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_cmdq.c:sparse:sparse:symbol-hifc_set_cmdq_ctxts-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-__cqm_bitmap_init-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-__cqm_object_table_init-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_bat_fill_cla_std_entry-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_cla_entry_init_tbl-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_cla_get-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_cqm_object.c:sparse:sparse:symbol-cqm_static_qpc_cla_get-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-desc-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_eqs.c:sparse:sparse:mixing-different-enum-types: |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_assign_probe_index-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_config_get_op-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_config_set_op-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_flush_root_ctx-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_flush_srq_ctx-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_fun_op-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-hifc_release_probe_index-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hba.c:sparse:sparse:symbol-service_cqm_temp-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-dev_cmd_handler-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_get_phy_init_status-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_hw_rx_buf_size-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_msg_to_mgmt_no_ack-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_ppf_ht_gpa_deinit-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_ppf_ht_gpa_init-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_read_reg-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwdev.c:sparse:sparse:symbol-hifc_set_vport_enable-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_hwif.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-val-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-dif_protect_op_code-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-dif_sect_size-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_build_sql_by_local_sge_num-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_check_fcp_rsp_iu-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_conf_dual_sgl_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_dif_action_delete-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_dif_action_forward-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_com_err_code-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_dif_info_l1-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_get_dma_direction_by_fcp_cmnd-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-hifc_process_ini_fail_io-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-no_dif_sect_size-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_io.c:sparse:sparse:symbol-ref_tag_mod-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-manufacture_id-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-reason_code-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-resp_code-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:symbol-hifc_event_process-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_lld.c:sparse:sparse:symbol-hifc_get_ppf_hwdev_by_pdev-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:Using-plain-integer-as-NULL-pointer |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-aeq_err_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-com_up_err_event_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-err_event_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_dfx_get_rxtx_error_state-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_diag_op-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-hifc_port_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_portmng.c:sparse:sparse:symbol-scq_err_type-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be16 |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-assigned-usertype-dw0-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-next_page_addr_hi-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-next_page_addr_lo-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-ctrl_ch_val-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-per_xmit_data_size-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-scq_num_rcv_cmd-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-val_wd0-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-val_wd1-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-aeq_info-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-doorbell_record-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-conn_id-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-oqid_rd-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-oqid_wr-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_alloc_parent_sq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_check_all_parent_queue_free-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_clear_els_srq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_disable_queues_dispatch-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_find_parent_queue_info_by_id-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_init_parent_ctx-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_invalid_parent_sq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_map_shared_queue_qid-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_pop_delay_sqe-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_rq_irq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_rqe_analysis-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_root_sq_irq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_scq_irq-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_set_scq_irq_cfg-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_update_root_rq_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_all_parent_queue_free-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_all_queues_empty-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_queue_set_flush_done-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_queue.c:sparse:sparse:symbol-hifc_wait_root_sq_empty-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-cid-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-usertype-e_d_tov_timer_val-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-mfs_unaligned_bytes-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-tx_mfs-got-restricted-__be16 |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-short-usertype-tx_mfs-got-restricted-__be16-usertype |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-els_pld_table_map-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_get_gs_req_and_rsp_pld_len-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_rcv_abts_marker_sts-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_rcv_tmf_marker_sts-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-hifc_scqe_error_pre_process-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_service.c:sparse:sparse:symbol-scqe_handler_table-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-addressable-assigned-usertype-val32-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_rd32_clear-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr32-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr64-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_sml.c:sparse:sparse:symbol-hifc_sm_ctr_wr64_pair-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_clp_to_mgmt-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_is_in_host-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_tool_hw.c:sparse:sparse:symbol-hifc_physical_port_id-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-hifc_utils.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_utils.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:cast-to-restricted-__be64 |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:incorrect-type-in-argument-(different-base-types)-expected-unsigned-int-flag-got-restricted-gfp_t |-- drivers-scsi-huawei-hifc-hifc_wq.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-long-long-usertype-got-restricted-__be64-usertype |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-unf_common.h:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-tmp-got-restricted-__be32-usertype |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_end-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_gid_ft_wait-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_gid_pt_wait-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_disc_stat_start-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_disc.c:sparse:sparse:symbol-unf_get_free_rscn_node-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_check_event_mgr_status-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_get_free_event_node-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_init_event_msg-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_init_event_node-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_post_event-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_release_event-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_release_global_event-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_event.c:sparse:sparse:symbol-unf_wait_event_mgr_complete-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_exchg.c:sparse:sparse:Using-plain-integer-as-NULL-pointer |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-cm_low_levle_handle-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-event_thread_exit-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-fc_event_handle_thd_comp-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-unf_event_process-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_init.c:sparse:sparse:symbol-unf_free_port_feature_pool-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_io.c:sparse:sparse:symbol-ini_error_handler_table-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_io.c:sparse:sparse:symbol-unf_prefer_to_send_scsi_cmnd-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_io_abnormal.c:sparse:sparse:symbol-unf_send_scsi_mgmt_cmnd-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_get_port_params-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_enter_sns_logo-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_name_server_register-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_lport.c:sparse:sparse:symbol-unf_lport_retry_flogi-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_alloc_vp_index-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_check_vport_pool_status-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_free_vp_index-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_get_free_vport-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_init_vport_from_lport-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_process_vports_linkup-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_all_exch-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_all_sfs_exch-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_abort_ini_io_exch-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_back_to_pool-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_deinit-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_init-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_wait_all_exch_removed-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_npiv.c:sparse:sparse:symbol-unf_vport_wait_rports_removed-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_check_sfp_tx_fault-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_cm_get_port_info-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_get_link_lose_tmo_from_up-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_is_vport_valid-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_lport_deinit-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_port_start_work-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_root_lport_ref_dec-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_set_link_lose_tmo_to_up-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_portman.c:sparse:sparse:symbol-unf_set_port_bbscn-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_rport.c:sparse:sparse:symbol-unf_get_rport_by_wwn-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_rport.c:sparse:sparse:symbol-unf_init_rport_params-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-assigned-transfer_len-got-restricted-__le32-usertype |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:incorrect-type-in-assignment-(different-base-types)-expected-unsigned-int-start_lba-got-restricted-__le32-usertype |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-function_template-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-function_template_v-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-ini_err_code_table_cnt1-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_host_init_attr_setting-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_scsi_create_vport-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_scsi.c:sparse:sparse:symbol-unf_scsi_delete_vport-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:cast-to-restricted-__be32 |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-els_handle-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_check_plogi_params-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_lport_enter_msn_plogi-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_prli_handler_com_process-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_process_logo_in_fabric-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_rport_relogin-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_flogi_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_logo_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_logo_by_did-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_pdisc_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_plogi_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_prli_acc-was-not-declared.-Should-it-be-static |-- drivers-scsi-huawei-hifc-unf_service.c:sparse:sparse:symbol-unf_send_prlo-was-not-declared.-Should-it-be-static |-- drivers-scsi-megaraid-megaraid_sas_base.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__user-ptr-got-unsigned-int-usertype-sense_cioc_ptr |-- drivers-scsi-megaraid-megaraid_sas_base.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__user-ptr-got-void-noderef-__user-sense_ioc_ptr |-- drivers-scsi-megaraid-megaraid_sas_base.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-noderef-__user-got-void-noderef-__user-sense_ioc_ptr |-- drivers-scsi-mpt3sas-mpt3sas_base.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-blk_mq_hw_ctx-hctx-got-struct-blk_mq_hw_ctx-noderef-__rcu |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-from-restricted-__virtio16 |-- drivers-vdpa-vdpa.c:sparse:sparse:cast-to-restricted-__le16 `-- kernel-watchdog_hld.c:sparse:sparse:symbol-__hardlockup_detector_perf_init-was-not-declared.-Should-it-be-static elapsed time: 726m configs tested: 16 configs skipped: 129 tested configs: arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20241228 gcc-14.2.0 arm64 randconfig-002-20241228 clang-15 arm64 randconfig-003-20241228 gcc-14.2.0 arm64 randconfig-004-20241228 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241228 clang-19 x86_64 buildonly-randconfig-002-20241228 clang-19 x86_64 buildonly-randconfig-003-20241228 gcc-12 x86_64 buildonly-randconfig-004-20241228 clang-19 x86_64 buildonly-randconfig-005-20241228 clang-19 x86_64 buildonly-randconfig-006-20241228 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1358/1358] fs/select.o: warning: objtool: poll_select_finish()+0x246: can't find switch jump table
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 44ae3d3e5f1f99c0fd5f040e4da88b0c5b3ec76b [1358/1358] select: shift restore_saved_sigmask_unless() into poll_select_copy_remaining() config: x86_64-randconfig-102-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290510.qDzEXEra-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290510.qDzEXEra-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290510.qDzEXEra-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/select.o: warning: objtool: poll_select_finish()+0x246: can't find switch jump table -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1358/1358] drivers/edac/i10nm_base.c:135:19: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 29 Dec '24

29 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 3b7ad71a0a415eb51fb41ddc01ef538a7e163de4 [1358/1358] Intel: EDAC, i10nm: Add a driver for Intel 10nm server processors config: x86_64-randconfig-121-20241228 (https://download.01.org/0day-ci/archive/20241229/202412290441.n0ZIl7ko-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241229/202412290441.n0ZIl7ko-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412290441.n0ZIl7ko-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/edac/i10nm_base.c:135:19: sparse: sparse: cast removes address space '__iomem' of expression drivers/edac/i10nm_base.c:157:31: sparse: sparse: cast removes address space '__iomem' of expression drivers/edac/i10nm_base.c:158:37: sparse: sparse: cast removes address space '__iomem' of expression vim +/__iomem +135 drivers/edac/i10nm_base.c 130 131 static bool i10nm_check_ecc(struct skx_imc *imc, int chan) 132 { 133 u32 mcmtr; 134 > 135 mcmtr = *(u32 *)(imc->mbase + 0x20ef8 + chan * 0x4000); 136 edac_dbg(1, "ch%d mcmtr reg %x\n", chan, mcmtr); 137 138 return !!GET_BITFIELD(mcmtr, 2, 2); 139 } 140 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0