- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2740/2740] fs/afs/vl_alias.o: warning: objtool: afs_compare_volume_slists()+0x21c: unreachable instruction
by kernel test robot 16 Feb '25

16 Feb '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e804018e3930644594e31fd711068f5d48ae05af commit: a8cd7bb0c2528d3afe29db0be10841671df41b5d [2740/2740] afs: Fix afs_server_list to be cleaned up with RCU config: x86_64-buildonly-randconfig-001-20250216 (https://download.01.org/0day-ci/archive/20250216/202502161959.kat8z9E7-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502161959.kat8z9E7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502161959.kat8z9E7-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/afs/vl_alias.o: warning: objtool: afs_compare_volume_slists()+0x21c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2740/2740] mm/page_alloc.c:3036:6: warning: no previous prototype for '__drain_all_pages'
by kernel test robot 16 Feb '25

16 Feb '25

Hi Vlastimil, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e804018e3930644594e31fd711068f5d48ae05af commit: e037ee4a8deaff7c579618c0aba1f066d6d14b11 [2740/2740] mm, page_alloc: disable pcplists during memory offline config: x86_64-buildonly-randconfig-002-20250216 (https://download.01.org/0day-ci/archive/20250216/202502161355.thfOP2mL-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502161355.thfOP2mL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502161355.thfOP2mL-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/page_alloc.c:3036:6: warning: no previous prototype for '__drain_all_pages' [-Wmissing-prototypes] 3036 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^~~~~~~~~~~~~~~~~ mm/page_alloc.c:3586:15: warning: no previous prototype for 'should_fail_alloc_page' [-Wmissing-prototypes] 3586 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:6497:20: warning: no previous prototype for 'memmap_init' [-Wmissing-prototypes] 6497 | void __init __weak memmap_init(void) | ^~~~~~~~~~~ mm/page_alloc.c:6535:23: warning: no previous prototype for 'arch_memmap_init' [-Wmissing-prototypes] 6535 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^~~~~~~~~~~~~~~~ >> mm/page_alloc.c:6634:6: warning: no previous prototype for '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] 6634 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7915:9: note: in expansion of macro 'adj_init_size' 7915 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7915:9: note: in expansion of macro 'adj_init_size' 7915 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7915:9: note: in expansion of macro 'adj_init_size' 7915 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7915:9: note: in expansion of macro 'adj_init_size' 7915 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7917:9: note: in expansion of macro 'adj_init_size' 7917 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7917:9: note: in expansion of macro 'adj_init_size' 7917 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7917:9: note: in expansion of macro 'adj_init_size' 7917 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7917:9: note: in expansion of macro 'adj_init_size' 7917 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7918:9: note: in expansion of macro 'adj_init_size' 7918 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7918:9: note: in expansion of macro 'adj_init_size' 7918 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7918:9: note: in expansion of macro 'adj_init_size' 7918 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7918:9: note: in expansion of macro 'adj_init_size' 7918 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7919:9: note: in expansion of macro 'adj_init_size' 7919 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: note: use '&_stext[0] <= &__start_rodata[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^~ mm/page_alloc.c:7919:9: note: in expansion of macro 'adj_init_size' 7919 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: warning: comparison between two arrays [-Warray-compare] 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7919:9: note: in expansion of macro 'adj_init_size' 7919 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:41: note: use '&__start_rodata[0] < &_etext[0]' to compare the addresses 7911 | if (start <= pos && pos < end && size > adj) \ | ^ mm/page_alloc.c:7919:9: note: in expansion of macro 'adj_init_size' 7919 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7911:27: warning: comparison between two arrays [-Warray-compare] vim +/__drain_all_pages +3036 mm/page_alloc.c 3025 3026 /* 3027 * The implementation of drain_all_pages(), exposing an extra parameter to 3028 * drain on all cpus. 3029 * 3030 * drain_all_pages() is optimized to only execute on cpus where pcplists are 3031 * not empty. The check for non-emptiness can however race with a free to 3032 * pcplist that has not yet increased the pcp->count from 0 to 1. Callers 3033 * that need the guarantee that every CPU has drained can disable the 3034 * optimizing racy check. 3035 */ > 3036 void __drain_all_pages(struct zone *zone, bool force_all_cpus) 3037 { 3038 int cpu; 3039 3040 /* 3041 * Allocate in the BSS so we wont require allocation in 3042 * direct reclaim path for CONFIG_CPUMASK_OFFSTACK=y 3043 */ 3044 static cpumask_t cpus_with_pcps; 3045 3046 /* 3047 * Make sure nobody triggers this path before mm_percpu_wq is fully 3048 * initialized. 3049 */ 3050 if (WARN_ON_ONCE(!mm_percpu_wq)) 3051 return; 3052 3053 /* 3054 * Do not drain if one is already in progress unless it's specific to 3055 * a zone. Such callers are primarily CMA and memory hotplug and need 3056 * the drain to be complete when the call returns. 3057 */ 3058 if (unlikely(!mutex_trylock(&pcpu_drain_mutex))) { 3059 if (!zone) 3060 return; 3061 mutex_lock(&pcpu_drain_mutex); 3062 } 3063 3064 /* 3065 * We don't care about racing with CPU hotplug event 3066 * as offline notification will cause the notified 3067 * cpu to drain that CPU pcps and on_each_cpu_mask 3068 * disables preemption as part of its processing 3069 */ 3070 for_each_online_cpu(cpu) { 3071 struct per_cpu_pageset *pcp; 3072 struct zone *z; 3073 bool has_pcps = false; 3074 3075 if (force_all_cpus) { 3076 /* 3077 * The pcp.count check is racy, some callers need a 3078 * guarantee that no cpu is missed. 3079 */ 3080 has_pcps = true; 3081 } else if (zone) { 3082 pcp = per_cpu_ptr(zone->pageset, cpu); 3083 if (pcp->pcp.count) 3084 has_pcps = true; 3085 } else { 3086 for_each_populated_zone(z) { 3087 pcp = per_cpu_ptr(z->pageset, cpu); 3088 if (pcp->pcp.count) { 3089 has_pcps = true; 3090 break; 3091 } 3092 } 3093 } 3094 3095 if (has_pcps) 3096 cpumask_set_cpu(cpu, &cpus_with_pcps); 3097 else 3098 cpumask_clear_cpu(cpu, &cpus_with_pcps); 3099 } 3100 3101 for_each_cpu(cpu, &cpus_with_pcps) { 3102 struct pcpu_drain *drain = per_cpu_ptr(&pcpu_drain, cpu); 3103 3104 drain->zone = zone; 3105 INIT_WORK(&drain->work, drain_local_pages_wq); 3106 queue_work_on(cpu, mm_percpu_wq, &drain->work); 3107 } 3108 for_each_cpu(cpu, &cpus_with_pcps) 3109 flush_work(&per_cpu_ptr(&pcpu_drain, cpu)->work); 3110 3111 mutex_unlock(&pcpu_drain_mutex); 3112 } 3113 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1928/1928] kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup'
by kernel test robot 16 Feb '25

16 Feb '25

Hi Xiongfeng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 01e57e5fa297f937102f9b58ee7905f638b8450f commit: 5f20541757730418065c3ae77dfdbcde3f523394 [1928/1928] blk-mq: avoid housekeeping CPUs scheduling a worker on a non-housekeeping CPU config: loongarch-randconfig-r064-20250216 (https://download.01.org/0day-ci/archive/20250216/202502160734.p26JLJ7W-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502160734.p26JLJ7W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502160734.p26JLJ7W-lkp@intel.com/ All errors (new ones prefixed by >>): | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:54:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 54 | EXPORT_SYMBOL_GPL(housekeeping_any_cpu); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:39:5: note: previous definition of 'housekeeping_any_cpu' with type 'int(enum hk_type)' 39 | int housekeeping_any_cpu(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:63:19: error: non-static declaration of 'housekeeping_cpumask' follows static declaration 63 | EXPORT_SYMBOL_GPL(housekeeping_cpumask); | ^~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:63:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 63 | EXPORT_SYMBOL_GPL(housekeeping_cpumask); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:56:23: note: previous definition of 'housekeeping_cpumask' with type 'const struct cpumask *(enum hk_type)' 56 | const struct cpumask *housekeeping_cpumask(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:71:19: error: non-static declaration of 'housekeeping_affine' follows static declaration 71 | EXPORT_SYMBOL_GPL(housekeeping_affine); | ^~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:71:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 71 | EXPORT_SYMBOL_GPL(housekeeping_affine); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:65:6: note: previous definition of 'housekeeping_affine' with type 'void(struct task_struct *, enum hk_type)' 65 | void housekeeping_affine(struct task_struct *t, enum hk_type type) | ^~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:80:19: error: non-static declaration of 'housekeeping_test_cpu' follows static declaration 80 | EXPORT_SYMBOL_GPL(housekeeping_test_cpu); | ^~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:80:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 80 | EXPORT_SYMBOL_GPL(housekeeping_test_cpu); | ^~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:73:6: note: previous definition of 'housekeeping_test_cpu' with type 'bool(int, enum hk_type)' {aka '_Bool(int, enum hk_type)'} 73 | bool housekeeping_test_cpu(int cpu, enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:100:20: error: invalid storage class for function 'housekeeping_setup_type' 100 | static void __init housekeeping_setup_type(enum hk_type type, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:109:19: error: invalid storage class for function 'housekeeping_setup' 109 | static int __init housekeeping_setup(char *str, unsigned long flags) | ^~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:180:19: error: invalid storage class for function 'housekeeping_nohz_full_setup' 180 | static int __init housekeeping_nohz_full_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:189:23: error: initializer element is not constant 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:189:1: note: in expansion of macro '__setup' 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~ kernel/sched/isolation.c:189:23: note: (near initialization for '__setup_housekeeping_nohz_full_setup.setup_func') 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:189:1: note: in expansion of macro '__setup' 189 | __setup("nohz_full=", housekeeping_nohz_full_setup); | ^~~~~~~ kernel/sched/isolation.c:191:19: error: invalid storage class for function 'housekeeping_isolcpus_setup' 191 | static int __init housekeeping_isolcpus_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:241:22: error: initializer element is not constant 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup' 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~ kernel/sched/isolation.c:241:22: note: (near initialization for '__setup_housekeeping_isolcpus_setup.setup_func') 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup' 241 | __setup("isolcpus=", housekeeping_isolcpus_setup); | ^~~~~~~ >> kernel/sched/isolation.c:244:19: error: invalid storage class for function 'enhanced_isolcpus_setup' 244 | static int __init enhanced_isolcpus_setup(char *str) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:249:30: error: initializer element is not constant 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:249:1: note: in expansion of macro '__setup' 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~ kernel/sched/isolation.c:249:30: note: (near initialization for '__setup_enhanced_isolcpus_setup.setup_func') 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/isolation.c:249:1: note: in expansion of macro '__setup' 249 | __setup("enhanced_isolcpus", enhanced_isolcpus_setup); | ^~~~~~~ In file included from kernel/sched/build_utility.c:109: kernel/sched/autogroup.c:7:28: error: section attribute cannot be specified for local variables 7 | unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:15:35: error: initializer element is not constant 15 | .data = &sysctl_sched_autogroup_enabled, | ^ kernel/sched/autogroup.c:15:35: note: (near initialization for 'sched_autogroup_sysctls[0].data') kernel/sched/autogroup.c:25:20: error: invalid storage class for function 'sched_autogroup_sysctl_init' 25 | static void __init sched_autogroup_sysctl_init(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:47:20: error: invalid storage class for function 'autogroup_destroy' 47 | static inline void autogroup_destroy(struct kref *kref) | ^~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:60:20: error: invalid storage class for function 'autogroup_kref_put' 60 | static inline void autogroup_kref_put(struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:65:33: error: invalid storage class for function 'autogroup_kref_get' 65 | static inline struct autogroup *autogroup_kref_get(struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:71:33: error: invalid storage class for function 'autogroup_task_get' 71 | static inline struct autogroup *autogroup_task_get(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:85:33: error: invalid storage class for function 'autogroup_create' 85 | static inline struct autogroup *autogroup_create(void) | ^~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:158:1: error: invalid storage class for function 'autogroup_move_group' 158 | autogroup_move_group(struct task_struct *p, struct autogroup *ag) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:202:15: error: non-static declaration of 'sched_autogroup_create_attach' follows static declaration 202 | EXPORT_SYMBOL(sched_autogroup_create_attach); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL' 86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "") | ^~~~~~~~~~~~~~ kernel/sched/autogroup.c:202:1: note: in expansion of macro 'EXPORT_SYMBOL' 202 | EXPORT_SYMBOL(sched_autogroup_create_attach); | ^~~~~~~~~~~~~ kernel/sched/autogroup.c:193:6: note: previous definition of 'sched_autogroup_create_attach' with type 'void(struct task_struct *)' 193 | void sched_autogroup_create_attach(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:209:15: error: non-static declaration of 'sched_autogroup_detach' follows static declaration 209 | EXPORT_SYMBOL(sched_autogroup_detach); | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL' 86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "") | ^~~~~~~~~~~~~~ kernel/sched/autogroup.c:209:1: note: in expansion of macro 'EXPORT_SYMBOL' 209 | EXPORT_SYMBOL(sched_autogroup_detach); | ^~~~~~~~~~~~~ kernel/sched/autogroup.c:205:6: note: previous definition of 'sched_autogroup_detach' with type 'void(struct task_struct *)' 205 | void sched_autogroup_detach(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/autogroup.c:221:19: error: invalid storage class for function 'setup_autogroup' 221 | static int __init setup_autogroup(char *str) | ^~~~~~~~~~~~~~~ kernel/sched/autogroup.c:227:24: error: initializer element is not constant 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup' 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~ kernel/sched/autogroup.c:227:24: note: (near initialization for '__setup_setup_autogroup.setup_func') 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~~~~~~~~~ include/linux/init.h:343:46: note: in definition of macro '__setup_param' 343 | = { __setup_str_##unique_id, fn, early } | ^~ kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup' 227 | __setup("noautogroup", setup_autogroup); | ^~~~~~~ vim +/enhanced_isolcpus_setup +244 kernel/sched/isolation.c 242 243 bool enhanced_isolcpus; > 244 static int __init enhanced_isolcpus_setup(char *str) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 01e57e5fa297f937102f9b58ee7905f638b8450f
by kernel test robot 16 Feb '25

16 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 01e57e5fa297f937102f9b58ee7905f638b8450f !15083 mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allmodconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-ARM64_ERRATUM_845719-when-selected-by-ARCH_MXC | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_KEY_PARSER-when-selected-by-PGP_PRELOAD | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-RESCTRL_FS-when-selected-by-ARM64_MPAM | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-defconfig | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250215 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-r121-20250216 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allmodconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_KEY_PARSER-when-selected-by-PGP_PRELOAD | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-r062-20250216 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-r064-20250216 | |-- include-linux-compiler-gcc.h:warning:alias-attribute-ignored | |-- include-linux-syscalls.h:error:implicit-declaration-of-function-__do_sys_membarrier | |-- include-linux-syscalls.h:error:invalid-storage-class-for-function-__do_sys_membarrier | |-- include-linux-syscalls.h:error:static-declaration-of-__se_sys_membarrier-follows-non-static-declaration | |-- include-linux-syscalls.h:warning:__se_sys_membarrier-defined-but-not-used | |-- kernel-sched-autogroup.c:error:initializer-element-is-not-constant | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_create | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_destroy | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_kref_get | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_kref_put | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_move_group | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-autogroup_task_get | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-sched_autogroup_sysctl_init | |-- kernel-sched-autogroup.c:error:invalid-storage-class-for-function-setup_autogroup | |-- kernel-sched-autogroup.c:error:non-static-declaration-of-sched_autogroup_create_attach-follows-static-declaration | |-- kernel-sched-autogroup.c:error:non-static-declaration-of-sched_autogroup_detach-follows-static-declaration | |-- kernel-sched-autogroup.c:error:section-attribute-cannot-be-specified-for-local-variables | |-- kernel-sched-autogroup.c:warning:autogroup_free-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:autogroup_init-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:autogroup_path-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:proc_sched_autogroup_set_nice-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:proc_sched_autogroup_show_task-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_exit-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_exit_task-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:sched_autogroup_fork-defined-but-not-used | |-- kernel-sched-autogroup.c:warning:task_wants_autogroup-defined-but-not-used | |-- kernel-sched-isolation.c:error:extern-declaration-of-housekeeping_overridden-follows-declaration-with-no-linkage | |-- kernel-sched-isolation.c:error:initializer-element-is-not-constant | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_isolcpus_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_nohz_full_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_setup | |-- kernel-sched-isolation.c:error:invalid-storage-class-for-function-housekeeping_setup_type | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_affine-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_any_cpu-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_cpumask-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_enabled-follows-static-declaration | |-- kernel-sched-isolation.c:error:non-static-declaration-of-housekeeping_test_cpu-follows-static-declaration | |-- kernel-sched-isolation.c:warning:housekeeping_init-defined-but-not-used | |-- kernel-sched-psi.c:error:initializer-element-is-not-constant | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-get_stat_names | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_cpu_open | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_cpu_show | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_cpu_write | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_fop_poll | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_fop_release | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_io_open | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_io_show | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_io_write | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_memory_open | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_memory_show | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_memory_write | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_proc_init | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_stat_open | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-psi_write | |-- kernel-sched-psi.c:error:invalid-storage-class-for-function-system_psi_stat_show | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_KEY_PARSER-when-selected-by-PGP_PRELOAD | |-- kismet:WARNING:unmet-direct-dependencies-detected-for-PGP_PRELOAD-when-selected-by-PGP_PRELOAD_PUBLIC_KEYS | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250215 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250215 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-defconfig |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 921m configs tested: 21 configs skipped: 115 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 defconfig gcc-14.2.0 arm64 randconfig-001-20250215 clang-21 arm64 randconfig-002-20250215 gcc-14.2.0 arm64 randconfig-003-20250215 clang-17 arm64 randconfig-004-20250215 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250215 gcc-14.2.0 loongarch randconfig-002-20250215 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250215 gcc-12 x86_64 buildonly-randconfig-002-20250215 clang-19 x86_64 buildonly-randconfig-003-20250215 gcc-12 x86_64 buildonly-randconfig-004-20250215 clang-19 x86_64 buildonly-randconfig-005-20250215 clang-19 x86_64 buildonly-randconfig-006-20250215 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1928/1928] kernel/sched/psi.c:1763:12: error: invalid storage class for function 'psi_io_show'
by kernel test robot 16 Feb '25

16 Feb '25

Hi Lu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 01e57e5fa297f937102f9b58ee7905f638b8450f commit: 654944510822988390470cbc5b6f914c19dd9b88 [1928/1928] sched/psi: add cpu fine grained stall tracking in pressure.stat config: loongarch-randconfig-r064-20250216 (https://download.01.org/0day-ci/archive/20250216/202502160550.E90uGy3T-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502160550.E90uGy3T-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502160550.E90uGy3T-lkp@intel.com/ All error/warnings (new ones prefixed by >>): kernel/sched/psi.c:447:13: error: invalid storage class for function 'psi_stat_flags_change' 447 | static void psi_stat_flags_change(struct task_struct *task, int *stat_set, | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:469:13: error: invalid storage class for function 'get_recent_stat_times' 469 | static void get_recent_stat_times(struct psi_group *group, int cpu, | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:516:20: error: invalid storage class for function 'update_throttle_type' 516 | static inline void update_throttle_type(struct task_struct *task, int cpu, | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:520:13: error: invalid storage class for function 'collect_percpu_times' 520 | static void collect_percpu_times(struct psi_group *group, | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:588:13: error: invalid storage class for function 'window_reset' 588 | static void window_reset(struct psi_window *win, u64 now, u64 value, | ^~~~~~~~~~~~ kernel/sched/psi.c:607:12: error: invalid storage class for function 'window_update' 607 | static u64 window_update(struct psi_window *win, u64 now, u64 value) | ^~~~~~~~~~~~~ kernel/sched/psi.c:633:12: error: invalid storage class for function 'update_triggers' 633 | static u64 update_triggers(struct psi_group *group, u64 now, bool *update_total, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:706:12: error: invalid storage class for function 'update_averages' 706 | static u64 update_averages(struct psi_group *group, u64 now) | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:771:13: error: invalid storage class for function 'psi_avgs_work' 771 | static void psi_avgs_work(struct work_struct *work) | ^~~~~~~~~~~~~ kernel/sched/psi.c:807:13: error: invalid storage class for function 'init_rtpoll_triggers' 807 | static void init_rtpoll_triggers(struct psi_group *group, u64 now) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:820:13: error: invalid storage class for function 'psi_schedule_rtpoll_work' 820 | static void psi_schedule_rtpoll_work(struct psi_group *group, unsigned long delay, | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:847:13: error: invalid storage class for function 'psi_rtpoll_work' 847 | static void psi_rtpoll_work(struct psi_group *group) | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:931:12: error: invalid storage class for function 'psi_rtpoll_worker' 931 | static int psi_rtpoll_worker(void *data) | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:949:13: error: invalid storage class for function 'poll_timer_fn' 949 | static void poll_timer_fn(struct timer_list *t) | ^~~~~~~~~~~~~ kernel/sched/psi.c:957:13: error: invalid storage class for function 'record_times' 957 | static void record_times(struct psi_group_cpu *groupc, u64 now) | ^~~~~~~~~~~~ kernel/sched/psi.c:990:13: error: invalid storage class for function 'psi_group_change' 990 | static void psi_group_change(struct psi_group *group, int cpu, | ^~~~~~~~~~~~~~~~ kernel/sched/psi.c:1106:13: error: invalid storage class for function 'task_is_in_psi_v1' 1106 | static bool task_is_in_psi_v1(void) | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1112:33: error: invalid storage class for function 'task_psi_group' 1112 | static inline struct psi_group *task_psi_group(struct task_struct *task) | ^~~~~~~~~~~~~~ kernel/sched/psi.c: In function 'task_psi_group': kernel/sched/psi.c:1120:52: error: 'cpuacct_cgrp_id' undeclared (first use in this function); did you mean 'cpuset_cgrp_id'? 1120 | cgroup = task_cgroup(task, cpuacct_cgrp_id); | ^~~~~~~~~~~~~~~ | cpuset_cgrp_id kernel/sched/psi.c:1120:52: note: each undeclared identifier is reported only once for each function it appears in kernel/sched/psi.c: In function 'record_stat_times': kernel/sched/psi.c:1130:13: error: invalid storage class for function 'psi_flags_change' 1130 | static void psi_flags_change(struct task_struct *task, int clear, int set) | ^~~~~~~~~~~~~~~~ In file included from include/linux/linkage.h:7, from include/linux/kernel.h:17, from include/linux/cpumask.h:10, from include/linux/smp.h:13, from include/linux/sched/clock.h:5, from kernel/sched/build_utility.c:12: kernel/sched/psi.c:1338:19: error: non-static declaration of 'psi_memstall_enter' follows static declaration 1338 | EXPORT_SYMBOL_GPL(psi_memstall_enter); | ^~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/psi.c:1338:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 1338 | EXPORT_SYMBOL_GPL(psi_memstall_enter); | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1306:6: note: previous definition of 'psi_memstall_enter' with type 'void(long unsigned int *)' 1306 | void psi_memstall_enter(unsigned long *flags) | ^~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1370:19: error: non-static declaration of 'psi_memstall_leave' follows static declaration 1370 | EXPORT_SYMBOL_GPL(psi_memstall_leave); | ^~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/psi.c:1370:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 1370 | EXPORT_SYMBOL_GPL(psi_memstall_leave); | ^~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1346:6: note: previous definition of 'psi_memstall_leave' with type 'void(long unsigned int *)' 1346 | void psi_memstall_leave(unsigned long *flags) | ^~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1763:12: error: invalid storage class for function 'psi_io_show' 1763 | static int psi_io_show(struct seq_file *m, void *v) | ^~~~~~~~~~~ >> kernel/sched/psi.c:1768:12: error: invalid storage class for function 'psi_memory_show' 1768 | static int psi_memory_show(struct seq_file *m, void *v) | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1773:12: error: invalid storage class for function 'psi_cpu_show' 1773 | static int psi_cpu_show(struct seq_file *m, void *v) | ^~~~~~~~~~~~ >> kernel/sched/psi.c:1778:12: error: invalid storage class for function 'psi_io_open' 1778 | static int psi_io_open(struct inode *inode, struct file *file) | ^~~~~~~~~~~ >> kernel/sched/psi.c:1783:12: error: invalid storage class for function 'psi_memory_open' 1783 | static int psi_memory_open(struct inode *inode, struct file *file) | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1788:12: error: invalid storage class for function 'psi_cpu_open' 1788 | static int psi_cpu_open(struct inode *inode, struct file *file) | ^~~~~~~~~~~~ >> kernel/sched/psi.c:1793:16: error: invalid storage class for function 'psi_write' 1793 | static ssize_t psi_write(struct file *file, const char __user *user_buf, | ^~~~~~~~~ >> kernel/sched/psi.c:1836:16: error: invalid storage class for function 'psi_io_write' 1836 | static ssize_t psi_io_write(struct file *file, const char __user *user_buf, | ^~~~~~~~~~~~ >> kernel/sched/psi.c:1842:16: error: invalid storage class for function 'psi_memory_write' 1842 | static ssize_t psi_memory_write(struct file *file, const char __user *user_buf, | ^~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1848:16: error: invalid storage class for function 'psi_cpu_write' 1848 | static ssize_t psi_cpu_write(struct file *file, const char __user *user_buf, | ^~~~~~~~~~~~~ >> kernel/sched/psi.c:1854:17: error: invalid storage class for function 'psi_fop_poll' 1854 | static __poll_t psi_fop_poll(struct file *file, poll_table *wait) | ^~~~~~~~~~~~ >> kernel/sched/psi.c:1861:12: error: invalid storage class for function 'psi_fop_release' 1861 | static int psi_fop_release(struct inode *inode, struct file *file) | ^~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1870:27: error: initializer element is not constant 1870 | .proc_open = psi_io_open, | ^~~~~~~~~~~ kernel/sched/psi.c:1870:27: note: (near initialization for 'psi_io_proc_ops.proc_open') kernel/sched/psi.c:1873:27: error: initializer element is not constant 1873 | .proc_write = psi_io_write, | ^~~~~~~~~~~~ kernel/sched/psi.c:1873:27: note: (near initialization for 'psi_io_proc_ops.proc_write') kernel/sched/psi.c:1874:27: error: initializer element is not constant 1874 | .proc_poll = psi_fop_poll, | ^~~~~~~~~~~~ kernel/sched/psi.c:1874:27: note: (near initialization for 'psi_io_proc_ops.proc_poll') kernel/sched/psi.c:1875:27: error: initializer element is not constant 1875 | .proc_release = psi_fop_release, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1875:27: note: (near initialization for 'psi_io_proc_ops.proc_release') kernel/sched/psi.c:1879:27: error: initializer element is not constant 1879 | .proc_open = psi_memory_open, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1879:27: note: (near initialization for 'psi_memory_proc_ops.proc_open') kernel/sched/psi.c:1882:27: error: initializer element is not constant 1882 | .proc_write = psi_memory_write, | ^~~~~~~~~~~~~~~~ kernel/sched/psi.c:1882:27: note: (near initialization for 'psi_memory_proc_ops.proc_write') kernel/sched/psi.c:1883:27: error: initializer element is not constant 1883 | .proc_poll = psi_fop_poll, | ^~~~~~~~~~~~ kernel/sched/psi.c:1883:27: note: (near initialization for 'psi_memory_proc_ops.proc_poll') kernel/sched/psi.c:1884:27: error: initializer element is not constant 1884 | .proc_release = psi_fop_release, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1884:27: note: (near initialization for 'psi_memory_proc_ops.proc_release') kernel/sched/psi.c:1888:27: error: initializer element is not constant 1888 | .proc_open = psi_cpu_open, | ^~~~~~~~~~~~ kernel/sched/psi.c:1888:27: note: (near initialization for 'psi_cpu_proc_ops.proc_open') kernel/sched/psi.c:1891:27: error: initializer element is not constant 1891 | .proc_write = psi_cpu_write, | ^~~~~~~~~~~~~ kernel/sched/psi.c:1891:27: note: (near initialization for 'psi_cpu_proc_ops.proc_write') kernel/sched/psi.c:1892:27: error: initializer element is not constant 1892 | .proc_poll = psi_fop_poll, | ^~~~~~~~~~~~ kernel/sched/psi.c:1892:27: note: (near initialization for 'psi_cpu_proc_ops.proc_poll') kernel/sched/psi.c:1893:27: error: initializer element is not constant 1893 | .proc_release = psi_fop_release, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1893:27: note: (near initialization for 'psi_cpu_proc_ops.proc_release') >> kernel/sched/psi.c:1907:13: error: invalid storage class for function 'get_stat_names' 1907 | static void get_stat_names(struct seq_file *m, int i, bool is_full) | ^~~~~~~~~~~~~~ >> kernel/sched/psi.c:1953:12: error: invalid storage class for function 'system_psi_stat_show' 1953 | static int system_psi_stat_show(struct seq_file *m, void *v) | ^~~~~~~~~~~~~~~~~~~~ >> kernel/sched/psi.c:1958:12: error: invalid storage class for function 'psi_stat_open' 1958 | static int psi_stat_open(struct inode *inode, struct file *file) | ^~~~~~~~~~~~~ kernel/sched/psi.c:1964:27: error: initializer element is not constant 1964 | .proc_open = psi_stat_open, | ^~~~~~~~~~~~~ kernel/sched/psi.c:1964:27: note: (near initialization for 'psi_stat_proc_ops.proc_open') kernel/sched/psi.c:1967:27: error: initializer element is not constant 1967 | .proc_release = psi_fop_release, | ^~~~~~~~~~~~~~~ kernel/sched/psi.c:1967:27: note: (near initialization for 'psi_stat_proc_ops.proc_release') >> kernel/sched/psi.c:1998:19: error: invalid storage class for function 'psi_proc_init' 1998 | static int __init psi_proc_init(void) | ^~~~~~~~~~~~~ In file included from include/linux/printk.h:6, from include/linux/kernel.h:30: kernel/sched/psi.c:2014:13: error: initializer element is not constant 2014 | module_init(psi_proc_init); | ^~~~~~~~~~~~~ include/linux/init.h:270:55: note: in definition of macro '____define_initcall' 270 | __attribute__((__section__(__sec))) = fn; | ^~ include/linux/init.h:280:9: note: in expansion of macro '__unique_initcall' 280 | __unique_initcall(fn, id, __sec, __initcall_id(fn)) | ^~~~~~~~~~~~~~~~~ include/linux/init.h:282:35: note: in expansion of macro '___define_initcall' 282 | #define __define_initcall(fn, id) ___define_initcall(fn, id, .initcall##id) | ^~~~~~~~~~~~~~~~~~ include/linux/init.h:311:41: note: in expansion of macro '__define_initcall' 311 | #define device_initcall(fn) __define_initcall(fn, 6) | ^~~~~~~~~~~~~~~~~ include/linux/init.h:316:24: note: in expansion of macro 'device_initcall' 316 | #define __initcall(fn) device_initcall(fn) | ^~~~~~~~~~~~~~~ include/linux/module.h:88:25: note: in expansion of macro '__initcall' 88 | #define module_init(x) __initcall(x); | ^~~~~~~~~~ kernel/sched/psi.c:2014:1: note: in expansion of macro 'module_init' 2014 | module_init(psi_proc_init); | ^~~~~~~~~~~ In file included from kernel/sched/build_utility.c:101: kernel/sched/membarrier.c:165:13: error: invalid storage class for function 'ipi_mb' 165 | static void ipi_mb(void *info) | ^~~~~~ kernel/sched/membarrier.c:170:13: error: invalid storage class for function 'ipi_sync_core' 170 | static void ipi_sync_core(void *info) | ^~~~~~~~~~~~~ kernel/sched/membarrier.c:187:13: error: invalid storage class for function 'ipi_rseq' 187 | static void ipi_rseq(void *info) | ^~~~~~~~ kernel/sched/membarrier.c:200:13: error: invalid storage class for function 'ipi_sync_rq_state' 200 | static void ipi_sync_rq_state(void *info) | ^~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:245:12: error: invalid storage class for function 'membarrier_global_expedited' 245 | static int membarrier_global_expedited(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:310:12: error: invalid storage class for function 'membarrier_private_expedited' 310 | static int membarrier_private_expedited(int flags, int cpu_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:426:12: error: invalid storage class for function 'sync_runqueues_membarrier_state' 426 | static int sync_runqueues_membarrier_state(struct mm_struct *mm) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:483:12: error: invalid storage class for function 'membarrier_register_global_expedited' 483 | static int membarrier_register_global_expedited(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:502:12: error: invalid storage class for function 'membarrier_register_private_expedited' 502 | static int membarrier_register_private_expedited(int flags) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/membarrier.c:544:12: error: invalid storage class for function 'membarrier_get_registrations' 544 | static int membarrier_get_registrations(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler_types.h:153, from <command-line>: >> include/linux/compiler-gcc.h:132:33: warning: 'alias' attribute ignored [-Wattributes] 132 | #define __diag(s) _Pragma(__diag_str(GCC diagnostic s)) | ^~~~~~~ include/linux/compiler-gcc.h:135:33: note: in expansion of macro '__diag' 135 | #define __diag_GCC_8(s) __diag(s) | ^~~~~~ include/linux/compiler-gcc.h:123:9: note: in expansion of macro '__diag_GCC_8' 123 | __diag_GCC_ ## version(__diag_GCC_ ## severity s) | ^~~~~~~~~~~ include/linux/compiler_types.h:444:9: note: in expansion of macro '__diag_GCC' 444 | __diag_ ## compiler(version, ignore, option) | ^~~~~~~ include/linux/syscalls.h:242:9: note: in expansion of macro '__diag_ignore' 242 | __diag_ignore(GCC, 8, "-Wattribute-alias", \ | ^~~~~~~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ In file included from include/linux/syscalls_api.h:1, from kernel/sched/sched.h:61, from kernel/sched/build_utility.c:53: >> include/linux/syscalls.h:247:28: error: invalid storage class for function '__do_sys_membarrier' 247 | static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\ | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ >> include/linux/syscalls.h:249:25: error: static declaration of '__se_sys_membarrier' follows non-static declaration 249 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ include/linux/syscalls.h:248:25: note: previous declaration of '__se_sys_membarrier' with type 'long int(long int, long int, long int)' 248 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c: In function '__se_sys_membarrier': include/linux/syscalls.h:251:28: error: implicit declaration of function '__do_sys_membarrier'; did you mean '__se_sys_membarrier'? [-Wimplicit-function-declaration] 251 | long ret = __do_sys##name(__MAP(x,__SC_CAST,__VA_ARGS__));\ | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c: In function 'record_stat_times': include/linux/syscalls.h:257:28: error: invalid storage class for function '__do_sys_membarrier' 257 | static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) | ^~~~~~~~ include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx' 230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx' 221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3' 614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id) | ^~~~~~~~~~~~~~~ kernel/sched/isolation.c:24:19: error: extern declaration of 'housekeeping_overridden' follows declaration with no linkage 24 | EXPORT_SYMBOL_GPL(housekeeping_overridden); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:24:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 24 | EXPORT_SYMBOL_GPL(housekeeping_overridden); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/once.h:6, from include/linux/prandom.h:12, from include/linux/random.h:153, from include/linux/nodemask.h:97, from include/linux/sched.h:23, from include/linux/sched/signal.h:7, from include/linux/sched/cputime.h:5, from kernel/sched/build_utility.c:13: kernel/sched/isolation.c:23:25: note: previous definition of 'housekeeping_overridden' with type 'struct static_key_false' 23 | DEFINE_STATIC_KEY_FALSE(housekeeping_overridden); | ^~~~~~~~~~~~~~~~~~~~~~~ include/linux/jump_label.h:390:33: note: in definition of macro 'DEFINE_STATIC_KEY_FALSE' 390 | struct static_key_false name = STATIC_KEY_FALSE_INIT | ^~~~ kernel/sched/isolation.c:37:19: error: non-static declaration of 'housekeeping_enabled' follows static declaration 37 | EXPORT_SYMBOL_GPL(housekeeping_enabled); | ^~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ kernel/sched/isolation.c:37:1: note: in expansion of macro 'EXPORT_SYMBOL_GPL' 37 | EXPORT_SYMBOL_GPL(housekeeping_enabled); | ^~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:105: kernel/sched/isolation.c:33:6: note: previous definition of 'housekeeping_enabled' with type 'bool(enum hk_type)' {aka '_Bool(enum hk_type)'} 33 | bool housekeeping_enabled(enum hk_type type) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/isolation.c:54:19: error: non-static declaration of 'housekeeping_any_cpu' follows static declaration 54 | EXPORT_SYMBOL_GPL(housekeeping_any_cpu); | ^~~~~~~~~~~~~~~~~~~~ include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL' 74 | extern typeof(sym) sym; \ | ^~~ include/linux/export.h:87:41: note: in expansion of macro '_EXPORT_SYMBOL' 87 | #define EXPORT_SYMBOL_GPL(sym) _EXPORT_SYMBOL(sym, "GPL") | ^~~~~~~~~~~~~~ vim +/psi_io_show +1763 kernel/sched/psi.c 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1761 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1762 #ifdef CONFIG_PROC_FS 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1763 static int psi_io_show(struct seq_file *m, void *v) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1764 { 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1765 return psi_show(m, &psi_system, PSI_IO); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1766 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1767 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1768 static int psi_memory_show(struct seq_file *m, void *v) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1769 { 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1770 return psi_show(m, &psi_system, PSI_MEM); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1771 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1772 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1773 static int psi_cpu_show(struct seq_file *m, void *v) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1774 { 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1775 return psi_show(m, &psi_system, PSI_CPU); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1776 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1777 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1778 static int psi_io_open(struct inode *inode, struct file *file) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1779 { d82caa273565b4 Domenico Cerasuolo 2023-03-30 1780 return single_open(file, psi_io_show, NULL); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1781 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1782 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1783 static int psi_memory_open(struct inode *inode, struct file *file) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1784 { d82caa273565b4 Domenico Cerasuolo 2023-03-30 1785 return single_open(file, psi_memory_show, NULL); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1786 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1787 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 @1788 static int psi_cpu_open(struct inode *inode, struct file *file) 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1789 { d82caa273565b4 Domenico Cerasuolo 2023-03-30 1790 return single_open(file, psi_cpu_show, NULL); 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1791 } 5102bb1c9f8285 Suren Baghdasaryan 2022-01-19 1792 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1793 static ssize_t psi_write(struct file *file, const char __user *user_buf, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1794 size_t nbytes, enum psi_res res) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1795 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1796 char buf[32]; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1797 size_t buf_size; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1798 struct seq_file *seq; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1799 struct psi_trigger *new; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1800 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1801 if (static_branch_likely(&psi_disabled)) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1802 return -EOPNOTSUPP; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1803 6fcca0fa48118e Suren Baghdasaryan 2020-02-03 1804 if (!nbytes) 6fcca0fa48118e Suren Baghdasaryan 2020-02-03 1805 return -EINVAL; 6fcca0fa48118e Suren Baghdasaryan 2020-02-03 1806 4adcdcea717cb2 Miles Chen 2019-09-12 1807 buf_size = min(nbytes, sizeof(buf)); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1808 if (copy_from_user(buf, user_buf, buf_size)) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1809 return -EFAULT; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1810 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1811 buf[buf_size - 1] = '\0'; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1812 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1813 seq = file->private_data; a06247c6804f1a Suren Baghdasaryan 2022-01-11 1814 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1815 /* Take seq->lock to protect seq->private from concurrent writes */ 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1816 mutex_lock(&seq->lock); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1817 a06247c6804f1a Suren Baghdasaryan 2022-01-11 1818 /* Allow only one trigger per file descriptor */ a06247c6804f1a Suren Baghdasaryan 2022-01-11 1819 if (seq->private) { a06247c6804f1a Suren Baghdasaryan 2022-01-11 1820 mutex_unlock(&seq->lock); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1821 return -EBUSY; a06247c6804f1a Suren Baghdasaryan 2022-01-11 1822 } a06247c6804f1a Suren Baghdasaryan 2022-01-11 1823 aff037078ecaec Suren Baghdasaryan 2023-06-29 1824 new = psi_trigger_create(&psi_system, buf, res, file, NULL); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1825 if (IS_ERR(new)) { a06247c6804f1a Suren Baghdasaryan 2022-01-11 1826 mutex_unlock(&seq->lock); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1827 return PTR_ERR(new); a06247c6804f1a Suren Baghdasaryan 2022-01-11 1828 } a06247c6804f1a Suren Baghdasaryan 2022-01-11 1829 a06247c6804f1a Suren Baghdasaryan 2022-01-11 1830 smp_store_release(&seq->private, new); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1831 mutex_unlock(&seq->lock); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1832 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1833 return nbytes; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1834 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1835 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1836 static ssize_t psi_io_write(struct file *file, const char __user *user_buf, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1837 size_t nbytes, loff_t *ppos) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1838 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1839 return psi_write(file, user_buf, nbytes, PSI_IO); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1840 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1841 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1842 static ssize_t psi_memory_write(struct file *file, const char __user *user_buf, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1843 size_t nbytes, loff_t *ppos) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1844 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1845 return psi_write(file, user_buf, nbytes, PSI_MEM); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1846 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1847 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1848 static ssize_t psi_cpu_write(struct file *file, const char __user *user_buf, 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1849 size_t nbytes, loff_t *ppos) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1850 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1851 return psi_write(file, user_buf, nbytes, PSI_CPU); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1852 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1853 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1854 static __poll_t psi_fop_poll(struct file *file, poll_table *wait) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1855 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1856 struct seq_file *seq = file->private_data; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1857 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1858 return psi_trigger_poll(&seq->private, file, wait); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1859 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1860 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 @1861 static int psi_fop_release(struct inode *inode, struct file *file) 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1862 { 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1863 struct seq_file *seq = file->private_data; 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1864 a06247c6804f1a Suren Baghdasaryan 2022-01-11 1865 psi_trigger_destroy(seq->private); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1866 return single_release(inode, file); 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1867 } 0e94682b73bfa6 Suren Baghdasaryan 2019-05-14 1868 97a32539b9568b Alexey Dobriyan 2020-02-03 1869 static const struct proc_ops psi_io_proc_ops = { 97a32539b9568b Alexey Dobriyan 2020-02-03 @1870 .proc_open = psi_io_open, 97a32539b9568b Alexey Dobriyan 2020-02-03 1871 .proc_read = seq_read, 97a32539b9568b Alexey Dobriyan 2020-02-03 1872 .proc_lseek = seq_lseek, 97a32539b9568b Alexey Dobriyan 2020-02-03 1873 .proc_write = psi_io_write, 97a32539b9568b Alexey Dobriyan 2020-02-03 1874 .proc_poll = psi_fop_poll, 97a32539b9568b Alexey Dobriyan 2020-02-03 1875 .proc_release = psi_fop_release, eb414681d5a07d Johannes Weiner 2018-10-26 1876 }; eb414681d5a07d Johannes Weiner 2018-10-26 1877 97a32539b9568b Alexey Dobriyan 2020-02-03 1878 static const struct proc_ops psi_memory_proc_ops = { 97a32539b9568b Alexey Dobriyan 2020-02-03 1879 .proc_open = psi_memory_open, 97a32539b9568b Alexey Dobriyan 2020-02-03 1880 .proc_read = seq_read, 97a32539b9568b Alexey Dobriyan 2020-02-03 1881 .proc_lseek = seq_lseek, 97a32539b9568b Alexey Dobriyan 2020-02-03 1882 .proc_write = psi_memory_write, 97a32539b9568b Alexey Dobriyan 2020-02-03 1883 .proc_poll = psi_fop_poll, 97a32539b9568b Alexey Dobriyan 2020-02-03 1884 .proc_release = psi_fop_release, eb414681d5a07d Johannes Weiner 2018-10-26 1885 }; eb414681d5a07d Johannes Weiner 2018-10-26 1886 97a32539b9568b Alexey Dobriyan 2020-02-03 1887 static const struct proc_ops psi_cpu_proc_ops = { 97a32539b9568b Alexey Dobriyan 2020-02-03 1888 .proc_open = psi_cpu_open, 97a32539b9568b Alexey Dobriyan 2020-02-03 1889 .proc_read = seq_read, 97a32539b9568b Alexey Dobriyan 2020-02-03 1890 .proc_lseek = seq_lseek, 97a32539b9568b Alexey Dobriyan 2020-02-03 1891 .proc_write = psi_cpu_write, 97a32539b9568b Alexey Dobriyan 2020-02-03 1892 .proc_poll = psi_fop_poll, 97a32539b9568b Alexey Dobriyan 2020-02-03 1893 .proc_release = psi_fop_release, eb414681d5a07d Johannes Weiner 2018-10-26 1894 }; eb414681d5a07d Johannes Weiner 2018-10-26 1895 4a69b56540f405 Lu Jialin 2024-01-04 1896 #ifdef CONFIG_PSI_FINE_GRAINED 4a69b56540f405 Lu Jialin 2024-01-04 1897 static const char *const psi_stat_names[] = { 4a69b56540f405 Lu Jialin 2024-01-04 1898 "cgroup_memory_reclaim", 25d00f6853c3c6 Lu Jialin 2024-01-04 1899 "global_memory_reclaim", 25d00f6853c3c6 Lu Jialin 2024-01-04 1900 "compact", 25d00f6853c3c6 Lu Jialin 2024-01-04 1901 "cgroup_async_memory_reclaim", 25d00f6853c3c6 Lu Jialin 2024-01-04 1902 "swap", 65494451082298 Lu Jialin 2024-01-04 1903 "cpu_cfs_bandwidth", 65494451082298 Lu Jialin 2024-01-04 1904 "cpu_qos", 4a69b56540f405 Lu Jialin 2024-01-04 1905 }; 4a69b56540f405 Lu Jialin 2024-01-04 1906 65494451082298 Lu Jialin 2024-01-04 @1907 static void get_stat_names(struct seq_file *m, int i, bool is_full) 65494451082298 Lu Jialin 2024-01-04 1908 { 65494451082298 Lu Jialin 2024-01-04 1909 if (i <= PSI_SWAP_FULL && !is_full) 65494451082298 Lu Jialin 2024-01-04 1910 return seq_printf(m, "%s\n", psi_stat_names[i / 2]); 65494451082298 Lu Jialin 2024-01-04 1911 else if (i == PSI_CPU_CFS_BANDWIDTH_FULL) 65494451082298 Lu Jialin 2024-01-04 1912 return seq_printf(m, "%s\n", "cpu_cfs_bandwidth"); 65494451082298 Lu Jialin 2024-01-04 1913 #ifdef CONFIG_QOS_SCHED 65494451082298 Lu Jialin 2024-01-04 1914 else if (i == PSI_CPU_QOS_FULL) 65494451082298 Lu Jialin 2024-01-04 1915 return seq_printf(m, "%s\n", "cpu_qos"); 65494451082298 Lu Jialin 2024-01-04 1916 #endif 65494451082298 Lu Jialin 2024-01-04 1917 } 65494451082298 Lu Jialin 2024-01-04 1918 4a69b56540f405 Lu Jialin 2024-01-04 1919 int psi_stat_show(struct seq_file *m, struct psi_group *group) 4a69b56540f405 Lu Jialin 2024-01-04 1920 { 4a69b56540f405 Lu Jialin 2024-01-04 1921 int i; 4a69b56540f405 Lu Jialin 2024-01-04 1922 u64 now; 4a69b56540f405 Lu Jialin 2024-01-04 1923 4a69b56540f405 Lu Jialin 2024-01-04 1924 if (static_branch_likely(&psi_disabled)) 4a69b56540f405 Lu Jialin 2024-01-04 1925 return -EOPNOTSUPP; 4a69b56540f405 Lu Jialin 2024-01-04 1926 4a69b56540f405 Lu Jialin 2024-01-04 1927 mutex_lock(&group->avgs_lock); 4a69b56540f405 Lu Jialin 2024-01-04 1928 now = sched_clock(); 4a69b56540f405 Lu Jialin 2024-01-04 1929 collect_percpu_times(group, PSI_AVGS, NULL); 4a69b56540f405 Lu Jialin 2024-01-04 1930 if (now >= group->avg_next_update) 4a69b56540f405 Lu Jialin 2024-01-04 1931 group->avg_next_update = update_averages(group, now); 4a69b56540f405 Lu Jialin 2024-01-04 1932 mutex_unlock(&group->avgs_lock); 4a69b56540f405 Lu Jialin 2024-01-04 1933 4a69b56540f405 Lu Jialin 2024-01-04 1934 for (i = 0; i < NR_PSI_STAT_STATES; i++) { 4a69b56540f405 Lu Jialin 2024-01-04 1935 unsigned long avg[3] = {0, }; 4a69b56540f405 Lu Jialin 2024-01-04 1936 int w; 4a69b56540f405 Lu Jialin 2024-01-04 1937 u64 total; 65494451082298 Lu Jialin 2024-01-04 1938 bool is_full = i % 2 || i > PSI_SWAP_FULL; 4a69b56540f405 Lu Jialin 2024-01-04 1939 4a69b56540f405 Lu Jialin 2024-01-04 1940 for (w = 0; w < 3; w++) 4a69b56540f405 Lu Jialin 2024-01-04 1941 avg[w] = group->fine_grained_avg[i][w]; 4a69b56540f405 Lu Jialin 2024-01-04 1942 total = div_u64(group->fine_grained_total[PSI_AVGS][i], NSEC_PER_USEC); 65494451082298 Lu Jialin 2024-01-04 1943 get_stat_names(m, i, is_full); 4a69b56540f405 Lu Jialin 2024-01-04 1944 seq_printf(m, "%s avg10=%lu.%02lu avg60=%lu.%02lu avg300=%lu.%02lu total=%llu\n", 4a69b56540f405 Lu Jialin 2024-01-04 1945 is_full ? "full" : "some", 4a69b56540f405 Lu Jialin 2024-01-04 1946 LOAD_INT(avg[0]), LOAD_FRAC(avg[0]), 4a69b56540f405 Lu Jialin 2024-01-04 1947 LOAD_INT(avg[1]), LOAD_FRAC(avg[1]), 4a69b56540f405 Lu Jialin 2024-01-04 1948 LOAD_INT(avg[2]), LOAD_FRAC(avg[2]), 4a69b56540f405 Lu Jialin 2024-01-04 1949 total); 4a69b56540f405 Lu Jialin 2024-01-04 1950 } 4a69b56540f405 Lu Jialin 2024-01-04 1951 return 0; 4a69b56540f405 Lu Jialin 2024-01-04 1952 } 4a69b56540f405 Lu Jialin 2024-01-04 @1953 static int system_psi_stat_show(struct seq_file *m, void *v) 4a69b56540f405 Lu Jialin 2024-01-04 1954 { 4a69b56540f405 Lu Jialin 2024-01-04 1955 return psi_stat_show(m, &psi_system); 4a69b56540f405 Lu Jialin 2024-01-04 1956 } 4a69b56540f405 Lu Jialin 2024-01-04 1957 4a69b56540f405 Lu Jialin 2024-01-04 @1958 static int psi_stat_open(struct inode *inode, struct file *file) 4a69b56540f405 Lu Jialin 2024-01-04 1959 { 4a69b56540f405 Lu Jialin 2024-01-04 1960 return single_open(file, system_psi_stat_show, NULL); 4a69b56540f405 Lu Jialin 2024-01-04 1961 } 4a69b56540f405 Lu Jialin 2024-01-04 1962 :::::: The code at line 1763 was first introduced by commit :::::: 5102bb1c9f82857a3164af9d7ab7ad628cb783ed psi: Fix "defined but not used" warnings when CONFIG_PROC_FS=n :::::: TO: Suren Baghdasaryan <surenb(a)google.com> :::::: CC: Peter Zijlstra <peterz(a)infradead.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1422/1422] kernel/time/.tmp_hrtimer.o: warning: objtool: hrtimer_start_range_ns()+0x535: unreachable instruction
by kernel test robot 16 Feb '25

16 Feb '25

Hi Phil, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6a6cc2b6b95dc80ae01221670e21a8059229a023 commit: 40ecfb28732cefd0c5658f7c10543bbc4cd41cb8 [1422/1422] hrtimer: Prevent queuing of hrtimer without a function callback config: x86_64-buildonly-randconfig-001-20250210 (https://download.01.org/0day-ci/archive/20250216/202502160431.1F2NAJJ5-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502160431.1F2NAJJ5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502160431.1F2NAJJ5-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/time/hrtimer.c:130:21: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 130 | [CLOCK_REALTIME] = HRTIMER_BASE_REALTIME, | ^~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:131:22: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 131 | [CLOCK_MONOTONIC] = HRTIMER_BASE_MONOTONIC, | ^~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:132:21: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 132 | [CLOCK_BOOTTIME] = HRTIMER_BASE_BOOTTIME, | ^~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:133:17: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides] 133 | [CLOCK_TAI] = HRTIMER_BASE_TAI, | ^~~~~~~~~~~~~~~~ kernel/time/hrtimer.c:128:27: note: previous initialization is here 128 | [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, | ^~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. >> kernel/time/.tmp_hrtimer.o: warning: objtool: hrtimer_start_range_ns()+0x535: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1422/1422] kernel/time/.tmp_posix-cpu-timers.o: warning: objtool: set_process_cpu_timer()+0x119: unreachable instruction
by kernel test robot 16 Feb '25

16 Feb '25

Hi Thomas, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6a6cc2b6b95dc80ae01221670e21a8059229a023 commit: 36ff49c95a04513935898fdcd4bc37646b2dc459 [1422/1422] posix-cpu-timers: Sanitize bogus WARNONS config: x86_64-buildonly-randconfig-001-20250210 (https://download.01.org/0day-ci/archive/20250216/202502160200.QYr3efrJ-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250216/202502160200.QYr3efrJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502160200.QYr3efrJ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/time/.tmp_posix-cpu-timers.o: warning: objtool: set_process_cpu_timer()+0x119: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 v3 0/2] net: Fix CVE-2024-56658
by Dong Chenchen 15 Feb '25

15 Feb '25

Fix CVE-2024-56658 Dong Chenchen (1): net: Fix kabi breakage in struct net Eric Dumazet (1): net: defer final 'struct net' free in netns dismantle include/net/net_namespace.h | 2 +- net/core/net_namespace.c | 20 +++++++++++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] netfilter: conntrack: clamp maximum hashtable size to INT_MAX
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.13-rc7 commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQN CVE: CVE-2025-21648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns. Fixes: 9cc1c73ad666 ("netfilter: conntrack: avoid integer overflow when resizing") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_core.c [commit b9e0102a57d7 use kvcalloc, which not merged lead to conflict] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 755e1cee32cb..ebc365e6ac8f 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -2314,12 +2314,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) struct hlist_nulls_head *hash; unsigned int nr_slots, i; - if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) + if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head))) return NULL; BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); + if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head))) + return NULL; + hash = kvmalloc_array(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL | __GFP_ZERO); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: x_tables: fix LED ID check in led_tg_check()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> mainline inclusion from mainline-v6.13-rc2 commit 04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO6 CVE: CVE-2024-56650 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 print_report+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_report+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? netlink_deliver_tap+0x2e/0x1b0 netlink_unicast+0x7f8/0x990 ? __pfx_netlink_unicast+0x10/0x10 ? __virt_addr_valid+0x183/0x530 ? __check_object_size+0x48e/0x900 netlink_sendmsg+0x8e4/0xcb0 ? __pfx_netlink_sendmsg+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? __pfx_____sys_sendmsg+0x10/0x10 __sys_sendmsg+0x292/0x380 ? __pfx___sys_sendmsg+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? exc_page_fault+0x590/0x8c0 ? do_syscall_64+0xb6/0x230 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> Since an invalid (without '\0' byte at all) byte sequence may be passed from userspace, add an extra check to ensure that such a sequence is rejected as possible ID and so never passed to 'kstrdup()' and further. Reported-by: syzbot+6c8215822f35fdb35667(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c8215822f35fdb35667 Fixes: 268cb38e1802 ("netfilter: x_tables: add LED trigger target") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_LED.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c index 19846445504d..043d657f4447 100644 --- a/net/netfilter/xt_LED.c +++ b/net/netfilter/xt_LED.c @@ -111,7 +111,9 @@ static int led_tg_check(const struct xt_tgchk_param *par) struct xt_led_info_internal *ledinternal; int err; - if (ledinfo->id[0] == '\0') + /* Bail out if empty string or not a string at all. */ + if (ledinfo->id[0] == '\0' || + !memchr(ledinfo->id, '\0', sizeof(ledinfo->id))) return -EINVAL; mutex_lock(&xt_led_mutex); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v3 0/2] net: Fix CVE-2024-56658
by Dong Chenchen 15 Feb '25

15 Feb '25

Fix CVE-2024-56658 Dong Chenchen (1): net: Fix kabi breakage in struct net Eric Dumazet (1): net: defer final 'struct net' free in netns dismantle include/net/net_namespace.h | 3 +++ net/core/net_namespace.c | 20 +++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] sched: sch_cake: add bounds checks to host bulk flow fairness counts
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v6.6.72 commit 27202e2e8721c3b23831563c36ed5ac7818641ba category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQOT CVE: CVE-2025-21647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 737d4d91d35b5f7fa5bb442651472277318b0bfd ] Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error). As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour. Fixes: 546ea84d07e3 ("sched: sch_cake: fix bulk flow accounting logic for host fairness") Reported-by: syzbot+f63600d288bfb7057424(a)syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Acked-by: Dave Taht <dave.taht(a)gmail.com> Link: https://patch.msgid.link/20250107120105.70685-1-toke@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_cake.c | 140 +++++++++++++++++++++++-------------------- 1 file changed, 75 insertions(+), 65 deletions(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index 30955dd45779..453dcc9c13f0 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -644,6 +644,63 @@ static bool cake_ddst(int flow_mode) return (flow_mode & CAKE_FLOW_DUAL_DST) == CAKE_FLOW_DUAL_DST; } +static void cake_dec_srchost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_dsrc(flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count)) + q->hosts[flow->srchost].srchost_bulk_flow_count--; +} + +static void cake_inc_srchost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_dsrc(flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count < CAKE_QUEUES)) + q->hosts[flow->srchost].srchost_bulk_flow_count++; +} + +static void cake_dec_dsthost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_ddst(flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count--; +} + +static void cake_inc_dsthost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_ddst(flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count < CAKE_QUEUES)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count++; +} + +static u16 cake_get_flow_quantum(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + u16 host_load = 1; + + if (cake_dsrc(flow_mode)) + host_load = max(host_load, + q->hosts[flow->srchost].srchost_bulk_flow_count); + + if (cake_ddst(flow_mode)) + host_load = max(host_load, + q->hosts[flow->dsthost].dsthost_bulk_flow_count); + + /* The get_random_u16() is a way to apply dithering to avoid + * accumulating roundoff errors + */ + return (q->flow_quantum * quantum_div[host_load] + + get_random_u16()) >> 16; +} + static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, int flow_mode, u16 flow_override, u16 host_override) { @@ -790,10 +847,8 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, allocate_dst = cake_ddst(flow_mode); if (q->flows[outer_hash + k].set == CAKE_SET_BULK) { - if (allocate_src) - q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; - if (allocate_dst) - q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; + cake_dec_srchost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); + cake_dec_dsthost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); } found: /* reserve queue for future packets in same flow */ @@ -818,9 +873,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].srchost_tag = srchost_hash; found_src: srchost_idx = outer_hash + k; - if (q->flows[reduced_hash].set == CAKE_SET_BULK) - q->hosts[srchost_idx].srchost_bulk_flow_count++; q->flows[reduced_hash].srchost = srchost_idx; + + if (q->flows[reduced_hash].set == CAKE_SET_BULK) + cake_inc_srchost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); } if (allocate_dst) { @@ -841,9 +897,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].dsthost_tag = dsthost_hash; found_dst: dsthost_idx = outer_hash + k; - if (q->flows[reduced_hash].set == CAKE_SET_BULK) - q->hosts[dsthost_idx].dsthost_bulk_flow_count++; q->flows[reduced_hash].dsthost = dsthost_idx; + + if (q->flows[reduced_hash].set == CAKE_SET_BULK) + cake_inc_dsthost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); } } @@ -1856,10 +1913,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* flowchain */ if (!flow->set || flow->set == CAKE_SET_DECAYING) { - struct cake_host *srchost = &b->hosts[flow->srchost]; - struct cake_host *dsthost = &b->hosts[flow->dsthost]; - u16 host_load = 1; - if (!flow->set) { list_add_tail(&flow->flowchain, &b->new_flows); } else { @@ -1869,18 +1922,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, flow->set = CAKE_SET_SPARSE; b->sparse_flow_count++; - if (cake_dsrc(q->flow_mode)) - host_load = max(host_load, srchost->srchost_bulk_flow_count); - - if (cake_ddst(q->flow_mode)) - host_load = max(host_load, dsthost->dsthost_bulk_flow_count); - - flow->deficit = (b->flow_quantum * - quantum_div[host_load]) >> 16; + flow->deficit = cake_get_flow_quantum(b, flow, q->flow_mode); } else if (flow->set == CAKE_SET_SPARSE_WAIT) { - struct cake_host *srchost = &b->hosts[flow->srchost]; - struct cake_host *dsthost = &b->hosts[flow->dsthost]; - /* this flow was empty, accounted as a sparse flow, but actually * in the bulk rotation. */ @@ -1888,12 +1931,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, b->sparse_flow_count--; b->bulk_flow_count++; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count++; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; - + cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); } if (q->buffer_used > q->buffer_max_used) @@ -1950,13 +1989,11 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) { struct cake_sched_data *q = qdisc_priv(sch); struct cake_tin_data *b = &q->tins[q->cur_tin]; - struct cake_host *srchost, *dsthost; ktime_t now = ktime_get(); struct cake_flow *flow; struct list_head *head; bool first_flow = true; struct sk_buff *skb; - u16 host_load; u64 delay; u32 len; @@ -2056,11 +2093,6 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) q->cur_flow = flow - b->flows; first_flow = false; - /* triple isolation (modified DRR++) */ - srchost = &b->hosts[flow->srchost]; - dsthost = &b->hosts[flow->dsthost]; - host_load = 1; - /* flow isolation (DRR++) */ if (flow->deficit <= 0) { /* Keep all flows with deficits out of the sparse and decaying @@ -2072,11 +2104,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) b->sparse_flow_count--; b->bulk_flow_count++; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count++; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; + cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); flow->set = CAKE_SET_BULK; } else { @@ -2088,19 +2117,7 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) } } - if (cake_dsrc(q->flow_mode)) - host_load = max(host_load, srchost->srchost_bulk_flow_count); - - if (cake_ddst(q->flow_mode)) - host_load = max(host_load, dsthost->dsthost_bulk_flow_count); - - WARN_ON(host_load > CAKE_QUEUES); - - /* The get_random_u16() is a way to apply dithering to avoid - * accumulating roundoff errors - */ - flow->deficit += (b->flow_quantum * quantum_div[host_load] + - get_random_u16()) >> 16; + flow->deficit += cake_get_flow_quantum(b, flow, q->flow_mode); list_move_tail(&flow->flowchain, &b->old_flows); goto retry; @@ -2124,11 +2141,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) if (flow->set == CAKE_SET_BULK) { b->bulk_flow_count--; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count--; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; + cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); b->decaying_flow_count++; } else if (flow->set == CAKE_SET_SPARSE || @@ -2146,12 +2160,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) else if (flow->set == CAKE_SET_BULK) { b->bulk_flow_count--; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count--; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; - + cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); } else b->decaying_flow_count--; -- 2.25.1

2 1

[PATCH OLK-6.6] net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.72 commit e54beb9aed2a90dddf4c5d68fcfc9a01f3e40a61 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQJ CVE: CVE-2025-21653 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a039e54397c6a75b713b9ce7894a62e06956aa92 ] syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSAN: shift-out-of-bounds in net/sched/cls_flow.c:329:23 shift exponent 9445 is too large for 32-bit type 'u32' (aka 'unsigned int') CPU: 1 UID: 0 PID: 54 Comm: kworker/u8:3 Not tainted 6.13.0-rc3-syzkaller-00180-g4f619d518db9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 ubsan_epilogue lib/ubsan.c:231 [inline] __ubsan_handle_shift_out_of_bounds+0x3c8/0x420 lib/ubsan.c:468 flow_classify+0x24d5/0x25b0 net/sched/cls_flow.c:329 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1771 [inline] tcf_classify+0x420/0x1160 net/sched/cls_api.c:1867 sfb_classify net/sched/sch_sfb.c:260 [inline] sfb_enqueue+0x3ad/0x18b0 net/sched/sch_sfb.c:318 dev_qdisc_enqueue+0x4b/0x290 net/core/dev.c:3793 __dev_xmit_skb net/core/dev.c:3889 [inline] __dev_queue_xmit+0xf0e/0x3f50 net/core/dev.c:4400 dev_queue_xmit include/linux/netdevice.h:3168 [inline] neigh_hh_output include/net/neighbour.h:523 [inline] neigh_output include/net/neighbour.h:537 [inline] ip_finish_output2+0xd41/0x1390 net/ipv4/ip_output.c:236 iptunnel_xmit+0x55d/0x9b0 net/ipv4/ip_tunnel_core.c:82 udp_tunnel_xmit_skb+0x262/0x3b0 net/ipv4/udp_tunnel_core.c:173 geneve_xmit_skb drivers/net/geneve.c:916 [inline] geneve_xmit+0x21dc/0x2d00 drivers/net/geneve.c:1039 __netdev_start_xmit include/linux/netdevice.h:5002 [inline] netdev_start_xmit include/linux/netdevice.h:5011 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x27a/0x7d0 net/core/dev.c:3606 __dev_queue_xmit+0x1b73/0x3f50 net/core/dev.c:4434 Fixes: e5dfb815181f ("[NET_SCHED]: Add flow classifier") Reported-by: syzbot+1dbb57d994e54aaa04d2(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6777bf49.050a0220.178762.0040.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250103104546.3714168-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/cls_flow.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c index 6ab317b48d6c..815216b564f3 100644 --- a/net/sched/cls_flow.c +++ b/net/sched/cls_flow.c @@ -356,7 +356,8 @@ static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = { [TCA_FLOW_KEYS] = { .type = NLA_U32 }, [TCA_FLOW_MODE] = { .type = NLA_U32 }, [TCA_FLOW_BASECLASS] = { .type = NLA_U32 }, - [TCA_FLOW_RSHIFT] = { .type = NLA_U32 }, + [TCA_FLOW_RSHIFT] = NLA_POLICY_MAX(NLA_U32, + 31 /* BITS_PER_U32 - 1 */), [TCA_FLOW_ADDEND] = { .type = NLA_U32 }, [TCA_FLOW_MASK] = { .type = NLA_U32 }, [TCA_FLOW_XOR] = { .type = NLA_U32 }, -- 2.25.1

2 1

[PATCH OLK-6.6] net: wwan: t7xx: Fix FSM command timeout issue
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jinjian Song <jinjian.song(a)fibocom.com> stable inclusion from stable-v6.6.70 commit 0cd3bde081cd3452c875fa1e5c55834c670d6e05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID39 CVE: CVE-2024-39282 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4f619d518db9cd1a933c3a095a5f95d0c1584ae8 ] When driver processes the internal state change command, it use an asynchronous thread to process the command operation. If the main thread detects that the task has timed out, the asynchronous thread will panic when executing the completion notification because the main thread completion object has been released. BUG: unable to handle page fault for address: fffffffffffffff8 PGD 1f283a067 P4D 1f283a067 PUD 1f283c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:complete_all+0x3e/0xa0 [...] Call Trace: <TASK> ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? complete_all+0x3e/0xa0 fsm_main_thread+0xa3/0x9c0 [mtk_t7xx (HASH:1400 5)] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0xd8/0x110 ? __pfx_fsm_main_thread+0x10/0x10 [mtk_t7xx (HASH:1400 5)] ? __pfx_kthread+0x10/0x10 ret_from_fork+0x38/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> [...] CR2: fffffffffffffff8 ---[ end trace 0000000000000000 ]--- Use the reference counter to ensure safe release as Sergey suggests: https://lore.kernel.org/all/da90f64c-260a-4329-87bf-1f9ff20a5951@gmail.com/ Fixes: 13e920d93e37 ("net: wwan: t7xx: Add core components") Signed-off-by: Jinjian Song <jinjian.song(a)fibocom.com> Acked-by: Sergey Ryazanov <ryazanov.s.a(a)gmail.com> Link: https://patch.msgid.link/20241224041552.8711-1-jinjian.song@fibocom.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wwan/t7xx/t7xx_state_monitor.c | 26 ++++++++++++++-------- drivers/net/wwan/t7xx/t7xx_state_monitor.h | 5 +++-- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/drivers/net/wwan/t7xx/t7xx_state_monitor.c b/drivers/net/wwan/t7xx/t7xx_state_monitor.c index 80edb8e75a6a..64868df3640d 100644 --- a/drivers/net/wwan/t7xx/t7xx_state_monitor.c +++ b/drivers/net/wwan/t7xx/t7xx_state_monitor.c @@ -97,14 +97,21 @@ void t7xx_fsm_broadcast_state(struct t7xx_fsm_ctl *ctl, enum md_state state) fsm_state_notify(ctl->md, state); } +static void fsm_release_command(struct kref *ref) +{ + struct t7xx_fsm_command *cmd = container_of(ref, typeof(*cmd), refcnt); + + kfree(cmd); +} + static void fsm_finish_command(struct t7xx_fsm_ctl *ctl, struct t7xx_fsm_command *cmd, int result) { if (cmd->flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { - *cmd->ret = result; - complete_all(cmd->done); + cmd->result = result; + complete_all(&cmd->done); } - kfree(cmd); + kref_put(&cmd->refcnt, fsm_release_command); } static void fsm_del_kf_event(struct t7xx_fsm_event *event) @@ -396,7 +403,6 @@ static int fsm_main_thread(void *data) int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id, unsigned int flag) { - DECLARE_COMPLETION_ONSTACK(done); struct t7xx_fsm_command *cmd; unsigned long flags; int ret; @@ -408,11 +414,13 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id INIT_LIST_HEAD(&cmd->entry); cmd->cmd_id = cmd_id; cmd->flag = flag; + kref_init(&cmd->refcnt); if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { - cmd->done = &done; - cmd->ret = &ret; + init_completion(&cmd->done); + kref_get(&cmd->refcnt); } + kref_get(&cmd->refcnt); spin_lock_irqsave(&ctl->command_lock, flags); list_add_tail(&cmd->entry, &ctl->command_queue); spin_unlock_irqrestore(&ctl->command_lock, flags); @@ -422,11 +430,11 @@ int t7xx_fsm_append_cmd(struct t7xx_fsm_ctl *ctl, enum t7xx_fsm_cmd_state cmd_id if (flag & FSM_CMD_FLAG_WAIT_FOR_COMPLETION) { unsigned long wait_ret; - wait_ret = wait_for_completion_timeout(&done, + wait_ret = wait_for_completion_timeout(&cmd->done, msecs_to_jiffies(FSM_CMD_TIMEOUT_MS)); - if (!wait_ret) - return -ETIMEDOUT; + ret = wait_ret ? cmd->result : -ETIMEDOUT; + kref_put(&cmd->refcnt, fsm_release_command); return ret; } diff --git a/drivers/net/wwan/t7xx/t7xx_state_monitor.h b/drivers/net/wwan/t7xx/t7xx_state_monitor.h index b6e76f3903c8..74f96fd2605e 100644 --- a/drivers/net/wwan/t7xx/t7xx_state_monitor.h +++ b/drivers/net/wwan/t7xx/t7xx_state_monitor.h @@ -109,8 +109,9 @@ struct t7xx_fsm_command { struct list_head entry; enum t7xx_fsm_cmd_state cmd_id; unsigned int flag; - struct completion *done; - int *ret; + struct completion done; + int result; + struct kref refcnt; }; struct t7xx_fsm_notifier { -- 2.25.1

2 1

[PATCH OLK-6.6] net/mlx5e: Skip restore TC rules for vport rep without loaded flag
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jianbo Liu <jianbol(a)nvidia.com> stable inclusion from stable-v6.6.70 commit 3e45dd1622a2c1a83c11bf42fdd8c1810123d6c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID2C CVE: CVE-2024-57801 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a03b368562a7ff5f5f1f63b5adf8309cbdbd5be ] During driver unload, unregister_netdev is called after unloading vport rep. So, the mlx5e_rep_priv is already freed while trying to get rpriv->netdev, or walk rpriv->tc_ht, which results in use-after-free. So add the checking to make sure access the data of vport rep which is still loaded. Fixes: d1569537a837 ("net/mlx5e: Modify and restore TC rules for IPSec TX rules") Signed-off-by: Jianbo Liu <jianbol(a)nvidia.com> Reviewed-by: Saeed Mahameed <saeedm(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20241220081505.1286093-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 6 +++--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +++ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 --- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c index 13b5916b64e2..eed8fcde2613 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c @@ -150,11 +150,11 @@ void mlx5_esw_ipsec_restore_dest_uplink(struct mlx5_core_dev *mdev) unsigned long i; int err; - xa_for_each(&esw->offloads.vport_reps, i, rep) { - rpriv = rep->rep_data[REP_ETH].priv; - if (!rpriv || !rpriv->netdev) + mlx5_esw_for_each_rep(esw, i, rep) { + if (atomic_read(&rep->rep_data[REP_ETH].state) != REP_LOADED) continue; + rpriv = rep->rep_data[REP_ETH].priv; rhashtable_walk_enter(&rpriv->tc_ht, &iter); rhashtable_walk_start(&iter); while ((flow = rhashtable_walk_next(&iter)) != NULL) { diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h index 9b771b572593..3e58e731b569 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h @@ -713,6 +713,9 @@ void mlx5e_tc_clean_fdb_peer_flows(struct mlx5_eswitch *esw); MLX5_CAP_GEN_2((esw->dev), ec_vf_vport_base) +\ (last) - 1) +#define mlx5_esw_for_each_rep(esw, i, rep) \ + xa_for_each(&((esw)->offloads.vport_reps), i, rep) + struct mlx5_eswitch *__must_check mlx5_devlink_eswitch_get(struct devlink *devlink); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c index 58529d1a98b3..7eba3a5bb97c 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c @@ -52,9 +52,6 @@ #include "lag/lag.h" #include "en/tc/post_meter.h" -#define mlx5_esw_for_each_rep(esw, i, rep) \ - xa_for_each(&((esw)->offloads.vport_reps), i, rep) - /* There are two match-all miss flows, one for unicast dst mac and * one for multicast. */ -- 2.25.1

2 1

[PATCH OLK-6.6] net: Fix icmp host relookup triggering ip_rt_bug
by Dong Chenchen 15 Feb '25

15 Feb '25

mainline inclusion from mainline-v6.13-rc2 commit c44daa7e3c73229f7ac74985acb8c7fb909c4e0a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANM CVE: CVE-2024-56647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- arp link failure may trigger ip_rt_bug while xfrm enabled, call trace is: WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20 Modules linked in: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc6-00077-g2e1b3cc9d7f7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:ip_rt_bug+0x14/0x20 Call Trace: <IRQ> ip_send_skb+0x14/0x40 __icmp_send+0x42d/0x6a0 ipv4_link_failure+0xe2/0x1d0 arp_error_report+0x3c/0x50 neigh_invalidate+0x8d/0x100 neigh_timer_handler+0x2e1/0x330 call_timer_fn+0x21/0x120 __run_timer_base.part.0+0x1c9/0x270 run_timer_softirq+0x4c/0x80 handle_softirqs+0xac/0x280 irq_exit_rcu+0x62/0x80 sysvec_apic_timer_interrupt+0x77/0x90 The script below reproduces this scenario: ip xfrm policy add src 0.0.0.0/0 dst 0.0.0.0/0 \ dir out priority 0 ptype main flag localok icmp ip l a veth1 type veth ip a a 192.168.141.111/24 dev veth0 ip l s veth0 up ping 192.168.141.155 -c 1 icmp_route_lookup() create input routes for locally generated packets while xfrm relookup ICMP traffic.Then it will set input route (dst->out = ip_rt_bug) to skb for DESTUNREACH. For ICMP err triggered by locally generated packets, dst->dev of output route is loopback. Generally, xfrm relookup verification is not required on loopback interfaces (net.ipv4.conf.lo.disable_xfrm = 1). Skip icmp relookup for locally generated packets to fix it. Fixes: 8b7817f3a959 ("[IPSEC]: Add ICMP host relookup support") Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241127040850.1513135-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/icmp.c [commit 913c83a610bb convert icmp_route_lookup() to dscp_t, which not merged lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/icmp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 9dffdd876fef..b40c1fc39125 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -521,6 +521,9 @@ static struct rtable *icmp_route_lookup(struct net *net, if (!IS_ERR(rt)) { if (rt != rt2) return rt; + if (inet_addr_type_dev_table(net, route_lookup_dev, + fl4->daddr) == RTN_LOCAL) + return rt; } else if (PTR_ERR(rt) == -EPERM) { rt = NULL; } else -- 2.25.1

2 1

[PATCH OLK-6.6] net/sched: netem: account for backlog updates from child qdisc
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Martin Ottens <martin.ottens(a)fau.de> stable inclusion from stable-v6.6.67 commit 3824c5fad18eeb7abe0c4fc966f29959552dca3e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCV9 CVE: CVE-2024-56770 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8d4bc455047cf3903cd6f85f49978987dbb3027 ] In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its children holds. In case of netem, 'qlen' only accounts for the packets in its internal tfifo. When netem is used with a child qdisc, the child qdisc can use 'qdisc_tree_reduce_backlog' to inform its parent, netem, about created or dropped SKBs. This function updates 'qlen' and the backlog statistics of netem, but netem does not account for changes made by a child qdisc. 'qlen' then indicates the wrong number of packets in the tfifo. If a child qdisc creates new SKBs during enqueue and informs its parent about this, netem's 'qlen' value is increased. When netem dequeues the newly created SKBs from the child, the 'qlen' in netem is not updated. If 'qlen' reaches the configured sch->limit, the enqueue function stops working, even though the tfifo is not full. Reproduce the bug: Ensure that the sender machine has GSO enabled. Configure netem as root qdisc and tbf as its child on the outgoing interface of the machine as follows: $ tc qdisc add dev <oif> root handle 1: netem delay 100ms limit 100 $ tc qdisc add dev <oif> parent 1:0 tbf rate 50Mbit burst 1542 latency 50ms Send bulk TCP traffic out via this interface, e.g., by running an iPerf3 client on the machine. Check the qdisc statistics: $ tc -s qdisc show dev <oif> Statistics after 10s of iPerf3 TCP test before the fix (note that netem's backlog > limit, netem stopped accepting packets): qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 2767766 bytes 1848 pkt (dropped 652, overlimits 0 requeues 0) backlog 4294528236b 1155p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 2767766 bytes 1848 pkt (dropped 327, overlimits 7601 requeues 0) backlog 0b 0p requeues 0 Statistics after the fix: qdisc netem 1: root refcnt 2 limit 1000 delay 100ms Sent 37766372 bytes 24974 pkt (dropped 9, overlimits 0 requeues 0) backlog 0b 0p requeues 0 qdisc tbf 10: parent 1:1 rate 50Mbit burst 1537b lat 50ms Sent 37766372 bytes 24974 pkt (dropped 327, overlimits 96017 requeues 0) backlog 0b 0p requeues 0 tbf segments the GSO SKBs (tbf_segment) and updates the netem's 'qlen'. The interface fully stops transferring packets and "locks". In this case, the child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at its limit and no more packets are accepted. This patch adds a counter for the entries in the tfifo. Netem's 'qlen' is only decreased when a packet is returned by its dequeue function, and not during enqueuing into the child qdisc. External updates to 'qlen' are thus accounted for and only the behavior of the backlog statistics changes. As in other qdiscs, 'qlen' then keeps track of how many packets are held in netem and all of its children. As before, sch->limit remains as the maximum number of packets in the tfifo. The same applies to netem's backlog statistics. Fixes: 50612537e9ab ("netem: fix classful handling") Signed-off-by: Martin Ottens <martin.ottens(a)fau.de> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://patch.msgid.link/20241210131412.1837202-1-martin.ottens@fau.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_netem.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index d36eeb7b0502..152dbbe8fd31 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -78,6 +78,8 @@ struct netem_sched_data { struct sk_buff *t_head; struct sk_buff *t_tail; + u32 t_len; + /* optional qdisc for classful handling (NULL at netem init) */ struct Qdisc *qdisc; @@ -382,6 +384,7 @@ static void tfifo_reset(struct Qdisc *sch) rtnl_kfree_skbs(q->t_head, q->t_tail); q->t_head = NULL; q->t_tail = NULL; + q->t_len = 0; } static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch) @@ -411,6 +414,7 @@ static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch) rb_link_node(&nskb->rbnode, parent, p); rb_insert_color(&nskb->rbnode, &q->t_root); } + q->t_len++; sch->q.qlen++; } @@ -517,7 +521,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, 1<<get_random_u32_below(8); } - if (unlikely(sch->q.qlen >= sch->limit)) { + if (unlikely(q->t_len >= sch->limit)) { /* re-link segs, so that qdisc_drop_all() frees them all */ skb->next = segs; qdisc_drop_all(skb, sch, to_free); @@ -701,8 +705,8 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) tfifo_dequeue: skb = __qdisc_dequeue_head(&sch->q); if (skb) { - qdisc_qstats_backlog_dec(sch, skb); deliver: + qdisc_qstats_backlog_dec(sch, skb); qdisc_bstats_update(sch, skb); return skb; } @@ -718,8 +722,7 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) if (time_to_send <= now && q->slot.slot_next <= now) { netem_erase_head(q, skb); - sch->q.qlen--; - qdisc_qstats_backlog_dec(sch, skb); + q->t_len--; skb->next = NULL; skb->prev = NULL; /* skb->dev shares skb->rbnode area, @@ -746,16 +749,21 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) if (net_xmit_drop_count(err)) qdisc_qstats_drop(sch); qdisc_tree_reduce_backlog(sch, 1, pkt_len); + sch->qstats.backlog -= pkt_len; + sch->q.qlen--; } goto tfifo_dequeue; } + sch->q.qlen--; goto deliver; } if (q->qdisc) { skb = q->qdisc->ops->dequeue(q->qdisc); - if (skb) + if (skb) { + sch->q.qlen--; goto deliver; + } } qdisc_watchdog_schedule_ns(&q->watchdog, @@ -765,8 +773,10 @@ static struct sk_buff *netem_dequeue(struct Qdisc *sch) if (q->qdisc) { skb = q->qdisc->ops->dequeue(q->qdisc); - if (skb) + if (skb) { + sch->q.qlen--; goto deliver; + } } return NULL; } -- 2.25.1

2 1

[PATCH OLK-6.6] netfilter: IDLETIMER: Fix for possible ABBA deadlock
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Phil Sutter <phil(a)nwl.cc> stable inclusion from stable-v6.6.67 commit 8c2c8445cda8f59c38dec7dc10509bcb23ae26a0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCF5 CVE: CVE-2024-54683 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f36b01994d68ffc253c8296e2228dfe6e6431c03 ] Deletion of the last rule referencing a given idletimer may happen at the same time as a read of its file in sysfs: | ====================================================== | WARNING: possible circular locking dependency detected | 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted | ------------------------------------------------------ | iptables/3303 is trying to acquire lock: | ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20 | | but task is already holding lock: | ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v] | | which lock already depends on the new lock. A simple reproducer is: | #!/bin/bash | | while true; do | iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme" | done & | while true; do | cat /sys/class/xt_idletimer/timers/testme >/dev/null | done Avoid this by freeing list_mutex right after deleting the element from the list, then continuing with the teardown. Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation") Signed-off-by: Phil Sutter <phil(a)nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_IDLETIMER.c | 52 +++++++++++++++++++----------------- 1 file changed, 28 insertions(+), 24 deletions(-) diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c index f8b25b6f5da7..9869ef3c2ab3 100644 --- a/net/netfilter/xt_IDLETIMER.c +++ b/net/netfilter/xt_IDLETIMER.c @@ -409,21 +409,23 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par) mutex_lock(&list_mutex); - if (--info->timer->refcnt == 0) { - pr_debug("deleting timer %s\n", info->label); - - list_del(&info->timer->entry); - timer_shutdown_sync(&info->timer->timer); - cancel_work_sync(&info->timer->work); - sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr); - kfree(info->timer->attr.attr.name); - kfree(info->timer); - } else { + if (--info->timer->refcnt > 0) { pr_debug("decreased refcnt of timer %s to %u\n", info->label, info->timer->refcnt); + mutex_unlock(&list_mutex); + return; } + pr_debug("deleting timer %s\n", info->label); + + list_del(&info->timer->entry); mutex_unlock(&list_mutex); + + timer_shutdown_sync(&info->timer->timer); + cancel_work_sync(&info->timer->work); + sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr); + kfree(info->timer->attr.attr.name); + kfree(info->timer); } static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par) @@ -434,25 +436,27 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par) mutex_lock(&list_mutex); - if (--info->timer->refcnt == 0) { - pr_debug("deleting timer %s\n", info->label); - - list_del(&info->timer->entry); - if (info->timer->timer_type & XT_IDLETIMER_ALARM) { - alarm_cancel(&info->timer->alarm); - } else { - timer_shutdown_sync(&info->timer->timer); - } - cancel_work_sync(&info->timer->work); - sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr); - kfree(info->timer->attr.attr.name); - kfree(info->timer); - } else { + if (--info->timer->refcnt > 0) { pr_debug("decreased refcnt of timer %s to %u\n", info->label, info->timer->refcnt); + mutex_unlock(&list_mutex); + return; } + pr_debug("deleting timer %s\n", info->label); + + list_del(&info->timer->entry); mutex_unlock(&list_mutex); + + if (info->timer->timer_type & XT_IDLETIMER_ALARM) { + alarm_cancel(&info->timer->alarm); + } else { + timer_shutdown_sync(&info->timer->timer); + } + cancel_work_sync(&info->timer->work); + sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr); + kfree(info->timer->attr.attr.name); + kfree(info->timer); } -- 2.25.1

2 1

[PATCH OLK-6.6] netfilter: conntrack: clamp maximum hashtable size to INT_MAX
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.72 commit d5807dd1328bbc86e059c5de80d1bbee9d58ca3d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQN CVE: CVE-2025-21648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 ] Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns. Fixes: 9cc1c73ad666 ("netfilter: conntrack: avoid integer overflow when resizing") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index e4ae2a08da6a..34ad5975fbf3 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -2568,12 +2568,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) struct hlist_nulls_head *hash; unsigned int nr_slots, i; - if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) + if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head))) return NULL; BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); + if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head))) + return NULL; + hash = kvcalloc(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL); if (hash && nulls) -- 2.25.1

2 1

[PATCH OLK-6.6] ipv6: Fix soft lockups in fib6_select_path under high next hop churn
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Omid Ehtemam-Haghighi <omid.ehtemamhaghighi(a)menlosecurity.com> mainline inclusion from mainline-v6.13-rc1 commit d9ccb18f83ea2bb654289b6ecf014fd267cc988b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEDOT CVE: CVE-2024-56703 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using the `bird` service, these routers continuously update BGP-advertised routes due to frequently changing nexthop destinations, while also managing significant IPv6 traffic. The lockups occur during the traversal of the multipath circular linked-list in the `fib6_select_path` function, particularly while iterating through the siblings in the list. The issue typically arises when the nodes of the linked list are unexpectedly deleted concurrently on a different core—indicated by their 'next' and 'previous' elements pointing back to the node itself and their reference count dropping to zero. This results in an infinite loop, leading to a soft lockup that triggers a system panic via the watchdog timer. Apply RCU primitives in the problematic code sections to resolve the issue. Where necessary, update the references to fib6_siblings to annotate or use the RCU APIs. Include a test script that reproduces the issue. The script periodically updates the routing table while generating a heavy load of outgoing IPv6 traffic through multiple iperf3 clients. It consistently induces infinite soft lockups within a couple of minutes. Kernel log: 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d -- <IRQ stack> -- 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb [exception RIP: fib6_select_path+299] RIP: ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287 RAX: ffff975850b43600 RBX: ffff975850b40200 RCX: 0000000000000000 RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618 RBP: ffffbd13003d3800 R8: 0000000000000000 R9: ffff975850b40200 R10: 0000000000000000 R11: 0000000000000000 R12: ffffbd13003d3830 R13: ffff975850b436a8 R14: ffff975850b43600 R15: 0000000000000007 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c 10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c 11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5 12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47 13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0 14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274 15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474 16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615 17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec 18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3 19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9 20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice] 21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice] 22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice] 23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000 24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581 25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9 26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47 27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30 28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f 29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64 30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb Fixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table") Reported-by: Adrian Oliver <kernel(a)aoliver.ca> Signed-off-by: Omid Ehtemam-Haghighi <omid.ehtemamhaghighi(a)menlosecurity.com> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Ido Schimmel <idosch(a)idosch.org> Cc: Kuniyuki Iwashima <kuniyu(a)amazon.com> Cc: Simon Horman <horms(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20241106010236.1239299-1-omid.ehtemamhaghighi@menl… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/route.c tools/testing/selftests/net/Makefile [commit cd9ebde125bf which not merged lead to conflict] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ip6_fib.c | 8 +- net/ipv6/route.c | 45 ++- tools/testing/selftests/net/Makefile | 1 + .../net/ipv6_route_update_soft_lockup.sh | 262 ++++++++++++++++++ 4 files changed, 297 insertions(+), 19 deletions(-) create mode 100755 tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index afa9073567dc..023ac39041a2 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -1179,8 +1179,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, while (sibling) { if (sibling->fib6_metric == rt->fib6_metric && rt6_qualify_for_ecmp(sibling)) { - list_add_tail(&rt->fib6_siblings, - &sibling->fib6_siblings); + list_add_tail_rcu(&rt->fib6_siblings, + &sibling->fib6_siblings); break; } sibling = rcu_dereference_protected(sibling->fib6_next, @@ -1241,7 +1241,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, fib6_siblings) sibling->fib6_nsiblings--; rt->fib6_nsiblings = 0; - list_del_init(&rt->fib6_siblings); + list_del_rcu(&rt->fib6_siblings); rt6_multipath_rebalance(next_sibling); return err; } @@ -1954,7 +1954,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; rt->fib6_nsiblings = 0; - list_del_init(&rt->fib6_siblings); + list_del_rcu(&rt->fib6_siblings); rt6_multipath_rebalance(next_sibling); } diff --git a/net/ipv6/route.c b/net/ipv6/route.c index fc5c53462025..c5cee40a658b 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -418,8 +418,8 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, struct flowi6 *fl6, int oif, bool have_oif_match, const struct sk_buff *skb, int strict) { - struct fib6_info *sibling, *next_sibling; struct fib6_info *match = res->f6i; + struct fib6_info *sibling; if (!match->nh && (!match->fib6_nsiblings || have_oif_match)) goto out; @@ -445,8 +445,8 @@ void fib6_select_path(const struct net *net, struct fib6_result *res, if (fl6->mp_hash <= atomic_read(&match->fib6_nh->fib_nh_upper_bound)) goto out; - list_for_each_entry_safe(sibling, next_sibling, &match->fib6_siblings, - fib6_siblings) { + list_for_each_entry_rcu(sibling, &match->fib6_siblings, + fib6_siblings) { const struct fib6_nh *nh = sibling->fib6_nh; int nh_upper_bound; @@ -5186,14 +5186,18 @@ static void ip6_route_mpath_notify(struct fib6_info *rt, * nexthop. Since sibling routes are always added at the end of * the list, find the first sibling of the last route appended */ + rcu_read_lock(); + if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) { - rt = list_first_entry(&rt_last->fib6_siblings, - struct fib6_info, - fib6_siblings); + rt = list_first_or_null_rcu(&rt_last->fib6_siblings, + struct fib6_info, + fib6_siblings); } if (rt) inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags); + + rcu_read_unlock(); } static bool ip6_route_mpath_should_notify(const struct fib6_info *rt) @@ -5538,17 +5542,21 @@ static size_t rt6_nlmsg_size(struct fib6_info *f6i) nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size, &nexthop_len); } else { - struct fib6_info *sibling, *next_sibling; struct fib6_nh *nh = f6i->fib6_nh; + struct fib6_info *sibling; nexthop_len = 0; if (f6i->fib6_nsiblings) { rt6_nh_nlmsg_size(nh, &nexthop_len); - list_for_each_entry_safe(sibling, next_sibling, - &f6i->fib6_siblings, fib6_siblings) { + rcu_read_lock(); + + list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, + fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } + + rcu_read_unlock(); } nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); } @@ -5712,7 +5720,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0) goto nla_put_failure; } else if (rt->fib6_nsiblings) { - struct fib6_info *sibling, *next_sibling; + struct fib6_info *sibling; struct nlattr *mp; mp = nla_nest_start_noflag(skb, RTA_MULTIPATH); @@ -5724,14 +5732,21 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, 0) < 0) goto nla_put_failure; - list_for_each_entry_safe(sibling, next_sibling, - &rt->fib6_siblings, fib6_siblings) { + rcu_read_lock(); + + list_for_each_entry_rcu(sibling, &rt->fib6_siblings, + fib6_siblings) { if (fib_add_nexthop(skb, &sibling->fib6_nh->nh_common, sibling->fib6_nh->fib_nh_weight, - AF_INET6, 0) < 0) + AF_INET6, 0) < 0) { + rcu_read_unlock(); + goto nla_put_failure; + } } + rcu_read_unlock(); + nla_nest_end(skb, mp); } else if (rt->nh) { if (nla_put_u32(skb, RTA_NH_ID, rt->nh->id)) @@ -6168,7 +6183,7 @@ void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info, err = -ENOBUFS; seq = info->nlh ? info->nlh->nlmsg_seq : 0; - skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any()); + skb = nlmsg_new(rt6_nlmsg_size(rt), GFP_ATOMIC); if (!skb) goto errout; @@ -6181,7 +6196,7 @@ void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info, goto errout; } rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE, - info->nlh, gfp_any()); + info->nlh, GFP_ATOMIC); return; errout: if (err < 0) diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile index f89dc5cd6111..ebe3f5874af7 100644 --- a/tools/testing/selftests/net/Makefile +++ b/tools/testing/selftests/net/Makefile @@ -53,6 +53,7 @@ TEST_PROGS += bind_bhash.sh TEST_PROGS += ip_local_port_range.sh TEST_PROGS += rps_default_mask.sh TEST_PROGS += big_tcp.sh +TEST_PROGS += ipv6_route_update_soft_lockup.sh TEST_PROGS_EXTENDED := toeplitz_client.sh toeplitz.sh TEST_GEN_FILES = socket nettest TEST_GEN_FILES += psock_fanout psock_tpacket msg_zerocopy reuseport_addr_any diff --git a/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh b/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh new file mode 100755 index 000000000000..a6b2b1f9c641 --- /dev/null +++ b/tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh @@ -0,0 +1,262 @@ +#!/bin/bash +# SPDX-License-Identifier: GPL-2.0 +# +# Testing for potential kernel soft lockup during IPv6 routing table +# refresh under heavy outgoing IPv6 traffic. If a kernel soft lockup +# occurs, a kernel panic will be triggered to prevent associated issues. +# +# +# Test Environment Layout +# +# ┌----------------┐ ┌----------------┐ +# | SOURCE_NS | | SINK_NS | +# | NAMESPACE | | NAMESPACE | +# |(iperf3 clients)| |(iperf3 servers)| +# | | | | +# | | | | +# | ┌-----------| nexthops |---------┐ | +# | |veth_source|<--------------------------------------->|veth_sink|<┐ | +# | └-----------|2001:0DB8:1::0:1/96 2001:0DB8:1::1:1/96 |---------┘ | | +# | | ^ 2001:0DB8:1::1:2/96 | | | +# | | . . | fwd | | +# | ┌---------┐ | . . | | | +# | | IPv6 | | . . | V | +# | | routing | | . 2001:0DB8:1::1:80/96| ┌-----┐ | +# | | table | | . | | lo | | +# | | nexthop | | . └--------┴-----┴-┘ +# | | update | | ............................> 2001:0DB8:2::1:1/128 +# | └-------- ┘ | +# └----------------┘ +# +# The test script sets up two network namespaces, source_ns and sink_ns, +# connected via a veth link. Within source_ns, it continuously updates the +# IPv6 routing table by flushing and inserting IPV6_NEXTHOP_ADDR_COUNT nexthop +# IPs destined for SINK_LOOPBACK_IP_ADDR in sink_ns. This refresh occurs at a +# rate of 1/ROUTING_TABLE_REFRESH_PERIOD per second for TEST_DURATION seconds. +# +# Simultaneously, multiple iperf3 clients within source_ns generate heavy +# outgoing IPv6 traffic. Each client is assigned a unique port number starting +# at 5000 and incrementing sequentially. Each client targets a unique iperf3 +# server running in sink_ns, connected to the SINK_LOOPBACK_IFACE interface +# using the same port number. +# +# The number of iperf3 servers and clients is set to half of the total +# available cores on each machine. +# +# NOTE: We have tested this script on machines with various CPU specifications, +# ranging from lower to higher performance as listed below. The test script +# effectively triggered a kernel soft lockup on machines running an unpatched +# kernel in under a minute: +# +# - 1x Intel Xeon E-2278G 8-Core Processor @ 3.40GHz +# - 1x Intel Xeon E-2378G Processor 8-Core @ 2.80GHz +# - 1x AMD EPYC 7401P 24-Core Processor @ 2.00GHz +# - 1x AMD EPYC 7402P 24-Core Processor @ 2.80GHz +# - 2x Intel Xeon Gold 5120 14-Core Processor @ 2.20GHz +# - 1x Ampere Altra Q80-30 80-Core Processor @ 3.00GHz +# - 2x Intel Xeon Gold 5120 14-Core Processor @ 2.20GHz +# - 2x Intel Xeon Silver 4214 24-Core Processor @ 2.20GHz +# - 1x AMD EPYC 7502P 32-Core @ 2.50GHz +# - 1x Intel Xeon Gold 6314U 32-Core Processor @ 2.30GHz +# - 2x Intel Xeon Gold 6338 32-Core Processor @ 2.00GHz +# +# On less performant machines, you may need to increase the TEST_DURATION +# parameter to enhance the likelihood of encountering a race condition leading +# to a kernel soft lockup and avoid a false negative result. +# +# NOTE: The test may not produce the expected result in virtualized +# environments (e.g., qemu) due to differences in timing and CPU handling, +# which can affect the conditions needed to trigger a soft lockup. + +source lib.sh +source net_helper.sh + +TEST_DURATION=300 +ROUTING_TABLE_REFRESH_PERIOD=0.01 + +IPERF3_BITRATE="300m" + + +IPV6_NEXTHOP_ADDR_COUNT="128" +IPV6_NEXTHOP_ADDR_MASK="96" +IPV6_NEXTHOP_PREFIX="2001:0DB8:1" + + +SOURCE_TEST_IFACE="veth_source" +SOURCE_TEST_IP_ADDR="2001:0DB8:1::0:1/96" + +SINK_TEST_IFACE="veth_sink" +# ${SINK_TEST_IFACE} is populated with the following range of IPv6 addresses: +# 2001:0DB8:1::1:1 to 2001:0DB8:1::1:${IPV6_NEXTHOP_ADDR_COUNT} +SINK_LOOPBACK_IFACE="lo" +SINK_LOOPBACK_IP_MASK="128" +SINK_LOOPBACK_IP_ADDR="2001:0DB8:2::1:1" + +nexthop_ip_list="" +termination_signal="" +kernel_softlokup_panic_prev_val="" + +terminate_ns_processes_by_pattern() { + local ns=$1 + local pattern=$2 + + for pid in $(ip netns pids ${ns}); do + [ -e /proc/$pid/cmdline ] && grep -qe "${pattern}" /proc/$pid/cmdline && kill -9 $pid + done +} + +cleanup() { + echo "info: cleaning up namespaces and terminating all processes within them..." + + + # Terminate iperf3 instances running in the source_ns. To avoid race + # conditions, first iterate over the PIDs and terminate those + # associated with the bash shells running the + # `while true; do iperf3 -c ...; done` loops. In a second iteration, + # terminate the individual `iperf3 -c ...` instances. + terminate_ns_processes_by_pattern ${source_ns} while + terminate_ns_processes_by_pattern ${source_ns} iperf3 + + # Repeat the same process for sink_ns + terminate_ns_processes_by_pattern ${sink_ns} while + terminate_ns_processes_by_pattern ${sink_ns} iperf3 + + # Check if any iperf3 instances are still running. This could happen + # if a core has entered an infinite loop and the timeout for detecting + # the soft lockup has not expired, but either the test interval has + # already elapsed or the test was terminated manually (e.g., with ^C) + for pid in $(ip netns pids ${source_ns}); do + if [ -e /proc/$pid/cmdline ] && grep -qe 'iperf3' /proc/$pid/cmdline; then + echo "FAIL: unable to terminate some iperf3 instances. Soft lockup is underway. A kernel panic is on the way!" + exit ${ksft_fail} + fi + done + + if [ "$termination_signal" == "SIGINT" ]; then + echo "SKIP: Termination due to ^C (SIGINT)" + elif [ "$termination_signal" == "SIGALRM" ]; then + echo "PASS: No kernel soft lockup occurred during this ${TEST_DURATION} second test" + fi + + cleanup_ns ${source_ns} ${sink_ns} + + sysctl -qw kernel.softlockup_panic=${kernel_softlokup_panic_prev_val} +} + +setup_prepare() { + setup_ns source_ns sink_ns + + ip -n ${source_ns} link add name ${SOURCE_TEST_IFACE} type veth peer name ${SINK_TEST_IFACE} netns ${sink_ns} + + # Setting up the Source namespace + ip -n ${source_ns} addr add ${SOURCE_TEST_IP_ADDR} dev ${SOURCE_TEST_IFACE} + ip -n ${source_ns} link set dev ${SOURCE_TEST_IFACE} qlen 10000 + ip -n ${source_ns} link set dev ${SOURCE_TEST_IFACE} up + ip netns exec ${source_ns} sysctl -qw net.ipv6.fib_multipath_hash_policy=1 + + # Setting up the Sink namespace + ip -n ${sink_ns} addr add ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK} dev ${SINK_LOOPBACK_IFACE} + ip -n ${sink_ns} link set dev ${SINK_LOOPBACK_IFACE} up + ip netns exec ${sink_ns} sysctl -qw net.ipv6.conf.${SINK_LOOPBACK_IFACE}.forwarding=1 + + ip -n ${sink_ns} link set ${SINK_TEST_IFACE} up + ip netns exec ${sink_ns} sysctl -qw net.ipv6.conf.${SINK_TEST_IFACE}.forwarding=1 + + + # Populate nexthop IPv6 addresses on the test interface in the sink_ns + echo "info: populating ${IPV6_NEXTHOP_ADDR_COUNT} IPv6 addresses on the ${SINK_TEST_IFACE} interface ..." + for IP in $(seq 1 ${IPV6_NEXTHOP_ADDR_COUNT}); do + ip -n ${sink_ns} addr add ${IPV6_NEXTHOP_PREFIX}::$(printf "1:%x" "${IP}")/${IPV6_NEXTHOP_ADDR_MASK} dev ${SINK_TEST_IFACE}; + done + + # Preparing list of nexthops + for IP in $(seq 1 ${IPV6_NEXTHOP_ADDR_COUNT}); do + nexthop_ip_list=$nexthop_ip_list" nexthop via ${IPV6_NEXTHOP_PREFIX}::$(printf "1:%x" $IP) dev ${SOURCE_TEST_IFACE} weight 1" + done +} + + +test_soft_lockup_during_routing_table_refresh() { + # Start num_of_iperf_servers iperf3 servers in the sink_ns namespace, + # each listening on ports starting at 5001 and incrementing + # sequentially. Since iperf3 instances may terminate unexpectedly, a + # while loop is used to automatically restart them in such cases. + echo "info: starting ${num_of_iperf_servers} iperf3 servers in the sink_ns namespace ..." + for i in $(seq 1 ${num_of_iperf_servers}); do + cmd="iperf3 --bind ${SINK_LOOPBACK_IP_ADDR} -s -p $(printf '5%03d' ${i}) --rcv-timeout 200 &>/dev/null" + ip netns exec ${sink_ns} bash -c "while true; do ${cmd}; done &" &>/dev/null + done + + # Wait for the iperf3 servers to be ready + for i in $(seq ${num_of_iperf_servers}); do + port=$(printf '5%03d' ${i}); + wait_local_port_listen ${sink_ns} ${port} tcp + done + + # Continuously refresh the routing table in the background within + # the source_ns namespace + ip netns exec ${source_ns} bash -c " + while \$(ip netns list | grep -q ${source_ns}); do + ip -6 route add ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK} ${nexthop_ip_list}; + sleep ${ROUTING_TABLE_REFRESH_PERIOD}; + ip -6 route delete ${SINK_LOOPBACK_IP_ADDR}/${SINK_LOOPBACK_IP_MASK}; + done &" + + # Start num_of_iperf_servers iperf3 clients in the source_ns namespace, + # each sending TCP traffic on sequential ports starting at 5001. + # Since iperf3 instances may terminate unexpectedly (e.g., if the route + # to the server is deleted in the background during a route refresh), a + # while loop is used to automatically restart them in such cases. + echo "info: starting ${num_of_iperf_servers} iperf3 clients in the source_ns namespace ..." + for i in $(seq 1 ${num_of_iperf_servers}); do + cmd="iperf3 -c ${SINK_LOOPBACK_IP_ADDR} -p $(printf '5%03d' ${i}) --length 64 --bitrate ${IPERF3_BITRATE} -t 0 --connect-timeout 150 &>/dev/null" + ip netns exec ${source_ns} bash -c "while true; do ${cmd}; done &" &>/dev/null + done + + echo "info: IPv6 routing table is being updated at the rate of $(echo "1/${ROUTING_TABLE_REFRESH_PERIOD}" | bc)/s for ${TEST_DURATION} seconds ..." + echo "info: A kernel soft lockup, if detected, results in a kernel panic!" + + wait +} + +# Make sure 'iperf3' is installed, skip the test otherwise +if [ ! -x "$(command -v "iperf3")" ]; then + echo "SKIP: 'iperf3' is not installed. Skipping the test." + exit ${ksft_skip} +fi + +# Determine the number of cores on the machine +num_of_iperf_servers=$(( $(nproc)/2 )) + +# Check if we are running on a multi-core machine, skip the test otherwise +if [ "${num_of_iperf_servers}" -eq 0 ]; then + echo "SKIP: This test is not valid on a single core machine!" + exit ${ksft_skip} +fi + +# Since the kernel soft lockup we're testing causes at least one core to enter +# an infinite loop, destabilizing the host and likely affecting subsequent +# tests, we trigger a kernel panic instead of reporting a failure and +# continuing +kernel_softlokup_panic_prev_val=$(sysctl -n kernel.softlockup_panic) +sysctl -qw kernel.softlockup_panic=1 + +handle_sigint() { + termination_signal="SIGINT" + cleanup + exit ${ksft_skip} +} + +handle_sigalrm() { + termination_signal="SIGALRM" + cleanup + exit ${ksft_pass} +} + +trap handle_sigint SIGINT +trap handle_sigalrm SIGALRM + +(sleep ${TEST_DURATION} && kill -s SIGALRM $$)& + +setup_prepare +test_soft_lockup_during_routing_table_refresh -- 2.25.1

2 1

[PATCH OLK-6.6] net/mlx5e: Don't call cleanup on profile rollback failure
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Cosmin Ratiu <cratiu(a)nvidia.com> mainline inclusion from mainline-v6.12-rc4 commit 4dbc1d1a9f39c3711ad2a40addca04d07d9ab5d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SU8 CVE: CVE-2024-50146 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When profile rollback fails in mlx5e_netdev_change_profile, the netdev profile var is left set to NULL. Avoid a crash when unloading the driver by not calling profile->cleanup in such a case. This was encountered while testing, with the original trigger that the wq rescuer thread creation got interrupted (presumably due to Ctrl+C-ing modprobe), which gets converted to ENOMEM (-12) by mlx5e_priv_init, the profile rollback also fails for the same reason (signal still active) so the profile is left as NULL, leading to a crash later in _mlx5e_remove. [ 732.473932] mlx5_core 0000:08:00.1: E-Switch: Unload vfs: mode(OFFLOADS), nvfs(2), necvfs(0), active vports(2) [ 734.525513] workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR [ 734.557372] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12 [ 734.559187] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: new profile init failed, -12 [ 734.560153] workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR [ 734.589378] mlx5_core 0000:08:00.1: mlx5e_netdev_init_profile:6235:(pid 6086): mlx5e_priv_init failed, err=-12 [ 734.591136] mlx5_core 0000:08:00.1 eth3: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 [ 745.537492] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 745.538222] #PF: supervisor read access in kernel mode <snipped> [ 745.551290] Call Trace: [ 745.551590] <TASK> [ 745.551866] ? __die+0x20/0x60 [ 745.552218] ? page_fault_oops+0x150/0x400 [ 745.555307] ? exc_page_fault+0x79/0x240 [ 745.555729] ? asm_exc_page_fault+0x22/0x30 [ 745.556166] ? mlx5e_remove+0x6b/0xb0 [mlx5_core] [ 745.556698] auxiliary_bus_remove+0x18/0x30 [ 745.557134] device_release_driver_internal+0x1df/0x240 [ 745.557654] bus_remove_device+0xd7/0x140 [ 745.558075] device_del+0x15b/0x3c0 [ 745.558456] mlx5_rescan_drivers_locked.part.0+0xb1/0x2f0 [mlx5_core] [ 745.559112] mlx5_unregister_device+0x34/0x50 [mlx5_core] [ 745.559686] mlx5_uninit_one+0x46/0xf0 [mlx5_core] [ 745.560203] remove_one+0x4e/0xd0 [mlx5_core] [ 745.560694] pci_device_remove+0x39/0xa0 [ 745.561112] device_release_driver_internal+0x1df/0x240 [ 745.561631] driver_detach+0x47/0x90 [ 745.562022] bus_remove_driver+0x84/0x100 [ 745.562444] pci_unregister_driver+0x3b/0x90 [ 745.562890] mlx5_cleanup+0xc/0x1b [mlx5_core] [ 745.563415] __x64_sys_delete_module+0x14d/0x2f0 [ 745.563886] ? kmem_cache_free+0x1b0/0x460 [ 745.564313] ? lockdep_hardirqs_on_prepare+0xe2/0x190 [ 745.564825] do_syscall_64+0x6d/0x140 [ 745.565223] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 745.565725] RIP: 0033:0x7f1579b1288b Fixes: 3ef14e463f6e ("net/mlx5e: Separate between netdev objects and mlx5e profiles initialization") Signed-off-by: Cosmin Ratiu <cratiu(a)nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c index bb5c41f0e8ba..dc6c62f20dac 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c @@ -6118,7 +6118,9 @@ static void mlx5e_remove(struct auxiliary_device *adev) mlx5e_dcbnl_delete_app(priv); unregister_netdev(priv->netdev); _mlx5e_suspend(adev, false); - priv->profile->cleanup(priv); + /* Avoid cleanup if profile rollback failed. */ + if (priv->profile) + priv->profile->cleanup(priv); mlx5e_destroy_netdev(priv); mlx5e_devlink_port_unregister(mlx5e_dev); mlx5e_destroy_devlink(mlx5e_dev); -- 2.25.1

2 3

[PATCH OLK-6.6] ethtool: fail closed if we can't get max channel used in indirection tables
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jakub Kicinski <kuba(a)kernel.org> mainline inclusion from mainline-v6.11-rc1 commit 2899d58462ba868287d6ff3acad3675e7adf934f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAUATO CVE: CVE-2024-46834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change. Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Link: https://patch.msgid.link/20240710174043.754664-2-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ethtool/common.c [commit fb6e30a72539 pass a pointer to parameters to ethtool_get_max_rxfh_channel(), which not merged lead to conflict.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ethtool/channels.c | 6 ++---- net/ethtool/common.c | 26 +++++++++++++++----------- net/ethtool/common.h | 2 +- net/ethtool/ioctl.c | 4 +--- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/net/ethtool/channels.c b/net/ethtool/channels.c index 7b4bbd674bae..cee188da54f8 100644 --- a/net/ethtool/channels.c +++ b/net/ethtool/channels.c @@ -171,11 +171,9 @@ ethnl_set_channels(struct ethnl_req_info *req_info, struct genl_info *info) */ if (ethtool_get_max_rxnfc_channel(dev, &max_rxnfc_in_use)) max_rxnfc_in_use = 0; - if (!netif_is_rxfh_configured(dev) || - ethtool_get_max_rxfh_channel(dev, &max_rxfh_in_use)) - max_rxfh_in_use = 0; + max_rxfh_in_use = ethtool_get_max_rxfh_channel(dev); if (channels.combined_count + channels.rx_count <= max_rxfh_in_use) { - GENL_SET_ERR_MSG(info, "requested channel counts are too low for existing indirection table settings"); + GENL_SET_ERR_MSG_FMT(info, "requested channel counts are too low for existing indirection table (%d)", max_rxfh_in_use); return -EINVAL; } if (channels.combined_count + channels.rx_count <= max_rxnfc_in_use) { diff --git a/net/ethtool/common.c b/net/ethtool/common.c index f5598c5f50de..450354315291 100644 --- a/net/ethtool/common.c +++ b/net/ethtool/common.c @@ -587,35 +587,39 @@ int ethtool_get_max_rxnfc_channel(struct net_device *dev, u64 *max) return err; } -int ethtool_get_max_rxfh_channel(struct net_device *dev, u32 *max) +u32 ethtool_get_max_rxfh_channel(struct net_device *dev) { - u32 dev_size, current_max = 0; + u32 dev_size, current_max; u32 *indir; int ret; + if (!netif_is_rxfh_configured(dev)) + return 0; + if (!dev->ethtool_ops->get_rxfh_indir_size || !dev->ethtool_ops->get_rxfh) - return -EOPNOTSUPP; + return 0; dev_size = dev->ethtool_ops->get_rxfh_indir_size(dev); if (dev_size == 0) - return -EOPNOTSUPP; + return 0; indir = kcalloc(dev_size, sizeof(indir[0]), GFP_USER); if (!indir) - return -ENOMEM; + return U32_MAX; ret = dev->ethtool_ops->get_rxfh(dev, indir, NULL, NULL); - if (ret) - goto out; + if (ret) { + current_max = U32_MAX; + goto out_free; + } + current_max = 0; while (dev_size--) current_max = max(current_max, indir[dev_size]); - *max = current_max; - -out: +out_free: kfree(indir); - return ret; + return current_max; } int ethtool_check_ops(const struct ethtool_ops *ops) diff --git a/net/ethtool/common.h b/net/ethtool/common.h index 28b8aaaf9bcb..b55705a9ad5a 100644 --- a/net/ethtool/common.h +++ b/net/ethtool/common.h @@ -42,7 +42,7 @@ int __ethtool_get_link(struct net_device *dev); bool convert_legacy_settings_to_link_ksettings( struct ethtool_link_ksettings *link_ksettings, const struct ethtool_cmd *legacy_settings); -int ethtool_get_max_rxfh_channel(struct net_device *dev, u32 *max); +u32 ethtool_get_max_rxfh_channel(struct net_device *dev); int ethtool_get_max_rxnfc_channel(struct net_device *dev, u64 *max); int __ethtool_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info); diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 4486cbe2faf0..7bf015fad447 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -1847,9 +1847,7 @@ static noinline_for_stack int ethtool_set_channels(struct net_device *dev, * indirection table/rxnfc settings */ if (ethtool_get_max_rxnfc_channel(dev, &max_rxnfc_in_use)) max_rxnfc_in_use = 0; - if (!netif_is_rxfh_configured(dev) || - ethtool_get_max_rxfh_channel(dev, &max_rxfh_in_use)) - max_rxfh_in_use = 0; + max_rxfh_in_use = ethtool_get_max_rxfh_channel(dev); if (channels.combined_count + channels.rx_count <= max_t(u64, max_rxnfc_in_use, max_rxfh_in_use)) return -EINVAL; -- 2.25.1

2 3

[PATCH OLK-6.6 v2 0/2] net: Fix CVE-2024-56658
by Dong Chenchen 15 Feb '25

15 Feb '25

Fix CVE-2024-56658 Dong Chenchen (1): net: Fix kabi breakage in struct net Eric Dumazet (1): net: defer final 'struct net' free in netns dismantle include/net/net_namespace.h | 1 + net/core/net_namespace.c | 20 +++++++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-5.10] ila: serialize calls to nf_register_net_hooks()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.233 commit d3017895e393536b234cf80a83fc463c08a28137 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID33 CVE: CVE-2024-57900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 260466b576bca0081a7d4acecc8e93687aa22d0e ] syzbot found a race in ila_add_mapping() [1] commit 031ae72825ce ("ila: call nf_unregister_net_hooks() sooner") attempted to fix a similar issue. Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands. Add a mutex to make sure at most one thread is calling nf_register_net_hooks(). [1] BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 Read of size 4 at addr ffff888028f40008 by task dhcpcd/5501 CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269 NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 process_backlog+0x443/0x15f0 net/core/dev.c:6117 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0xa94/0x1010 net/core/dev.c:7074 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") Reported-by: syzbot+47e761d22ecf745f72b9(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6772c9ae.050a0220.2f3838.04c7.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Florian Westphal <fw(a)strlen.de> Cc: Tom Herbert <tom(a)herbertland.com> Link: https://patch.msgid.link/20241230162849.2795486-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ila/ila_xlat.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c index 2e7a36a1ea0a..8483116dfa23 100644 --- a/net/ipv6/ila/ila_xlat.c +++ b/net/ipv6/ila/ila_xlat.c @@ -201,6 +201,8 @@ static const struct nf_hook_ops ila_nf_hook_ops[] = { }, }; +static DEFINE_MUTEX(ila_mutex); + static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) { struct ila_net *ilan = net_generic(net, ila_net_id); @@ -208,16 +210,20 @@ static int ila_add_mapping(struct net *net, struct ila_xlat_params *xp) spinlock_t *lock = ila_get_lock(ilan, xp->ip.locator_match); int err = 0, order; - if (!ilan->xlat.hooks_registered) { + if (!READ_ONCE(ilan->xlat.hooks_registered)) { /* We defer registering net hooks in the namespace until the * first mapping is added. */ - err = nf_register_net_hooks(net, ila_nf_hook_ops, - ARRAY_SIZE(ila_nf_hook_ops)); + mutex_lock(&ila_mutex); + if (!ilan->xlat.hooks_registered) { + err = nf_register_net_hooks(net, ila_nf_hook_ops, + ARRAY_SIZE(ila_nf_hook_ops)); + if (!err) + WRITE_ONCE(ilan->xlat.hooks_registered, true); + } + mutex_unlock(&ila_mutex); if (err) return err; - - ilan->xlat.hooks_registered = true; } ila = kzalloc(sizeof(*ila), GFP_KERNEL); -- 2.25.1

2 1

[PATCH OLK-5.10] sched: sch_cake: add bounds checks to host bulk flow fairness counts
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Toke Høiland-Jørgensen <toke(a)redhat.com> mainline inclusion from mainline-v6.13-rc7 commit 737d4d91d35b5f7fa5bb442651472277318b0bfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQOT CVE: CVE-2025-21647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out of bounds memory access. To avoid any such logic errors causing out of bounds memory accesses, this commit factors out all accesses to the per-host bulk flow counters to a series of helpers that perform bounds-checking before any increments and decrements. This also has the benefit of improving readability by moving the conditional checks for the flow mode into these helpers, instead of having them spread out throughout the code (which was the cause of the original logic error). As part of this change, the flow quantum calculation is consolidated into a helper function, which means that the dithering applied to the ost load scaling is now applied both in the DRR rotation and when a sparse flow's quantum is first initiated. The only user-visible effect of this is that the maximum packet size that can be sent while a flow stays sparse will now vary with +/- one byte in some cases. This should not make a noticeable difference in practice, and thus it's not worth complicating the code to preserve the old behaviour. Fixes: 546ea84d07e3 ("sched: sch_cake: fix bulk flow accounting logic for host fairness") Reported-by: syzbot+f63600d288bfb7057424(a)syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Acked-by: Dave Taht <dave.taht(a)gmail.com> Link: https://patch.msgid.link/20250107120105.70685-1-toke@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_cake.c [commit 7e3cf0843fe5 use get_random_{u8,u16}() in cake_dequeue, which not merged lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_cake.c | 140 +++++++++++++++++++++++-------------------- 1 file changed, 75 insertions(+), 65 deletions(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index 4ddb43a6644a..e0030c16143f 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -643,6 +643,63 @@ static bool cake_ddst(int flow_mode) return (flow_mode & CAKE_FLOW_DUAL_DST) == CAKE_FLOW_DUAL_DST; } +static void cake_dec_srchost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_dsrc(flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count)) + q->hosts[flow->srchost].srchost_bulk_flow_count--; +} + +static void cake_inc_srchost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_dsrc(flow_mode) && + q->hosts[flow->srchost].srchost_bulk_flow_count < CAKE_QUEUES)) + q->hosts[flow->srchost].srchost_bulk_flow_count++; +} + +static void cake_dec_dsthost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_ddst(flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count--; +} + +static void cake_inc_dsthost_bulk_flow_count(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + if (likely(cake_ddst(flow_mode) && + q->hosts[flow->dsthost].dsthost_bulk_flow_count < CAKE_QUEUES)) + q->hosts[flow->dsthost].dsthost_bulk_flow_count++; +} + +static u16 cake_get_flow_quantum(struct cake_tin_data *q, + struct cake_flow *flow, + int flow_mode) +{ + u16 host_load = 1; + + if (cake_dsrc(flow_mode)) + host_load = max(host_load, + q->hosts[flow->srchost].srchost_bulk_flow_count); + + if (cake_ddst(flow_mode)) + host_load = max(host_load, + q->hosts[flow->dsthost].dsthost_bulk_flow_count); + + /* The get_random_u16() is a way to apply dithering to avoid + * accumulating roundoff errors + */ + return (q->flow_quantum * quantum_div[host_load] + + (prandom_u32() >> 16)) >> 16; +} + static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, int flow_mode, u16 flow_override, u16 host_override) { @@ -789,10 +846,8 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, allocate_dst = cake_ddst(flow_mode); if (q->flows[outer_hash + k].set == CAKE_SET_BULK) { - if (allocate_src) - q->hosts[q->flows[reduced_hash].srchost].srchost_bulk_flow_count--; - if (allocate_dst) - q->hosts[q->flows[reduced_hash].dsthost].dsthost_bulk_flow_count--; + cake_dec_srchost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); + cake_dec_dsthost_bulk_flow_count(q, &q->flows[outer_hash + k], flow_mode); } found: /* reserve queue for future packets in same flow */ @@ -817,9 +872,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].srchost_tag = srchost_hash; found_src: srchost_idx = outer_hash + k; - if (q->flows[reduced_hash].set == CAKE_SET_BULK) - q->hosts[srchost_idx].srchost_bulk_flow_count++; q->flows[reduced_hash].srchost = srchost_idx; + + if (q->flows[reduced_hash].set == CAKE_SET_BULK) + cake_inc_srchost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); } if (allocate_dst) { @@ -840,9 +896,10 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, q->hosts[outer_hash + k].dsthost_tag = dsthost_hash; found_dst: dsthost_idx = outer_hash + k; - if (q->flows[reduced_hash].set == CAKE_SET_BULK) - q->hosts[dsthost_idx].dsthost_bulk_flow_count++; q->flows[reduced_hash].dsthost = dsthost_idx; + + if (q->flows[reduced_hash].set == CAKE_SET_BULK) + cake_inc_dsthost_bulk_flow_count(q, &q->flows[reduced_hash], flow_mode); } } @@ -1855,10 +1912,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, /* flowchain */ if (!flow->set || flow->set == CAKE_SET_DECAYING) { - struct cake_host *srchost = &b->hosts[flow->srchost]; - struct cake_host *dsthost = &b->hosts[flow->dsthost]; - u16 host_load = 1; - if (!flow->set) { list_add_tail(&flow->flowchain, &b->new_flows); } else { @@ -1868,18 +1921,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, flow->set = CAKE_SET_SPARSE; b->sparse_flow_count++; - if (cake_dsrc(q->flow_mode)) - host_load = max(host_load, srchost->srchost_bulk_flow_count); - - if (cake_ddst(q->flow_mode)) - host_load = max(host_load, dsthost->dsthost_bulk_flow_count); - - flow->deficit = (b->flow_quantum * - quantum_div[host_load]) >> 16; + flow->deficit = cake_get_flow_quantum(b, flow, q->flow_mode); } else if (flow->set == CAKE_SET_SPARSE_WAIT) { - struct cake_host *srchost = &b->hosts[flow->srchost]; - struct cake_host *dsthost = &b->hosts[flow->dsthost]; - /* this flow was empty, accounted as a sparse flow, but actually * in the bulk rotation. */ @@ -1887,12 +1930,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, b->sparse_flow_count--; b->bulk_flow_count++; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count++; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; - + cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); } if (q->buffer_used > q->buffer_max_used) @@ -1949,13 +1988,11 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) { struct cake_sched_data *q = qdisc_priv(sch); struct cake_tin_data *b = &q->tins[q->cur_tin]; - struct cake_host *srchost, *dsthost; ktime_t now = ktime_get(); struct cake_flow *flow; struct list_head *head; bool first_flow = true; struct sk_buff *skb; - u16 host_load; u64 delay; u32 len; @@ -2055,11 +2092,6 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) q->cur_flow = flow - b->flows; first_flow = false; - /* triple isolation (modified DRR++) */ - srchost = &b->hosts[flow->srchost]; - dsthost = &b->hosts[flow->dsthost]; - host_load = 1; - /* flow isolation (DRR++) */ if (flow->deficit <= 0) { /* Keep all flows with deficits out of the sparse and decaying @@ -2071,11 +2103,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) b->sparse_flow_count--; b->bulk_flow_count++; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count++; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count++; + cake_inc_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_inc_dsthost_bulk_flow_count(b, flow, q->flow_mode); flow->set = CAKE_SET_BULK; } else { @@ -2087,19 +2116,7 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) } } - if (cake_dsrc(q->flow_mode)) - host_load = max(host_load, srchost->srchost_bulk_flow_count); - - if (cake_ddst(q->flow_mode)) - host_load = max(host_load, dsthost->dsthost_bulk_flow_count); - - WARN_ON(host_load > CAKE_QUEUES); - - /* The shifted prandom_u32() is a way to apply dithering to - * avoid accumulating roundoff errors - */ - flow->deficit += (b->flow_quantum * quantum_div[host_load] + - (prandom_u32() >> 16)) >> 16; + flow->deficit += cake_get_flow_quantum(b, flow, q->flow_mode); list_move_tail(&flow->flowchain, &b->old_flows); goto retry; @@ -2123,11 +2140,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) if (flow->set == CAKE_SET_BULK) { b->bulk_flow_count--; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count--; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; + cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); b->decaying_flow_count++; } else if (flow->set == CAKE_SET_SPARSE || @@ -2145,12 +2159,8 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) else if (flow->set == CAKE_SET_BULK) { b->bulk_flow_count--; - if (cake_dsrc(q->flow_mode)) - srchost->srchost_bulk_flow_count--; - - if (cake_ddst(q->flow_mode)) - dsthost->dsthost_bulk_flow_count--; - + cake_dec_srchost_bulk_flow_count(b, flow, q->flow_mode); + cake_dec_dsthost_bulk_flow_count(b, flow, q->flow_mode); } else b->decaying_flow_count--; -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: conntrack: clamp maximum hashtable size to INT_MAX
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.13-rc7 commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQN CVE: CVE-2025-21648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns. Fixes: 9cc1c73ad666 ("netfilter: conntrack: avoid integer overflow when resizing") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_conntrack_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index f2634cda262c..9090d677ddfa 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -2435,12 +2435,15 @@ void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) struct hlist_nulls_head *hash; unsigned int nr_slots, i; - if (*sizep > (UINT_MAX / sizeof(struct hlist_nulls_head))) + if (*sizep > (INT_MAX / sizeof(struct hlist_nulls_head))) return NULL; BUILD_BUG_ON(sizeof(struct hlist_nulls_head) != sizeof(struct hlist_head)); nr_slots = *sizep = roundup(*sizep, PAGE_SIZE / sizeof(struct hlist_nulls_head)); + if (nr_slots > (INT_MAX / sizeof(struct hlist_nulls_head))) + return NULL; + hash = kvcalloc(nr_slots, sizeof(struct hlist_nulls_head), GFP_KERNEL); if (hash && nulls) -- 2.25.1

2 1

[PATCH OLK-5.10] net: inet6: do not leave a dangling sk pointer in inet6_create()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit 35360255ca30776dee34d9fa764cffa24d0a5f65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPG CVE: CVE-2024-56600 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9df99c395d0f55fb444ef39f4d6f194ca437d884 ] sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear the sock sk pointer on error. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-8-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/af_inet6.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index 3bd7e3a04229..bf23dbbf7536 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -259,31 +259,29 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol, */ inet->inet_sport = htons(inet->inet_num); err = sk->sk_prot->hash(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (sk->sk_prot->init) { err = sk->sk_prot->init(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (!kern) { err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } out: return err; out_rcu_unlock: rcu_read_unlock(); goto out; +out_sk_release: + sk_common_release(sk); + sock->sk = NULL; + goto out; } static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len, -- 2.25.1

2 1

[PATCH OLK-5.10] net: inet: do not leave a dangling sk pointer in inet_create()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit 2bc34d8c8898ae9fddf4612501aabb22d76c2b2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAPL CVE: CVE-2024-56601 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff ] sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-7-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/af_inet.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index f8aba75192a7..c6ec22f314c4 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -373,32 +373,30 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, inet->inet_sport = htons(inet->inet_num); /* Add to protocol hash chains. */ err = sk->sk_prot->hash(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (sk->sk_prot->init) { err = sk->sk_prot->init(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } if (!kern) { err = BPF_CGROUP_RUN_PROG_INET_SOCK(sk); - if (err) { - sk_common_release(sk); - goto out; - } + if (err) + goto out_sk_release; } out: return err; out_rcu_unlock: rcu_read_unlock(); goto out; +out_sk_release: + sk_common_release(sk); + sock->sk = NULL; + goto out; } -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: x_tables: fix LED ID check in led_tg_check()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Dmitry Antipov <dmantipov(a)yandex.ru> stable inclusion from stable-v5.10.231 commit ad28612ebae1fcc1104bd432e99e99d87f6bfe09 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAO6 CVE: CVE-2024-56650 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7 ] Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 print_report+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_report+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? netlink_deliver_tap+0x2e/0x1b0 netlink_unicast+0x7f8/0x990 ? __pfx_netlink_unicast+0x10/0x10 ? __virt_addr_valid+0x183/0x530 ? __check_object_size+0x48e/0x900 netlink_sendmsg+0x8e4/0xcb0 ? __pfx_netlink_sendmsg+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? __pfx_____sys_sendmsg+0x10/0x10 __sys_sendmsg+0x292/0x380 ? __pfx___sys_sendmsg+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? exc_page_fault+0x590/0x8c0 ? do_syscall_64+0xb6/0x230 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> Since an invalid (without '\0' byte at all) byte sequence may be passed from userspace, add an extra check to ensure that such a sequence is rejected as possible ID and so never passed to 'kstrdup()' and further. Reported-by: syzbot+6c8215822f35fdb35667(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c8215822f35fdb35667 Fixes: 268cb38e1802 ("netfilter: x_tables: add LED trigger target") Signed-off-by: Dmitry Antipov <dmantipov(a)yandex.ru> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/xt_LED.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c index 0371c387b0d1..13a2b5820b34 100644 --- a/net/netfilter/xt_LED.c +++ b/net/netfilter/xt_LED.c @@ -97,7 +97,9 @@ static int led_tg_check(const struct xt_tgchk_param *par) struct xt_led_info_internal *ledinternal; int err; - if (ledinfo->id[0] == '\0') + /* Bail out if empty string or not a string at all. */ + if (ledinfo->id[0] == '\0' || + !memchr(ledinfo->id, '\0', sizeof(ledinfo->id))) return -EINVAL; mutex_lock(&xt_led_mutex); -- 2.25.1

2 3

[PATCH OLK-5.10] wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jeongjun Park <aha310510(a)gmail.com> stable inclusion from stable-v5.10.231 commit c941af142200d975dd3be632aeb490f4cb91dae4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGJ CVE: CVE-2024-53156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8619593634cbdf5abf43f5714df49b04e4ef09ab ] I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ... Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240909103855.68006-1-aha310510@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index 99667aba289d..00dc97ac53b9 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -294,6 +294,9 @@ int htc_connect_service(struct htc_target *target, return -ETIMEDOUT; } + if (target->conn_rsp_epid < 0 || target->conn_rsp_epid >= ENDPOINT_MAX) + return -EINVAL; + *conn_rsp_epid = target->conn_rsp_epid; return 0; err: -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: ipset: add missing range check in bitmap_ip_uadt
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.13-rc1 commit 35f56c554eb1b56b77b3cf197a6b00922d49033d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB9NOX CVE: CVE-2024-53141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks. Cc: <stable(a)vger.kernel.org> Reported-by: syzbot+58c872f7790a4d2ac951(a)syzkaller.appspotmail.com Fixes: 72205fc68bd1 ("netfilter: ipset: bitmap:ip set type support") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Acked-by: Jozsef Kadlecsik <kadlec(a)blackhole.kfki.hu> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_bitmap_ip.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c index e4fa00abde6a..5988b9bb9029 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ip.c +++ b/net/netfilter/ipset/ip_set_bitmap_ip.c @@ -163,11 +163,8 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[], ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to); if (ret) return ret; - if (ip > ip_to) { + if (ip > ip_to) swap(ip, ip_to); - if (ip < map->first_ip) - return -IPSET_ERR_BITMAP_RANGE; - } } else if (tb[IPSET_ATTR_CIDR]) { u8 cidr = nla_get_u8(tb[IPSET_ATTR_CIDR]); @@ -178,7 +175,7 @@ bitmap_ip_uadt(struct ip_set *set, struct nlattr *tb[], ip_to = ip; } - if (ip_to > map->last_ip) + if (ip < map->first_ip || ip_to > map->last_ip) return -IPSET_ERR_BITMAP_RANGE; for (; !before(ip_to, ip); ip += map->hosts) { -- 2.25.1

2 5

[PATCH OLK-5.10] net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Pedro Tammela <pctammela(a)mojatatu.com> stable inclusion from stable-v5.10.229 commit ce691c814bc7a3c30c220ffb5b7422715458fd9b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KR7 CVE: CVE-2024-53057 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e95c4384438adeaa772caa560244b1a2efef816 ] In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. Fixes: 066a3b5b2346 ("[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Suggested-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Tested-by: Victor Nogueira <victor(a)mojatatu.com> Signed-off-by: Pedro Tammela <pctammela(a)mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20241024165547.418570-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index efd109652f22..0b809dfb0e43 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -781,7 +781,7 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, int n, int len) drops = max_t(int, n, 0); rcu_read_lock(); while ((parentid = sch->parent)) { - if (TC_H_MAJ(parentid) == TC_H_MAJ(TC_H_INGRESS)) + if (parentid == TC_H_ROOT) break; if (sch->flags & TCQ_F_NOPARENT) -- 2.25.1

2 5

[PATCH OLK-5.10 0/2] net: Fix CVE-2024-50125
by Dong Chenchen 15 Feb '25

15 Feb '25

Fix CVE-2024-50125 Desmond Cheong Zhi Xi (1): Bluetooth: call sock_hold earlier in sco_conn_del Luiz Augusto von Dentz (1): Bluetooth: SCO: Fix UAF on sco_sock_timeout include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 22 ++++++++++++++++++++++ net/bluetooth/sco.c | 17 ++++++++++++----- 3 files changed, 35 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] ila: call nf_unregister_net_hooks() sooner
by Dong Chenchen 15 Feb '25

15 Feb '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.226 commit 93ee345ba349922834e6a9d1dadabaedcc12dce6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWHA CVE: CVE-2024-46782 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 031ae72825cef43e4650140b800ad58bf7a6a466 upstream. syzbot found an use-after-free Read in ila_nf_input [1] Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hooks(). It should be done in the reverse way, with a synchronize_rcu(). This is a good match for a pre_exit() method. [1] BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16 CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup include/linux/rhashtable.h:604 [inline] rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775 process_backlog+0x662/0x15b0 net/core/dev.c:6108 __napi_poll+0xcb/0x490 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:6963 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xbfffffff(buddy) raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000 raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493 prep_new_page mm/page_alloc.c:1501 [inline] get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] ___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103 __kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130 __do_kmalloc_node mm/slub.c:4146 [inline] __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164 __kvmalloc_node_noprof+0x72/0x190 mm/util.c:650 bucket_table_alloc lib/rhashtable.c:186 [inline] rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071 ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613 ops_init+0x359/0x610 net/core/net_namespace.c:139 setup_net+0x515/0xca0 net/core/net_namespace.c:343 copy_net_ns+0x4e2/0x7b0 net/core/net_namespace.c:508 create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228 ksys_unshare+0x619/0xc10 kernel/fork.c:3328 __do_sys_unshare kernel/fork.c:3399 [inline] __se_sys_unshare kernel/fork.c:3397 [inline] __x64_sys_unshare+0x38/0x40 kernel/fork.c:3397 page last free pid 11846 tgid 11846 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1094 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2612 __folio_put+0x2c8/0x440 mm/swap.c:128 folio_put include/linux/mm.h:1486 [inline] free_large_kmalloc+0x105/0x1c0 mm/slub.c:4565 kfree+0x1c4/0x360 mm/slub.c:4588 rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169 ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff88806461ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88806461ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888064620000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888064620080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888064620100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Tom Herbert <tom(a)herbertland.com> Reviewed-by: Florian Westphal <fw(a)strlen.de> Link: https://patch.msgid.link/20240904144418.1162839-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ila/ila.h | 1 + net/ipv6/ila/ila_main.c | 6 ++++++ net/ipv6/ila/ila_xlat.c | 13 +++++++++---- 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/net/ipv6/ila/ila.h b/net/ipv6/ila/ila.h index ad5f6f6ba333..85b92917849b 100644 --- a/net/ipv6/ila/ila.h +++ b/net/ipv6/ila/ila.h @@ -108,6 +108,7 @@ int ila_lwt_init(void); void ila_lwt_fini(void); int ila_xlat_init_net(struct net *net); +void ila_xlat_pre_exit_net(struct net *net); void ila_xlat_exit_net(struct net *net); int ila_xlat_nl_cmd_add_mapping(struct sk_buff *skb, struct genl_info *info); diff --git a/net/ipv6/ila/ila_main.c b/net/ipv6/ila/ila_main.c index 36c58aa257e8..a5b0365c5e48 100644 --- a/net/ipv6/ila/ila_main.c +++ b/net/ipv6/ila/ila_main.c @@ -71,6 +71,11 @@ static __net_init int ila_init_net(struct net *net) return err; } +static __net_exit void ila_pre_exit_net(struct net *net) +{ + ila_xlat_pre_exit_net(net); +} + static __net_exit void ila_exit_net(struct net *net) { ila_xlat_exit_net(net); @@ -78,6 +83,7 @@ static __net_exit void ila_exit_net(struct net *net) static struct pernet_operations ila_net_ops = { .init = ila_init_net, + .pre_exit = ila_pre_exit_net, .exit = ila_exit_net, .id = &ila_net_id, .size = sizeof(struct ila_net), diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c index bee45dfeb187..2e7a36a1ea0a 100644 --- a/net/ipv6/ila/ila_xlat.c +++ b/net/ipv6/ila/ila_xlat.c @@ -620,6 +620,15 @@ int ila_xlat_init_net(struct net *net) return 0; } +void ila_xlat_pre_exit_net(struct net *net) +{ + struct ila_net *ilan = net_generic(net, ila_net_id); + + if (ilan->xlat.hooks_registered) + nf_unregister_net_hooks(net, ila_nf_hook_ops, + ARRAY_SIZE(ila_nf_hook_ops)); +} + void ila_xlat_exit_net(struct net *net) { struct ila_net *ilan = net_generic(net, ila_net_id); @@ -627,10 +636,6 @@ void ila_xlat_exit_net(struct net *net) rhashtable_free_and_destroy(&ilan->xlat.rhash_table, ila_free_cb, NULL); free_bucket_spinlocks(ilan->xlat.locks); - - if (ilan->xlat.hooks_registered) - nf_unregister_net_hooks(net, ila_nf_hook_ops, - ARRAY_SIZE(ila_nf_hook_ops)); } static int ila_xlat_addr(struct sk_buff *skb, bool sir2ila) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 15 Feb '25

15 Feb '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6a6cc2b6b95dc80ae01221670e21a8059229a023 commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250215/202502152003.YgfLX405-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502152003.YgfLX405-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1926/1926] mm/memcontrol.c:3147:6: warning: no previous prototype for function 'hisi_oom_recover'
by kernel test robot 15 Feb '25

15 Feb '25

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 56197cf035ddc0d25f6d27169455448133fd75dd commit: b498d9f1bacd40d583c0970cab02ad522127a7e7 [1926/1926] arm64/ascend: Add new enable_oom_killer interface for oom contrl config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250215/202502151053.A5sFfyJm-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250215/202502151053.A5sFfyJm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502151053.A5sFfyJm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memcontrol.c:3147:6: warning: no previous prototype for function 'hisi_oom_recover' [-Wmissing-prototypes] 3147 | void hisi_oom_recover(struct obj_cgroup *objcg) | ^ mm/memcontrol.c:3147:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3147 | void hisi_oom_recover(struct obj_cgroup *objcg) | ^ | static 1 warning generated. vim +/hisi_oom_recover +3147 mm/memcontrol.c 3145 3146 #ifdef CONFIG_ASCEND_OOM > 3147 void hisi_oom_recover(struct obj_cgroup *objcg) 3148 { 3149 struct mem_cgroup *memcg; 3150 3151 memcg = get_mem_cgroup_from_objcg(objcg); 3152 if (!mem_cgroup_is_root(memcg)) 3153 memcg_oom_recover(memcg); 3154 css_put(&memcg->css); 3155 } 3156 #else 3157 static inline void hisi_oom_recover(struct obj_cgroup *objcg) { } 3158 #endif 3159 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1926/1926] mm/share_pool.c:1468:7: warning: variable 'is_hugepage' set but not used
by kernel test robot 15 Feb '25

15 Feb '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 56197cf035ddc0d25f6d27169455448133fd75dd commit: eaafc4a2a3fd023a99c44286895074dd5712706f [1926/1926] mm/sharepool: Implement mg_sp_unshare_kva config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250215/202502150929.DA6B0wcU-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250215/202502150929.DA6B0wcU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502150929.DA6B0wcU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/share_pool.c:1468:7: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 1468 | bool is_hugepage = true; | ^ mm/share_pool.c:73:12: warning: unused variable 'system_group_count' [-Wunused-variable] 73 | static int system_group_count; | ^~~~~~~~~~~~~~~~~~ mm/share_pool.c:76:19: warning: unused variable 'sp_group_idr' [-Wunused-variable] 76 | static DEFINE_IDR(sp_group_idr); | ^~~~~~~~~~~~ include/linux/idr.h:56:37: note: expanded from macro 'DEFINE_IDR' 56 | #define DEFINE_IDR(name) struct idr name = IDR_INIT(name) | ^~~~ mm/share_pool.c:223:20: warning: unused function 'sp_add_group_master' [-Wunused-function] 223 | static inline void sp_add_group_master(struct sp_group_master *master) | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:230:20: warning: unused function 'sp_del_group_master' [-Wunused-function] 230 | static inline void sp_del_group_master(struct sp_group_master *master) | ^~~~~~~~~~~~~~~~~~~ mm/share_pool.c:237:13: warning: unused function 'meminfo_init' [-Wunused-function] 237 | static void meminfo_init(struct sp_meminfo *meminfo) | ^~~~~~~~~~~~ mm/share_pool.c:274:20: warning: unused function 'meminfo_alloc_sum_byKB' [-Wunused-function] 274 | static inline long meminfo_alloc_sum_byKB(struct sp_meminfo *meminfo) | ^~~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c:279:20: warning: unused function 'meminfo_k2u_size' [-Wunused-function] 279 | static inline long meminfo_k2u_size(struct sp_meminfo *meminfo) | ^~~~~~~~~~~~~~~~ mm/share_pool.c:284:25: warning: unused function 'meminfo_total_size' [-Wunused-function] 284 | static inline long long meminfo_total_size(struct sp_meminfo *meminfo) | ^~~~~~~~~~~~~~~~~~ mm/share_pool.c:380:13: warning: unused function 'sp_mapping_detach' [-Wunused-function] 380 | static void sp_mapping_detach(struct sp_group *spg, struct sp_mapping *spm) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:438:12: warning: unused function 'sp_group_setup_mapping_normal' [-Wunused-function] 438 | static int sp_group_setup_mapping_normal(struct mm_struct *mm, struct sp_group *spg) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c:485:13: warning: unused function 'update_mem_usage_alloc' [-Wunused-function] 485 | static void update_mem_usage_alloc(unsigned long size, bool inc, | ^~~~~~~~~~~~~~~~~~~~~~ mm/share_pool.c:497:13: warning: unused function 'update_mem_usage_k2u' [-Wunused-function] 497 | static void update_mem_usage_k2u(unsigned long size, bool inc, | ^~~~~~~~~~~~~~~~~~~~ mm/share_pool.c:582:22: warning: unused function 'spa_size' [-Wunused-function] 582 | static unsigned long spa_size(struct sp_area *spa) | ^~~~~~~~ mm/share_pool.c:587:21: warning: unused function 'spa_file' [-Wunused-function] 587 | static struct file *spa_file(struct sp_area *spa) | ^~~~~~~~ mm/share_pool.c:791:24: warning: unused function 'sp_area_alloc' [-Wunused-function] 791 | static struct sp_area *sp_area_alloc(unsigned long size, unsigned long flags, | ^~~~~~~~~~~~~ mm/share_pool.c:944:24: warning: unused function 'sp_area_get' [-Wunused-function] 944 | static struct sp_area *sp_area_get(struct sp_group *spg, | ^~~~~~~~~~~ mm/share_pool.c:1005:13: warning: unused function 'sp_area_put_locked' [-Wunused-function] 1005 | static void sp_area_put_locked(struct sp_area *spa) | ^~~~~~~~~~~~~~~~~~ 18 warnings generated. vim +/is_hugepage +1468 mm/share_pool.c 1460 1461 /* No possible concurrent protection, take care when use */ 1462 static int sp_unshare_kva(unsigned long kva, unsigned long size) 1463 { 1464 unsigned long addr, kva_aligned; 1465 struct page *page; 1466 unsigned long size_aligned; 1467 unsigned long step; > 1468 bool is_hugepage = true; 1469 int ret; 1470 1471 ret = is_vmap_hugepage(kva); 1472 if (ret > 0) { 1473 kva_aligned = ALIGN_DOWN(kva, PMD_SIZE); 1474 size_aligned = ALIGN(kva + size, PMD_SIZE) - kva_aligned; 1475 step = PMD_SIZE; 1476 } else if (ret == 0) { 1477 kva_aligned = ALIGN_DOWN(kva, PAGE_SIZE); 1478 size_aligned = ALIGN(kva + size, PAGE_SIZE) - kva_aligned; 1479 step = PAGE_SIZE; 1480 is_hugepage = false; 1481 } else { 1482 pr_err_ratelimited("check vmap hugepage failed %d\n", ret); 1483 return -EINVAL; 1484 } 1485 1486 if (kva_aligned + size_aligned < kva_aligned) { 1487 pr_err_ratelimited("overflow happened in unshare kva\n"); 1488 return -EINVAL; 1489 } 1490 1491 for (addr = kva_aligned; addr < (kva_aligned + size_aligned); addr += step) { 1492 page = vmalloc_to_page((void *)addr); 1493 if (page) 1494 put_page(page); 1495 else 1496 WARN(1, "vmalloc %pK to page/hugepage failed\n", 1497 (void *)addr); 1498 } 1499 1500 vunmap((void *)kva_aligned); 1501 1502 return 0; 1503 } 1504 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
by Jinjiang Tu 15 Feb '25

15 Feb '25

From: Adrian Huang <ahuang12(a)lenovo.com> mainline inclusion from mainline-v6.13-rc1 commit 9e9e085effe9b7e342138fde3cf8577d22509932 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMT CVE: CVE-2024-56559 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- When compiling kernel source 'make -j $(nproc)' with the up-and-running KASAN-enabled kernel on a 256-core machine, the following soft lockup is shown: watchdog: BUG: soft lockup - CPU#28 stuck for 22s! [kworker/28:1:1760] CPU: 28 PID: 1760 Comm: kworker/28:1 Kdump: loaded Not tainted 6.10.0-rc5 #95 Workqueue: events drain_vmap_area_work RIP: 0010:smp_call_function_many_cond+0x1d8/0xbb0 Code: 38 c8 7c 08 84 c9 0f 85 49 08 00 00 8b 45 08 a8 01 74 2e 48 89 f1 49 89 f7 48 c1 e9 03 41 83 e7 07 4c 01 e9 41 83 c7 03 f3 90 <0f> b6 01 41 38 c7 7c 08 84 c0 0f 85 d4 06 00 00 8b 45 08 a8 01 75 RSP: 0018:ffffc9000cb3fb60 EFLAGS: 00000202 RAX: 0000000000000011 RBX: ffff8883bc4469c0 RCX: ffffed10776e9949 RDX: 0000000000000002 RSI: ffff8883bb74ca48 RDI: ffffffff8434dc50 RBP: ffff8883bb74ca40 R08: ffff888103585dc0 R09: ffff8884533a1800 R10: 0000000000000004 R11: ffffffffffffffff R12: ffffed1077888d39 R13: dffffc0000000000 R14: ffffed1077888d38 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8883bc400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005577b5c8d158 CR3: 0000000004850000 CR4: 0000000000350ef0 Call Trace: <IRQ> ? watchdog_timer_fn+0x2cd/0x390 ? __pfx_watchdog_timer_fn+0x10/0x10 ? __hrtimer_run_queues+0x300/0x6d0 ? sched_clock_cpu+0x69/0x4e0 ? __pfx___hrtimer_run_queues+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? ktime_get_update_offsets_now+0x7f/0x2a0 ? srso_return_thunk+0x5/0x5f ? srso_return_thunk+0x5/0x5f ? hrtimer_interrupt+0x2ca/0x760 ? __sysvec_apic_timer_interrupt+0x8c/0x2b0 ? sysvec_apic_timer_interrupt+0x6a/0x90 </IRQ> <TASK> ? asm_sysvec_apic_timer_interrupt+0x16/0x20 ? smp_call_function_many_cond+0x1d8/0xbb0 ? __pfx_do_kernel_range_flush+0x10/0x10 on_each_cpu_cond_mask+0x20/0x40 flush_tlb_kernel_range+0x19b/0x250 ? srso_return_thunk+0x5/0x5f ? kasan_release_vmalloc+0xa7/0xc0 purge_vmap_node+0x357/0x820 ? __pfx_purge_vmap_node+0x10/0x10 __purge_vmap_area_lazy+0x5b8/0xa10 drain_vmap_area_work+0x21/0x30 process_one_work+0x661/0x10b0 worker_thread+0x844/0x10e0 ? srso_return_thunk+0x5/0x5f ? __kthread_parkme+0x82/0x140 ? __pfx_worker_thread+0x10/0x10 kthread+0x2a5/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Debugging Analysis: 1. The following ftrace log shows that the lockup CPU spends too much time iterating vmap_nodes and flushing TLB when purging vm_area structures. (Some info is trimmed). kworker: funcgraph_entry: | drain_vmap_area_work() { kworker: funcgraph_entry: | mutex_lock() { kworker: funcgraph_entry: 1.092 us | __cond_resched(); kworker: funcgraph_exit: 3.306 us | } ... ... kworker: funcgraph_entry: | flush_tlb_kernel_range() { ... ... kworker: funcgraph_exit: # 7533.649 us | } ... ... kworker: funcgraph_entry: 2.344 us | mutex_unlock(); kworker: funcgraph_exit: $ 23871554 us | } The drain_vmap_area_work() spends over 23 seconds. There are 2805 flush_tlb_kernel_range() calls in the ftrace log. * One is called in __purge_vmap_area_lazy(). * Others are called by purge_vmap_node->kasan_release_vmalloc. purge_vmap_node() iteratively releases kasan vmalloc allocations and flushes TLB for each vmap_area. - [Rough calculation] Each flush_tlb_kernel_range() runs about 7.5ms. -- 2804 * 7.5ms = 21.03 seconds. -- That's why a soft lock is triggered. 2. Extending the soft lockup time can work around the issue (For example, # echo 60 > /proc/sys/kernel/watchdog_thresh). This confirms the above-mentioned speculation: drain_vmap_area_work() spends too much time. If we combine all TLB flush operations of the KASAN shadow virtual address into one operation in the call path 'purge_vmap_node()->kasan_release_vmalloc()', the running time of drain_vmap_area_work() can be saved greatly. The idea is from the flush_tlb_kernel_range() call in __purge_vmap_area_lazy(). And, the soft lockup won't be triggered. Here is the test result based on 6.10: [6.10 wo/ the patch] 1. ftrace latency profiling (record a trace if the latency > 20s). echo 20000000 > /sys/kernel/debug/tracing/tracing_thresh echo drain_vmap_area_work > /sys/kernel/debug/tracing/set_graph_function echo function_graph > /sys/kernel/debug/tracing/current_tracer echo 1 > /sys/kernel/debug/tracing/tracing_on 2. Run `make -j $(nproc)` to compile the kernel source 3. Once the soft lockup is reproduced, check the ftrace log: cat /sys/kernel/debug/tracing/trace # tracer: function_graph # # CPU DURATION FUNCTION CALLS # | | | | | | | 76) $ 50412985 us | } /* __purge_vmap_area_lazy */ 76) $ 50412997 us | } /* drain_vmap_area_work */ 76) $ 29165911 us | } /* __purge_vmap_area_lazy */ 76) $ 29165926 us | } /* drain_vmap_area_work */ 91) $ 53629423 us | } /* __purge_vmap_area_lazy */ 91) $ 53629434 us | } /* drain_vmap_area_work */ 91) $ 28121014 us | } /* __purge_vmap_area_lazy */ 91) $ 28121026 us | } /* drain_vmap_area_work */ [6.10 w/ the patch] 1. Repeat step 1-2 in "[6.10 wo/ the patch]" 2. The soft lockup is not triggered and ftrace log is empty. cat /sys/kernel/debug/tracing/trace # tracer: function_graph # # CPU DURATION FUNCTION CALLS # | | | | | | | 3. Setting 'tracing_thresh' to 10/5 seconds does not get any ftrace log. 4. Setting 'tracing_thresh' to 1 second gets ftrace log. cat /sys/kernel/debug/tracing/trace # tracer: function_graph # # CPU DURATION FUNCTION CALLS # | | | | | | | 23) $ 1074942 us | } /* __purge_vmap_area_lazy */ 23) $ 1074950 us | } /* drain_vmap_area_work */ The worst execution time of drain_vmap_area_work() is about 1 second. Link: https://lore.kernel.org/lkml/ZqFlawuVnOMY2k3E@pc638.lan/ Link: https://lkml.kernel.org/r/20240726165246.31326-1-ahuang12@lenovo.com Fixes: 282631cb2447 ("mm: vmalloc: remove global purge_vmap_area_root rb-tree") Signed-off-by: Adrian Huang <ahuang12(a)lenovo.com> Co-developed-by: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Signed-off-by: Uladzislau Rezki (Sony) <urezki(a)gmail.com> Tested-by: Jiwei Sun <sunjw10(a)lenovo.com> Reviewed-by: Baoquan He <bhe(a)redhat.com> Cc: Alexander Potapenko <glider(a)google.com> Cc: Andrey Konovalov <andreyknvl(a)gmail.com> Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> Cc: Christoph Hellwig <hch(a)infradead.org> Cc: Dmitry Vyukov <dvyukov(a)google.com> Cc: Vincenzo Frascino <vincenzo.frascino(a)arm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/vmalloc.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/kasan.h | 12 +++++++++--- mm/kasan/shadow.c | 14 ++++++++++---- mm/vmalloc.c | 34 ++++++++++++++++++++++++++-------- 3 files changed, 45 insertions(+), 15 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 71fa9a40fb5a..388397042c5d 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -28,6 +28,9 @@ typedef unsigned int __bitwise kasan_vmalloc_flags_t; #define KASAN_VMALLOC_VM_ALLOC ((__force kasan_vmalloc_flags_t)0x02u) #define KASAN_VMALLOC_PROT_NORMAL ((__force kasan_vmalloc_flags_t)0x04u) +#define KASAN_VMALLOC_PAGE_RANGE 0x1 /* Apply exsiting page range */ +#define KASAN_VMALLOC_TLB_FLUSH 0x2 /* TLB flush */ + #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) #include <linux/pgtable.h> @@ -385,7 +388,8 @@ void kasan_populate_early_vm_area_shadow(void *start, unsigned long size); int kasan_populate_vmalloc(unsigned long addr, unsigned long size); void kasan_release_vmalloc(unsigned long start, unsigned long end, unsigned long free_region_start, - unsigned long free_region_end); + unsigned long free_region_end, + unsigned long flags); #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ @@ -400,7 +404,8 @@ static inline int kasan_populate_vmalloc(unsigned long start, static inline void kasan_release_vmalloc(unsigned long start, unsigned long end, unsigned long free_region_start, - unsigned long free_region_end) { } + unsigned long free_region_end, + unsigned long flags) { } #endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ @@ -435,7 +440,8 @@ static inline int kasan_populate_vmalloc(unsigned long start, static inline void kasan_release_vmalloc(unsigned long start, unsigned long end, unsigned long free_region_start, - unsigned long free_region_end) { } + unsigned long free_region_end, + unsigned long flags) { } static inline void *kasan_unpoison_vmalloc(const void *start, unsigned long size, diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c index ac8d19bdcc95..13528cf510b1 100644 --- a/mm/kasan/shadow.c +++ b/mm/kasan/shadow.c @@ -520,7 +520,8 @@ static int kasan_depopulate_vmalloc_pte(pte_t *ptep, unsigned long addr, */ void kasan_release_vmalloc(unsigned long start, unsigned long end, unsigned long free_region_start, - unsigned long free_region_end) + unsigned long free_region_end, + unsigned long flags) { void *shadow_start, *shadow_end; unsigned long region_start, region_end; @@ -553,12 +554,17 @@ void kasan_release_vmalloc(unsigned long start, unsigned long end, __memset(shadow_start, KASAN_SHADOW_INIT, shadow_end - shadow_start); return; } - apply_to_existing_page_range(&init_mm, + + + if (flags & KASAN_VMALLOC_PAGE_RANGE) + apply_to_existing_page_range(&init_mm, (unsigned long)shadow_start, size, kasan_depopulate_vmalloc_pte, NULL); - flush_tlb_kernel_range((unsigned long)shadow_start, - (unsigned long)shadow_end); + + if (flags & KASAN_VMALLOC_TLB_FLUSH) + flush_tlb_kernel_range((unsigned long)shadow_start, + (unsigned long)shadow_end); } } diff --git a/mm/vmalloc.c b/mm/vmalloc.c index cb0951fea238..9434785d6861 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2176,6 +2176,25 @@ decay_va_pool_node(struct vmap_node *vn, bool full_decay) reclaim_list_global(&decay_list); } +static void +kasan_release_vmalloc_node(struct vmap_node *vn) +{ + struct vmap_area *va; + unsigned long start, end; + + start = list_first_entry(&vn->purge_list, struct vmap_area, list)->va_start; + end = list_last_entry(&vn->purge_list, struct vmap_area, list)->va_end; + + list_for_each_entry(va, &vn->purge_list, list) { + if (is_vmalloc_or_module_addr((void *) va->va_start)) + kasan_release_vmalloc(va->va_start, va->va_end, + va->va_start, va->va_end, + KASAN_VMALLOC_PAGE_RANGE); + } + + kasan_release_vmalloc(start, end, start, end, KASAN_VMALLOC_TLB_FLUSH); +} + static void purge_vmap_node(struct work_struct *work) { struct vmap_node *vn = container_of(work, @@ -2183,20 +2202,17 @@ static void purge_vmap_node(struct work_struct *work) struct vmap_area *va, *n_va; LIST_HEAD(local_list); + if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) + kasan_release_vmalloc_node(vn); + vn->nr_purged = 0; list_for_each_entry_safe(va, n_va, &vn->purge_list, list) { unsigned long nr = (va->va_end - va->va_start) >> PAGE_SHIFT; - unsigned long orig_start = va->va_start; - unsigned long orig_end = va->va_end; unsigned int vn_id = decode_vn_id(va->flags); list_del_init(&va->list); - if (is_vmalloc_or_module_addr((void *)orig_start)) - kasan_release_vmalloc(orig_start, orig_end, - va->va_start, va->va_end); - atomic_long_sub(nr, &vmap_lazy_nr); vn->nr_purged++; @@ -4712,7 +4728,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, &free_vmap_area_list); if (va) kasan_release_vmalloc(orig_start, orig_end, - va->va_start, va->va_end); + va->va_start, va->va_end, + KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH); vas[area] = NULL; } @@ -4762,7 +4779,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets, &free_vmap_area_list); if (va) kasan_release_vmalloc(orig_start, orig_end, - va->va_start, va->va_end); + va->va_start, va->va_end, + KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH); vas[area] = NULL; kfree(vms[area]); } -- 2.43.0

2 1

[openeuler:OLK-6.6 1926/1926] mm/share_pool.c:787: warning: Function parameter or member 'node_id' not described in 'sp_area_alloc'
by kernel test robot 15 Feb '25

15 Feb '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 56197cf035ddc0d25f6d27169455448133fd75dd commit: b39fcd51ad1b62c99ed0932ad0d2f89dfdc17aaa [1926/1926] mm/sharepool: Add sp_area management code config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250215/202502150809.BaTrf9hC-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250215/202502150809.BaTrf9hC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502150809.BaTrf9hC-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/share_pool.c:685: warning: expecting prototype for mp_sp_group_id_by_pid(). Prototype was for mg_sp_group_id_by_pid() instead >> mm/share_pool.c:787: warning: Function parameter or member 'node_id' not described in 'sp_area_alloc' mm/share_pool.c:1110: warning: duplicate section name 'Return' mm/share_pool.c:1145: warning: Function parameter or member 'spg_id' not described in 'mg_sp_unshare' vim +787 mm/share_pool.c 773 774 /** 775 * sp_area_alloc() - Allocate a region of VA from the share pool. 776 * @size: the size of VA to allocate. 777 * @flags: how to allocate the memory. 778 * @spg: the share group that the memory is allocated to. 779 * @type: the type of the region. 780 * @applier: the tgid of the task which allocates the region. 781 * 782 * Return: a valid pointer for success, NULL on failure. 783 */ 784 static struct sp_area *sp_area_alloc(unsigned long size, unsigned long flags, 785 struct sp_group *spg, enum spa_type type, 786 pid_t applier, int node_id) > 787 { 788 int device_id; 789 struct sp_area *spa, *first, *err; 790 struct rb_node *n; 791 unsigned long vstart; 792 unsigned long vend; 793 unsigned long addr; 794 unsigned long size_align = ALIGN(size, PMD_SIZE); /* va aligned to 2M */ 795 struct sp_mapping *mapping; 796 797 device_id = sp_flags_device_id(flags); 798 if (device_id < 0 || device_id >= MAX_DEVID) { 799 pr_err("invalid device id %d\n", device_id); 800 return ERR_PTR(-EINVAL); 801 } 802 803 if (flags & SP_PROT_FOCUS) { 804 if ((flags & (SP_DVPP | SP_PROT_RO)) != SP_PROT_RO) { 805 pr_err("invalid sp_flags [%lx]\n", flags); 806 return ERR_PTR(-EINVAL); 807 } 808 mapping = spg->mapping[SP_MAPPING_RO]; 809 } else if (flags & SP_DVPP) { 810 mapping = spg->mapping[SP_MAPPING_DVPP]; 811 } else { 812 mapping = spg->mapping[SP_MAPPING_NORMAL]; 813 } 814 815 if (!mapping) { 816 pr_err_ratelimited("non DVPP spg, id %d\n", spg->id); 817 return ERR_PTR(-EINVAL); 818 } 819 820 vstart = mapping->start[device_id]; 821 vend = mapping->end[device_id]; 822 spa = kmalloc(sizeof(struct sp_area), GFP_KERNEL); 823 if (unlikely(!spa)) 824 return ERR_PTR(-ENOMEM); 825 826 spin_lock(&mapping->sp_mapping_lock); 827 828 /* 829 * Invalidate cache if we have more permissive parameters. 830 * cached_hole_size notes the largest hole noticed _below_ 831 * the sp_area cached in free_area_cache: if size fits 832 * into that hole, we want to scan from vstart to reuse 833 * the hole instead of allocating above free_area_cache. 834 * Note that sp_area_free may update free_area_cache 835 * without updating cached_hole_size. 836 */ 837 if (!mapping->free_area_cache || size_align < mapping->cached_hole_size || 838 vstart != mapping->cached_vstart) { 839 mapping->cached_hole_size = 0; 840 mapping->free_area_cache = NULL; 841 } 842 843 /* record if we encounter less permissive parameters */ 844 mapping->cached_vstart = vstart; 845 846 /* find starting point for our search */ 847 if (mapping->free_area_cache) { 848 first = rb_entry(mapping->free_area_cache, struct sp_area, rb_node); 849 addr = first->va_end; 850 if (addr + size_align < addr) { 851 err = ERR_PTR(-EOVERFLOW); 852 goto error; 853 } 854 } else { 855 addr = vstart; 856 if (addr + size_align < addr) { 857 err = ERR_PTR(-EOVERFLOW); 858 goto error; 859 } 860 861 n = mapping->area_root.rb_node; 862 first = NULL; 863 864 while (n) { 865 struct sp_area *tmp; 866 867 tmp = rb_entry(n, struct sp_area, rb_node); 868 if (tmp->va_end >= addr) { 869 first = tmp; 870 if (tmp->va_start <= addr) 871 break; 872 n = n->rb_left; 873 } else 874 n = n->rb_right; 875 } 876 877 if (!first) 878 goto found; 879 } 880 881 /* from the starting point, traverse areas until a suitable hole is found */ 882 while (addr + size_align > first->va_start && addr + size_align <= vend) { 883 if (addr + mapping->cached_hole_size < first->va_start) 884 mapping->cached_hole_size = first->va_start - addr; 885 addr = first->va_end; 886 if (addr + size_align < addr) { 887 err = ERR_PTR(-EOVERFLOW); 888 goto error; 889 } 890 891 n = rb_next(&first->rb_node); 892 if (n) 893 first = rb_entry(n, struct sp_area, rb_node); 894 else 895 goto found; 896 } 897 898 found: 899 if (addr + size_align > vend) { 900 err = ERR_PTR(-EOVERFLOW); 901 goto error; 902 } 903 904 spa->va_start = addr; 905 spa->va_end = addr + size_align; 906 spa->real_size = size; 907 spa->region_vstart = vstart; 908 spa->flags = flags; 909 spa->is_hugepage = (flags & SP_HUGEPAGE); 910 spa->spg = spg; 911 spa->spm = mapping; 912 spa->type = type; 913 spa->kva = 0; /* NULL pointer */ 914 spa->applier = applier; 915 spa->preferred_node_id = node_id; 916 atomic_set(&spa->use_count, 1); 917 918 /* the link location could be saved before, to be optimized */ 919 spm_insert_area(mapping, spa); 920 mapping->free_area_cache = &spa->rb_node; 921 922 spin_unlock(&mapping->sp_mapping_lock); 923 sp_group_insert_area(spg, spa); 924 925 return spa; 926 927 error: 928 spin_unlock(&mapping->sp_mapping_lock); 929 kfree(spa); 930 return err; 931 } 932 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD SUCCESS WITH WARNING 56197cf035ddc0d25f6d27169455448133fd75dd
by kernel test robot 15 Feb '25

15 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 56197cf035ddc0d25f6d27169455448133fd75dd !15078 [OLK-6.6] crypto: zhaoxin - Optimize the assembly code in the SM3 driver Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202502142151.sl3QmAFi-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202502150605.wrnTujjy-lkp@intel.com mm/page_cache_limit.c:35:5: warning: no previous prototype for 'cache_reclaim_enable_handler' [-Wmissing-prototypes] mm/page_cache_limit.c:51:5: warning: no previous prototype for 'cache_reclaim_sysctl_handler' [-Wmissing-prototypes] mm/page_cache_limit.c:94:5: warning: no previous prototype for function 'cache_limit_mbytes_sysctl_handler' [-Wmissing-prototypes] mm/share_pool.c:176: warning: duplicate section name 'Return' mm/share_pool.c:211: warning: Function parameter or member 'spg_id' not described in 'mg_sp_unshare' mm/share_pool.c:68: warning: expecting prototype for mp_sp_group_id_by_pid(). Prototype was for mg_sp_group_id_by_pid() instead Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250214 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allmodconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250214 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250214 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250214 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-defconfig |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 727m configs tested: 17 configs skipped: 76 tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250214 gcc-14.2.0 arm64 randconfig-002-20250214 gcc-14.2.0 arm64 randconfig-003-20250214 gcc-14.2.0 arm64 randconfig-004-20250214 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch randconfig-001-20250214 gcc-14.2.0 loongarch randconfig-002-20250214 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250214 clang-19 x86_64 buildonly-randconfig-002-20250214 clang-19 x86_64 buildonly-randconfig-003-20250214 gcc-12 x86_64 buildonly-randconfig-004-20250214 clang-19 x86_64 buildonly-randconfig-005-20250214 gcc-12 x86_64 buildonly-randconfig-006-20250214 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1926/1926] mm/share_pool.c:68: warning: expecting prototype for mp_sp_group_id_by_pid(). Prototype was for mg_sp_group_id_by_pid() instead
by kernel test robot 15 Feb '25

15 Feb '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 56197cf035ddc0d25f6d27169455448133fd75dd commit: fb31808921b891789a2f6cbfc7e277fd0918144a [1926/1926] mm/sharepool: Add base framework for share_pool config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250215/202502150605.wrnTujjy-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250215/202502150605.wrnTujjy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502150605.wrnTujjy-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/share_pool.c:68: warning: expecting prototype for mp_sp_group_id_by_pid(). Prototype was for mg_sp_group_id_by_pid() instead >> mm/share_pool.c:176: warning: duplicate section name 'Return' >> mm/share_pool.c:211: warning: Function parameter or member 'spg_id' not described in 'mg_sp_unshare' vim +68 mm/share_pool.c 54 55 /** 56 * mp_sp_group_id_by_pid() - Get the sp_group ID array of a process. 57 * @tgid: tgid of target process. 58 * @spg_ids: point to an array to save the group ids the process belongs to 59 * @num: input the spg_ids array size; output the spg number of the process 60 * 61 * Return: 62 * >0 - the sp_group ID. 63 * -ENODEV - target process doesn't belong to any sp_group. 64 * -EINVAL - spg_ids or num is NULL. 65 * -E2BIG - the num of groups process belongs to is larger than *num 66 */ 67 int mg_sp_group_id_by_pid(int tgid, int *spg_ids, int *num) > 68 { 69 return -EOPNOTSUPP; 70 } 71 EXPORT_SYMBOL_GPL(mg_sp_group_id_by_pid); 72 73 /** 74 * mg_sp_group_add_task() - Add a process to an share group (sp_group). 75 * @tgid: the tgid of the task to be added. 76 * @prot: the prot of task for this spg. 77 * @spg_id: the ID of the sp_group. 78 * 79 * Return: A postive group number for success, -errno on failure. 80 * 81 * Valid @spg_id: 82 * [SPG_ID_MIN, SPG_ID_MAX]: 83 * the task would be added to the group with @spg_id, if the 84 * group doesn't exist, just create it. 85 * [SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX]: 86 * the task would be added to the group with @spg_id, if it 87 * doesn't exist ,return failed. 88 * SPG_ID_AUTO: 89 * the task would be added into a new group with a new id in range 90 * [SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX]. 91 * 92 * This function can be taken into four parts: 93 * 1. Check and initlize the task specified by @tgid properly. 94 * 2. Create or get the spg specified by @spg_id. 95 * 3. Check the spg and task together and link the task into the spg if 96 * everything looks good. 97 * 4. Map the existing sp_area from the spg into the new task. 98 */ 99 int mg_sp_group_add_task(int tgid, unsigned long prot, int spg_id) 100 { 101 return -EOPNOTSUPP; 102 } 103 EXPORT_SYMBOL_GPL(mg_sp_group_add_task); 104 105 int mg_sp_id_of_current(void) 106 { 107 return -EOPNOTSUPP; 108 } 109 EXPORT_SYMBOL_GPL(mg_sp_id_of_current); 110 111 /** 112 * mg_sp_free() - Free the memory allocated by mg_sp_alloc() or 113 * mg_sp_alloc_nodemask(). 114 * 115 * @addr: the starting VA of the memory. 116 * @id: Address space identifier, which is used to distinguish the addr. 117 * 118 * Return: 119 * * 0 - success. 120 * * -EINVAL - the memory can't be found or was not allocated by share pool. 121 * * -EPERM - the caller has no permision to free the memory. 122 */ 123 int mg_sp_free(unsigned long addr, int id) 124 { 125 return -EOPNOTSUPP; 126 } 127 EXPORT_SYMBOL_GPL(mg_sp_free); 128 129 static void __init proc_sharepool_init(void) 130 { 131 if (!proc_mkdir("sharepool", NULL)) 132 return; 133 } 134 135 void *mg_sp_alloc_nodemask(unsigned long size, unsigned long sp_flags, int spg_id, 136 nodemask_t nodemask) 137 { 138 return ERR_PTR(-EOPNOTSUPP); 139 } 140 EXPORT_SYMBOL_GPL(mg_sp_alloc_nodemask); 141 142 /** 143 * mg_sp_alloc() - Allocate shared memory for all the processes in a sp_group. 144 * @size: the size of memory to allocate. 145 * @sp_flags: how to allocate the memory. 146 * @spg_id: the share group that the memory is allocated to. 147 * 148 * Use pass through allocation if spg_id == SPG_ID_DEFAULT in multi-group mode. 149 * 150 * Return: 151 * * if succeed, return the starting address of the shared memory. 152 * * if fail, return the pointer of -errno. 153 */ 154 void *mg_sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) 155 { 156 return ERR_PTR(-EOPNOTSUPP); 157 } 158 EXPORT_SYMBOL_GPL(mg_sp_alloc); 159 160 /** 161 * mg_sp_make_share_k2u() - Share kernel memory to current process or an sp_group. 162 * @kva: the VA of shared kernel memory. 163 * @size: the size of shared kernel memory. 164 * @sp_flags: how to allocate the memory. We only support SP_DVPP. 165 * @tgid: the tgid of the specified process (Not currently in use). 166 * @spg_id: the share group that the memory is shared to. 167 * 168 * Return: the shared target user address to start at 169 * 170 * Share kernel memory to current task if spg_id == SPG_ID_NONE 171 * or SPG_ID_DEFAULT in multi-group mode. 172 * 173 * Return: 174 * * if succeed, return the shared user address to start at. 175 * * if fail, return the pointer of -errno. > 176 */ 177 void *mg_sp_make_share_k2u(unsigned long kva, unsigned long size, 178 unsigned long sp_flags, int tgid, int spg_id) 179 { 180 return ERR_PTR(-EOPNOTSUPP); 181 } 182 EXPORT_SYMBOL_GPL(mg_sp_make_share_k2u); 183 184 /** 185 * mg_sp_make_share_u2k() - Share user memory of a specified process to kernel. 186 * @uva: the VA of shared user memory 187 * @size: the size of shared user memory 188 * @tgid: the tgid of the specified process(Not currently in use) 189 * 190 * Return: 191 * * if success, return the starting kernel address of the shared memory. 192 * * if failed, return the pointer of -errno. 193 */ 194 void *mg_sp_make_share_u2k(unsigned long uva, unsigned long size, int tgid) 195 { 196 return ERR_PTR(-EOPNOTSUPP); 197 } 198 EXPORT_SYMBOL_GPL(mg_sp_make_share_u2k); 199 200 /** 201 * mg_sp_unshare() - Unshare the kernel or user memory which shared by calling 202 * sp_make_share_{k2u,u2k}(). 203 * @va: the specified virtual address of memory 204 * @size: the size of unshared memory 205 * 206 * Use spg_id of current thread if spg_id == SPG_ID_DEFAULT. 207 * 208 * Return: 0 for success, -errno on failure. 209 */ 210 int mg_sp_unshare(unsigned long va, unsigned long size, int spg_id) > 211 { 212 return -EOPNOTSUPP; 213 } 214 EXPORT_SYMBOL_GPL(mg_sp_unshare); 215 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1924/1924] mm/page_cache_limit.c:94:5: warning: no previous prototype for function 'cache_limit_mbytes_sysctl_handler'
by kernel test robot 14 Feb '25

14 Feb '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 56197cf035ddc0d25f6d27169455448133fd75dd commit: 7d1031b36ebd6c273d9aad316fd9e3e2daa01a85 [1924/1924] mm: support pagecache limit config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250214/202502142151.sl3QmAFi-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250214/202502142151.sl3QmAFi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502142151.sl3QmAFi-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/page_cache_limit.c:6: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ mm/page_cache_limit.c:61:5: warning: no previous prototype for function 'cache_reclaim_enable_handler' [-Wmissing-prototypes] 61 | int cache_reclaim_enable_handler(struct ctl_table *table, int write, | ^ mm/page_cache_limit.c:61:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 61 | int cache_reclaim_enable_handler(struct ctl_table *table, int write, | ^ | static mm/page_cache_limit.c:77:5: warning: no previous prototype for function 'cache_reclaim_sysctl_handler' [-Wmissing-prototypes] 77 | int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, | ^ mm/page_cache_limit.c:77:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 77 | int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, | ^ | static >> mm/page_cache_limit.c:94:5: warning: no previous prototype for function 'cache_limit_mbytes_sysctl_handler' [-Wmissing-prototypes] 94 | int cache_limit_mbytes_sysctl_handler(struct ctl_table *table, int write, | ^ mm/page_cache_limit.c:94:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 94 | int cache_limit_mbytes_sysctl_handler(struct ctl_table *table, int write, | ^ | static 8 warnings generated. vim +/cache_limit_mbytes_sysctl_handler +94 mm/page_cache_limit.c 93 > 94 int cache_limit_mbytes_sysctl_handler(struct ctl_table *table, int write, 95 void __user *buffer, size_t *length, loff_t *ppos) 96 { 97 int ret; 98 unsigned long vm_cache_limit_mbytes_max; 99 unsigned long origin_mbytes = vm_cache_limit_mbytes; 100 int nr_retries = MAX_RECLAIM_RETRIES; 101 102 vm_cache_limit_mbytes_max = totalram_pages() >> (20 - PAGE_SHIFT); 103 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 104 if (ret || !write) 105 return ret; 106 107 if (vm_cache_limit_mbytes > vm_cache_limit_mbytes_max) { 108 vm_cache_limit_mbytes = origin_mbytes; 109 return -EINVAL; 110 } 111 112 if (write) { 113 while (should_reclaim_page_cache() && page_cache_over_limit() && 114 nr_retries--) { 115 if (signal_pending(current)) 116 return -EINTR; 117 118 shrink_memory(node_reclaim_num(), false); 119 } 120 } 121 122 return 0; 123 } 124 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1924/1924] mm/oom_kill.c:316: warning: Function parameter or member 'task' not described in 'oom_next_task'
by kernel test robot 14 Feb '25

14 Feb '25

Hi Jing, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 254b433462607f511039b75693d9314822538f20 commit: be8d95530886b0aaa5a59b5c43a285667c9eebc6 [1924/1924] memcg: support priority for oom config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20250214/202502142019.HSCMUy5Y-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250214/202502142019.HSCMUy5Y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502142019.HSCMUy5Y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/oom_kill.c:316: warning: Function parameter or member 'task' not described in 'oom_next_task' >> mm/oom_kill.c:316: warning: Function parameter or member 'oc' not described in 'oom_next_task' >> mm/oom_kill.c:316: warning: Function parameter or member 'points' not described in 'oom_next_task' >> mm/oom_kill.c:316: warning: expecting prototype for We choose the task in low(). Prototype was for oom_next_task() instead vim +316 mm/oom_kill.c 308 309 #ifdef CONFIG_MEMCG_OOM_PRIORITY 310 /** 311 * We choose the task in low-priority memcg firstly. For the same state, we 312 * choose the task with the highest number of 'points'. 313 */ 314 static bool oom_next_task(struct task_struct *task, struct oom_control *oc, 315 long points) > 316 { 317 struct mem_cgroup *cur_memcg; 318 struct mem_cgroup *oc_memcg; 319 int cur_memcg_prio, oc_memcg_prio; 320 321 if (points == LONG_MIN) 322 return true; 323 324 if (!oc->chosen) 325 return false; 326 327 rcu_read_lock(); 328 oc_memcg = mem_cgroup_from_task(oc->chosen); 329 cur_memcg = mem_cgroup_from_task(task); 330 oc_memcg_prio = READ_ONCE(oc_memcg->oom_prio); 331 cur_memcg_prio = READ_ONCE(cur_memcg->oom_prio); 332 rcu_read_unlock(); 333 334 if (cur_memcg_prio == oc_memcg_prio) 335 return points < oc->chosen_points; 336 337 /* if oc is low-priority, so skip the task */ 338 if (oc_memcg_prio == MEMCG_LOW_OOM_PRIORITY) 339 return true; 340 341 return false; 342 } 343 #else 344 static inline bool oom_next_task(struct task_struct *task, 345 struct oom_control *oc, long points) 346 { 347 return points == LONG_MIN || points < oc->chosen_points; 348 } 349 #endif 350 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1924/1924] mm/page_cache_limit.c:35:5: warning: no previous prototype for function 'cache_reclaim_enable_handler'
by kernel test robot 14 Feb '25

14 Feb '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 254b433462607f511039b75693d9314822538f20 commit: 621647ce254f1d347ae9bc3d328c09cbb2732487 [1924/1924] mm: support periodical memory reclaim config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250214/202502142012.QOB8Lff2-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250214/202502142012.QOB8Lff2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502142012.QOB8Lff2-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/page_cache_limit.c:6: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> mm/page_cache_limit.c:35:5: warning: no previous prototype for function 'cache_reclaim_enable_handler' [-Wmissing-prototypes] 35 | int cache_reclaim_enable_handler(struct ctl_table *table, int write, | ^ mm/page_cache_limit.c:35:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 35 | int cache_reclaim_enable_handler(struct ctl_table *table, int write, | ^ | static >> mm/page_cache_limit.c:51:5: warning: no previous prototype for function 'cache_reclaim_sysctl_handler' [-Wmissing-prototypes] 51 | int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, | ^ mm/page_cache_limit.c:51:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 51 | int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, | ^ | static 7 warnings generated. vim +/cache_reclaim_enable_handler +35 mm/page_cache_limit.c 34 > 35 int cache_reclaim_enable_handler(struct ctl_table *table, int write, 36 void *buffer, size_t *length, loff_t *ppos) 37 { 38 int ret; 39 40 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 41 if (ret || !write) 42 return ret; 43 44 if (should_periodical_reclaim()) 45 schedule_delayed_work(&shepherd, round_jiffies_relative( 46 (unsigned long)vm_cache_reclaim_s * HZ)); 47 48 return 0; 49 } 50 > 51 int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, 52 void *buffer, size_t *length, loff_t *ppos) 53 { 54 int ret; 55 56 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 57 if (ret || !write) 58 return ret; 59 60 if (should_periodical_reclaim()) 61 mod_delayed_work(system_unbound_wq, &shepherd, 62 round_jiffies_relative( 63 (unsigned long)vm_cache_reclaim_s * HZ)); 64 65 return ret; 66 } 67 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1924/1924] mm/vmalloc.c:4443: warning: Function parameter or member 'pgoff' not described in 'remap_vmalloc_hugepage_range_partial'
by kernel test robot 14 Feb '25

14 Feb '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 254b433462607f511039b75693d9314822538f20 commit: 9b1283f2bec2134030e1e099b900579f1f03840e [1924/1924] mm/vmalloc: Extend vmalloc usage about hugepage config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20250214/202502141816.L1NkVPgB-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250214/202502141816.L1NkVPgB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502141816.L1NkVPgB-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/vmalloc.c:4443: warning: Function parameter or member 'pgoff' not described in 'remap_vmalloc_hugepage_range_partial' vim +4443 mm/vmalloc.c 4423 4424 /** 4425 * remap_vmalloc_hugepage_range_partial - map vmalloc hugepages 4426 * to userspace 4427 * @vma: vma to cover 4428 * @uaddr: target user address to start at 4429 * @kaddr: virtual address of vmalloc hugepage kernel memory 4430 * @size: size of map area 4431 * 4432 * Returns: 0 for success, -Exxx on failure 4433 * 4434 * This function checks that @kaddr is a valid vmalloc'ed area, 4435 * and that it is big enough to cover the range starting at 4436 * @uaddr in @vma. Will return failure if that criteria isn't 4437 * met. 4438 * 4439 * Similar to remap_pfn_range() (see mm/memory.c) 4440 */ 4441 int remap_vmalloc_hugepage_range_partial(struct vm_area_struct *vma, unsigned long uaddr, 4442 void *kaddr, unsigned long pgoff, unsigned long size) > 4443 { 4444 struct vm_struct *area; 4445 unsigned long off; 4446 unsigned long end_index; 4447 4448 if (check_shl_overflow(pgoff, PMD_SHIFT, &off)) 4449 return -EINVAL; 4450 4451 size = ALIGN(size, PMD_SIZE); 4452 4453 if (!IS_ALIGNED(uaddr, PMD_SIZE) || !IS_ALIGNED((unsigned long)kaddr, PMD_SIZE)) 4454 return -EINVAL; 4455 4456 area = find_vm_area(kaddr); 4457 if (!area) 4458 return -EINVAL; 4459 4460 if (!(area->flags & VM_USERMAP)) 4461 return -EINVAL; 4462 4463 if (check_add_overflow(size, off, &end_index) || 4464 end_index > get_vm_area_size(area)) 4465 return -EINVAL; 4466 kaddr += off; 4467 4468 do { 4469 struct page *page = vmalloc_to_page(kaddr); 4470 int ret; 4471 4472 ret = hugetlb_insert_hugepage_pte_by_pa(vma->vm_mm, uaddr, 4473 vma->vm_page_prot, page_to_phys(page)); 4474 if (ret) 4475 return ret; 4476 4477 uaddr += PMD_SIZE; 4478 kaddr += PMD_SIZE; 4479 size -= PMD_SIZE; 4480 } while (size > 0); 4481 4482 vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP); 4483 4484 return 0; 4485 } 4486 EXPORT_SYMBOL(remap_vmalloc_hugepage_range_partial); 4487 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
by Xia Fukun 14 Feb '25

14 Feb '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.12-rc7 commit 7dd08a0b4193087976db6b3ee7807de7e8316f96 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AV7 CVE: CVE-2024-50268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "*cmd" variable can be controlled by the user via debugfs. That means "new_cam" can be as high as 255 while the size of the uc->updated[] array is UCSI_MAX_ALTMODES (30). The call tree is: ucsi_cmd() // val comes from simple_attr_write_xsigned() -> ucsi_send_command() -> ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() -> ucsi_ccg_sync_control() Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") Cc: stable <stable(a)kernel.org> Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/325102b3-eaa8-4918-a947-22aca1146586@stanley.moun… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi_ccg.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c index 2f2cb3fc85813..83dc13f6ab8c1 100644 --- a/drivers/usb/typec/ucsi/ucsi_ccg.c +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c @@ -436,6 +436,8 @@ static void ucsi_ccg_update_set_new_cam_cmd(struct ucsi_ccg *uc, port = uc->orig; new_cam = UCSI_SET_NEW_CAM_GET_AM(*cmd); + if (new_cam >= ARRAY_SIZE(uc->updated)) + return; new_port = &uc->updated[new_cam]; cam = new_port->linked_idx; enter_new_mode = UCSI_SET_NEW_CAM_ENTER(*cmd); -- 2.34.1

2 1

[PATCH OLK-5.10] drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
by Xia Fukun 14 Feb '25

14 Feb '25

From: Junlin Li <make24(a)iscas.ac.cn> mainline inclusion from mainline-v6.12-rc5 commit 46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJG CVE: CVE-2024-47697 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue. Fixes: df70ddad81b4 ("[media] rtl2830: implement PID filter") Signed-off-by: Junlin Li <make24(a)iscas.ac.cn> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/media/dvb-frontends/rtl2830.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/rtl2830.c b/drivers/media/dvb-frontends/rtl2830.c index e6b8367c8cce4..84c00c6894d3d 100644 --- a/drivers/media/dvb-frontends/rtl2830.c +++ b/drivers/media/dvb-frontends/rtl2830.c @@ -609,7 +609,7 @@ static int rtl2830_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, int on index, pid, onoff); /* skip invalid PIDs (0x2000) */ - if (pid > 0x1fff || index > 32) + if (pid > 0x1fff || index >= 32) return 0; if (onoff) -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD SUCCESS 7173d438401b108861e2baa01501f4dadba16c8b
by kernel test robot 14 Feb '25

14 Feb '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 7173d438401b108861e2baa01501f4dadba16c8b !15067 irqchip/gic-v3-its: Don't enable interrupts in its_irq_set_vcpu_affinity() Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- arm64-randconfig-001-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- arm64-randconfig-002-20250213 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- arm64-randconfig-003-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- arm64-randconfig-004-20250213 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- loongarch-allmodconfig | |-- include-trace-stages-init.h:warning:str__bonding__trace_system_name-defined-but-not-used | |-- include-trace-stages-init.h:warning:str__fs__trace_system_name-defined-but-not-used | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-randconfig-001-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- loongarch-randconfig-002-20250213 | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | `-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used |-- x86_64-allnoconfig | |-- include-linux-sched-signal.h:linux-kabi.h-is-included-more-than-once. | |-- include-net-tcp.h:linux-kabi.h-is-included-more-than-once. | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- x86_64-allyesconfig | |-- mm-dynamic_pool.c:warning:variable-ret-is-uninitialized-when-used-here | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-001-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-002-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | |-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags | `-- mm-memcontrol.c:warning:mem_cgroup_check_swap_for_v1-defined-but-not-used |-- x86_64-buildonly-randconfig-003-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-function-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-function-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-004-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-005-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags |-- x86_64-buildonly-randconfig-006-20250213 | |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma | |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead | `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags `-- x86_64-defconfig |-- mm-madvise.c:warning:no-previous-prototype-for-force_swapin_vma |-- mm-memblock.c:warning:expecting-prototype-for-memblock_alloc_internal().-Prototype-was-for-__memblock_alloc_internal()-instead `-- mm-memblock.c:warning:no-previous-prototype-for-memblock_alloc_range_nid_flags elapsed time: 721m configs tested: 17 configs skipped: 119 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250213 clang-19 arm64 randconfig-002-20250213 gcc-14.2.0 arm64 randconfig-003-20250213 gcc-14.2.0 arm64 randconfig-004-20250213 clang-21 loongarch allmodconfig gcc-14.2.0 loongarch randconfig-001-20250213 gcc-14.2.0 loongarch randconfig-002-20250213 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250213 gcc-11 x86_64 buildonly-randconfig-002-20250213 gcc-12 x86_64 buildonly-randconfig-003-20250213 clang-19 x86_64 buildonly-randconfig-004-20250213 gcc-12 x86_64 buildonly-randconfig-005-20250213 gcc-12 x86_64 buildonly-randconfig-006-20250213 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] kasan: fix incorrect return type of quarantine_put()
by Kaixiong Yu 13 Feb '25

13 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLXYN -------------------------------- The return type of quarantine_put() leads to complie errors. Fix it by changing void type into bool. Fixes: 83271e84716b ("kasan: sanitize objects when metadata doesn't fit") Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/kasan/kasan.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index 17d97ffbbdeb..e147b9595ee8 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -195,7 +195,7 @@ bool quarantine_put(struct kmem_cache *cache, void *object); void quarantine_reduce(void); void quarantine_remove_cache(struct kmem_cache *cache); #else -static inline void quarantine_put(struct kmem_cache *cache, void *object) { return false; } +static inline bool quarantine_put(struct kmem_cache *cache, void *object) { return false; } static inline void quarantine_reduce(void) { } static inline void quarantine_remove_cache(struct kmem_cache *cache) { } #endif -- 2.34.1

2 1

[PATCH V4 openEuler-1.0-LTS 0/1] Fix CVE-2023-52572 in openEuler-1.0-LTS
by Wang Zhaolong 13 Feb '25

13 Feb '25

V1 -> V2: In the compound_send_recv(), correct the credits[i] update condition MID_RESPONSE_RECEIVED to MID_RESPONSE_READY. V2 -> V3: Correct conflicts and Signed-off-by information. V3 -> V4 Correct conflicts information. Zhang Xiaoxu (1): cifs: Fix UAF in cifs_demultiplex_thread() fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 3 ++- fs/cifs/transport.c | 32 +++++++++++++++++++++----------- 3 files changed, 24 insertions(+), 12 deletions(-) -- 2.34.3

2 2