- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2455/2455] drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c:823:5: warning: no previous prototype for 'hinic3_set_rxq_recovery_flag'
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9b85bcf0e6357841885264f42859bec05c9073f4 commit: dcb286ce50a35a77e51b61db72c7cc001647b598 [2455/2455] net/hinic3: add huawei/hinic3 driver config: x86_64-buildonly-randconfig-006-20250704 (https://download.01.org/0day-ci/archive/20250704/202507040311.LBh4TqFz-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507040311.LBh4TqFz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507040311.LBh4TqFz-lkp@intel.com/ All error/warnings (new ones prefixed by >>): >> drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c:823:5: warning: no previous prototype for 'hinic3_set_rxq_recovery_flag' [-Wmissing-prototypes] 823 | int hinic3_set_rxq_recovery_flag(struct net_device *netdev, u32 priv_flags) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:64:55: error: positional initialization of field in 'struct' declared with 'designated_init' attribute [-Werror=designated-init] 64 | struct hinic3_uld_info g_uld_info[SERVICE_T_MAX] = { {0} }; | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:64:55: note: (near initialization for 'g_uld_info[0]') >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:64:55: error: invalid initializer drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:64:55: note: (near initialization for 'g_uld_info[0].<anonymous>') drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:69:6: warning: no previous prototype for 'hinic3_uld_lock_init' [-Wmissing-prototypes] 69 | void hinic3_uld_lock_init(void) | ^~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/hinic3_set_rxq_recovery_flag +823 drivers/net/ethernet/huawei/hinic3/hinic3_ethtool.c 822 > 823 int hinic3_set_rxq_recovery_flag(struct net_device *netdev, u32 priv_flags) 824 { 825 struct hinic3_nic_dev *nic_dev = netdev_priv(netdev); 826 827 if (priv_flags & HINIC3_PRIV_FLAGS_RXQ_RECOVERY) { 828 if (!HINIC3_SUPPORT_RXQ_RECOVERY(nic_dev->hwdev)) { 829 nicif_info(nic_dev, drv, netdev, "Unsupport open rxq recovery\n"); 830 return -EOPNOTSUPP; 831 } 832 833 if (test_and_set_bit(HINIC3_RXQ_RECOVERY, &nic_dev->flags)) 834 return 0; 835 queue_delayed_work(nic_dev->workq, &nic_dev->rxq_check_work, HZ); 836 nicif_info(nic_dev, drv, netdev, "open rxq recovery\n"); 837 } else { 838 if (!test_and_clear_bit(HINIC3_RXQ_RECOVERY, &nic_dev->flags)) 839 return 0; 840 cancel_delayed_work_sync(&nic_dev->rxq_check_work); 841 nicif_info(nic_dev, drv, netdev, "close rxq recovery\n"); 842 } 843 844 return 0; 845 } 846 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2455/2455] include/trace/events/kmem.h:428:26: error: invalid use of undefined type 'struct mem_sampling_record'
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9b85bcf0e6357841885264f42859bec05c9073f4 commit: 5c9754d56876f60e199456beda45715da2d1a20b [2455/2455] mm/mem_sampling: Add eBPF interface for memory access tracing config: arm64-randconfig-004-20250704 (https://download.01.org/0day-ci/archive/20250704/202507040329.C58KAKhY-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507040329.C58KAKhY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507040329.C58KAKhY-lkp@intel.com/ All errors (new ones prefixed by >>): | ^~~~~~~~~~~~~~~~~ include/linux/tracepoint.h:253:2: note: in expansion of macro 'DECLARE_STATIC_CALL' 253 | DECLARE_STATIC_CALL(tp_func_##name, __traceiter_##name); \ | ^~~~~~~~~~~~~~~~~~~ include/linux/tracepoint.h:432:2: note: in expansion of macro '__DECLARE_TRACE' 432 | __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \ | ^~~~~~~~~~~~~~~ include/linux/tracepoint.h:566:2: note: in expansion of macro 'DECLARE_TRACE' 566 | DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) | ^~~~~~~~~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ In file included from include/trace/define_trace.h:102, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: include/trace/events/kmem.h:417:18: warning: 'struct mem_sampling_record' declared inside parameter list will not be visible outside of this definition or declaration 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:261:58: note: in definition of macro 'DECLARE_EVENT_CLASS' 261 | struct trace_event_data_offsets_##call *__data_offsets, proto) \ | ^~~~~ include/trace/trace_events.h:41:9: note: in expansion of macro 'PARAMS' 41 | PARAMS(proto), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:417:2: note: in expansion of macro 'TP_PROTO' 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~ In file included from include/trace/define_trace.h:102, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: include/trace/events/kmem.h:417:18: warning: 'struct mem_sampling_record' declared inside parameter list will not be visible outside of this definition or declaration 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:399:47: note: in definition of macro '__DECLARE_EVENT_CLASS' 399 | do_trace_event_raw_event_##call(void *__data, proto) \ | ^~~~~ include/trace/trace_events.h:427:29: note: in expansion of macro 'PARAMS' 427 | __DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \ | ^~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:41:9: note: in expansion of macro 'PARAMS' 41 | PARAMS(proto), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:417:2: note: in expansion of macro 'TP_PROTO' 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~ include/trace/events/kmem.h: In function 'do_trace_event_raw_event_mm_spe_record': include/trace/events/kmem.h:419:10: error: passing argument 2 of 'trace_event_get_offsets_mm_spe_record' from incompatible pointer type [-Werror=incompatible-pointer-types] 419 | TP_ARGS(record), | ^~~~~~ | | | struct mem_sampling_record * include/trace/trace_events.h:410:64: note: in definition of macro '__DECLARE_EVENT_CLASS' 410 | __data_size = trace_event_get_offsets_##call(&__data_offsets, args); \ | ^~~~ include/trace/trace_events.h:427:44: note: in expansion of macro 'PARAMS' 427 | __DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \ | ^~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:42:9: note: in expansion of macro 'PARAMS' 42 | PARAMS(args), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:419:2: note: in expansion of macro 'TP_ARGS' 419 | TP_ARGS(record), | ^~~~~~~ In file included from include/trace/define_trace.h:102, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: include/trace/events/kmem.h:417:39: note: expected 'struct mem_sampling_record *' but argument is of type 'struct mem_sampling_record *' 417 | TP_PROTO(struct mem_sampling_record *record), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ include/trace/trace_events.h:261:58: note: in definition of macro 'DECLARE_EVENT_CLASS' 261 | struct trace_event_data_offsets_##call *__data_offsets, proto) \ | ^~~~~ include/trace/trace_events.h:41:9: note: in expansion of macro 'PARAMS' 41 | PARAMS(proto), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:417:2: note: in expansion of macro 'TP_PROTO' 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~ In file included from include/trace/define_trace.h:102, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: >> include/trace/events/kmem.h:428:26: error: invalid use of undefined type 'struct mem_sampling_record' 428 | __entry->vaddr = record->virt_addr; | ^~ include/trace/trace_events.h:420:4: note: in definition of macro '__DECLARE_EVENT_CLASS' 420 | { assign; } \ | ^~~~~~ include/trace/trace_events.h:428:9: note: in expansion of macro 'PARAMS' 428 | PARAMS(assign), PARAMS(print)) \ | ^~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:44:9: note: in expansion of macro 'PARAMS' 44 | PARAMS(assign), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:427:2: note: in expansion of macro 'TP_fast_assign' 427 | TP_fast_assign( | ^~~~~~~~~~~~~~ include/trace/events/kmem.h:429:26: error: invalid use of undefined type 'struct mem_sampling_record' 429 | __entry->paddr = record->phys_addr; | ^~ include/trace/trace_events.h:420:4: note: in definition of macro '__DECLARE_EVENT_CLASS' 420 | { assign; } \ | ^~~~~~ include/trace/trace_events.h:428:9: note: in expansion of macro 'PARAMS' 428 | PARAMS(assign), PARAMS(print)) \ | ^~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:44:9: note: in expansion of macro 'PARAMS' 44 | PARAMS(assign), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:427:2: note: in expansion of macro 'TP_fast_assign' 427 | TP_fast_assign( | ^~~~~~~~~~~~~~ include/trace/events/kmem.h:430:24: error: invalid use of undefined type 'struct mem_sampling_record' 430 | __entry->pid = record->context_id; | ^~ include/trace/trace_events.h:420:4: note: in definition of macro '__DECLARE_EVENT_CLASS' 420 | { assign; } \ | ^~~~~~ include/trace/trace_events.h:428:9: note: in expansion of macro 'PARAMS' 428 | PARAMS(assign), PARAMS(print)) \ | ^~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:44:9: note: in expansion of macro 'PARAMS' 44 | PARAMS(assign), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:427:2: note: in expansion of macro 'TP_fast_assign' 427 | TP_fast_assign( | ^~~~~~~~~~~~~~ include/trace/events/kmem.h: At top level: include/trace/events/kmem.h:417:18: warning: 'struct mem_sampling_record' declared inside parameter list will not be visible outside of this definition or declaration 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:430:44: note: in definition of macro 'DECLARE_EVENT_CLASS' 430 | trace_event_raw_event_##call(void *__data, proto) \ | ^~~~~ include/trace/trace_events.h:41:9: note: in expansion of macro 'PARAMS' 41 | PARAMS(proto), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:417:2: note: in expansion of macro 'TP_PROTO' 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~ include/trace/events/kmem.h: In function 'trace_event_raw_event_mm_spe_record': include/trace/events/kmem.h:419:10: error: passing argument 2 of 'do_trace_event_raw_event_mm_spe_record' from incompatible pointer type [-Werror=incompatible-pointer-types] 419 | TP_ARGS(record), | ^~~~~~ | | | struct mem_sampling_record * include/trace/trace_events.h:432:42: note: in definition of macro 'DECLARE_EVENT_CLASS' 432 | do_trace_event_raw_event_##call(__data, args); \ | ^~~~ include/trace/trace_events.h:42:9: note: in expansion of macro 'PARAMS' 42 | PARAMS(args), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:419:2: note: in expansion of macro 'TP_ARGS' 419 | TP_ARGS(record), | ^~~~~~~ include/trace/events/kmem.h:417:39: note: expected 'struct mem_sampling_record *' but argument is of type 'struct mem_sampling_record *' 417 | TP_PROTO(struct mem_sampling_record *record), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ include/trace/trace_events.h:399:47: note: in definition of macro '__DECLARE_EVENT_CLASS' -- | ^~~~~ include/trace/trace_events.h:468:25: note: in expansion of macro 'PARAMS' 468 | _TRACE_PERF_PROTO(call, PARAMS(proto)); \ | ^~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:41:9: note: in expansion of macro 'PARAMS' 41 | PARAMS(proto), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:417:2: note: in expansion of macro 'TP_PROTO' 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~ In file included from include/trace/define_trace.h:103, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: include/trace/events/kmem.h:417:18: warning: 'struct mem_sampling_record' declared inside parameter list will not be visible outside of this definition or declaration 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~~~~~~~~~~~~ include/trace/perf.h:18:33: note: in definition of macro 'DECLARE_EVENT_CLASS' 18 | perf_trace_##call(void *__data, proto) \ | ^~~~~ include/trace/trace_events.h:41:9: note: in expansion of macro 'PARAMS' 41 | PARAMS(proto), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:417:2: note: in expansion of macro 'TP_PROTO' 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~ include/trace/perf.h:18:1: error: conflicting types for 'perf_trace_mm_spe_record' 18 | perf_trace_##call(void *__data, proto) \ | ^~~~~~~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ In file included from include/trace/define_trace.h:102, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: include/trace/trace_events.h:383:2: note: previous declaration of 'perf_trace_mm_spe_record' was here 383 | perf_trace_##call(void *__data, proto); | ^~~~~~~~~~~ include/trace/trace_events.h:468:1: note: in expansion of macro '_TRACE_PERF_PROTO' 468 | _TRACE_PERF_PROTO(call, PARAMS(proto)); \ | ^~~~~~~~~~~~~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ In file included from include/trace/define_trace.h:103, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: include/trace/events/kmem.h: In function 'perf_trace_mm_spe_record': include/trace/events/kmem.h:419:10: error: passing argument 2 of 'trace_event_get_offsets_mm_spe_record' from incompatible pointer type [-Werror=incompatible-pointer-types] 419 | TP_ARGS(record), | ^~~~~~ | | | struct mem_sampling_record * include/trace/perf.h:31:64: note: in definition of macro 'DECLARE_EVENT_CLASS' 31 | __data_size = trace_event_get_offsets_##call(&__data_offsets, args); \ | ^~~~ include/trace/trace_events.h:42:9: note: in expansion of macro 'PARAMS' 42 | PARAMS(args), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:419:2: note: in expansion of macro 'TP_ARGS' 419 | TP_ARGS(record), | ^~~~~~~ In file included from include/trace/define_trace.h:102, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: include/trace/events/kmem.h:417:39: note: expected 'struct mem_sampling_record *' but argument is of type 'struct mem_sampling_record *' 417 | TP_PROTO(struct mem_sampling_record *record), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~ include/trace/trace_events.h:261:58: note: in definition of macro 'DECLARE_EVENT_CLASS' 261 | struct trace_event_data_offsets_##call *__data_offsets, proto) \ | ^~~~~ include/trace/trace_events.h:41:9: note: in expansion of macro 'PARAMS' 41 | PARAMS(proto), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:417:2: note: in expansion of macro 'TP_PROTO' 417 | TP_PROTO(struct mem_sampling_record *record), | ^~~~~~~~ In file included from include/trace/define_trace.h:103, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: >> include/trace/events/kmem.h:428:26: error: invalid use of undefined type 'struct mem_sampling_record' 428 | __entry->vaddr = record->virt_addr; | ^~ include/trace/perf.h:51:4: note: in definition of macro 'DECLARE_EVENT_CLASS' 51 | { assign; } \ | ^~~~~~ include/trace/trace_events.h:44:9: note: in expansion of macro 'PARAMS' 44 | PARAMS(assign), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:427:2: note: in expansion of macro 'TP_fast_assign' 427 | TP_fast_assign( | ^~~~~~~~~~~~~~ include/trace/events/kmem.h:429:26: error: invalid use of undefined type 'struct mem_sampling_record' 429 | __entry->paddr = record->phys_addr; | ^~ include/trace/perf.h:51:4: note: in definition of macro 'DECLARE_EVENT_CLASS' 51 | { assign; } \ | ^~~~~~ include/trace/trace_events.h:44:9: note: in expansion of macro 'PARAMS' 44 | PARAMS(assign), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:427:2: note: in expansion of macro 'TP_fast_assign' 427 | TP_fast_assign( | ^~~~~~~~~~~~~~ include/trace/events/kmem.h:430:24: error: invalid use of undefined type 'struct mem_sampling_record' 430 | __entry->pid = record->context_id; | ^~ include/trace/perf.h:51:4: note: in definition of macro 'DECLARE_EVENT_CLASS' 51 | { assign; } \ | ^~~~~~ include/trace/trace_events.h:44:9: note: in expansion of macro 'PARAMS' 44 | PARAMS(assign), \ | ^~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ include/trace/events/kmem.h:427:2: note: in expansion of macro 'TP_fast_assign' 427 | TP_fast_assign( | ^~~~~~~~~~~~~~ include/trace/events/kmem.h: In function 'perf_test_probe_mm_spe_record': include/trace/perf.h:67:35: error: passing argument 1 of 'check_trace_callback_type_mm_spe_record' from incompatible pointer type [-Werror=incompatible-pointer-types] 67 | check_trace_callback_type_##call(perf_trace_##template); \ | ^~~~~~~~~~~ | | | void (*)(void *, struct mem_sampling_record *) include/trace/trace_events.h:46:2: note: in expansion of macro 'DEFINE_EVENT' 46 | DEFINE_EVENT(name, name, PARAMS(proto), PARAMS(args)); | ^~~~~~~~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ In file included from include/trace/events/kmem.h:9, from mm/slab_common.c:35: include/linux/tracepoint.h:287:42: note: expected 'void (*)(void *, struct mem_sampling_record *)' but argument is of type 'void (*)(void *, struct mem_sampling_record *)' 287 | check_trace_callback_type_##name(void (*cb)(data_proto)) \ | ~~~~~~~^~~~~~~~~~~~~~~ include/linux/tracepoint.h:432:2: note: in expansion of macro '__DECLARE_TRACE' 432 | __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \ | ^~~~~~~~~~~~~~~ include/linux/tracepoint.h:566:2: note: in expansion of macro 'DECLARE_TRACE' 566 | DECLARE_TRACE(name, PARAMS(proto), PARAMS(args)) | ^~~~~~~~~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ In file included from include/trace/define_trace.h:102, from include/trace/events/kmem.h:441, from mm/slab_common.c:35: mm/slab_common.c: At top level: include/trace/trace_events.h:383:2: warning: 'perf_trace_mm_spe_record' used but never defined 383 | perf_trace_##call(void *__data, proto); | ^~~~~~~~~~~ include/trace/trace_events.h:468:1: note: in expansion of macro '_TRACE_PERF_PROTO' 468 | _TRACE_PERF_PROTO(call, PARAMS(proto)); \ | ^~~~~~~~~~~~~~~~~ include/trace/trace_events.h:40:2: note: in expansion of macro 'DECLARE_EVENT_CLASS' 40 | DECLARE_EVENT_CLASS(name, \ | ^~~~~~~~~~~~~~~~~~~ include/trace/events/kmem.h:416:1: note: in expansion of macro 'TRACE_EVENT' 416 | TRACE_EVENT(mm_spe_record, | ^~~~~~~~~~~ cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for RESCTRL_FS Depends on [n]: MISC_FILESYSTEMS [=n] && ARCH_HAS_CPU_RESCTRL [=y] Selected by [y]: - ARM64_MPAM [=y] vim +428 include/trace/events/kmem.h 388 389 TP_PROTO(struct mm_struct *mm, 390 int member), 391 392 TP_ARGS(mm, member), 393 394 TP_STRUCT__entry( 395 __field(unsigned int, mm_id) 396 __field(unsigned int, curr) 397 __field(int, member) 398 __field(long, size) 399 ), 400 401 TP_fast_assign( 402 __entry->mm_id = mm_ptr_to_hash(mm); 403 __entry->curr = !!(current->mm == mm); 404 __entry->member = member; 405 __entry->size = (mm_counter_sum_positive(mm, member) 406 << PAGE_SHIFT); 407 ), 408 409 TP_printk("mm_id=%u curr=%d type=%s size=%ldB", 410 __entry->mm_id, 411 __entry->curr, 412 __print_symbolic(__entry->member, TRACE_MM_PAGES), 413 __entry->size) 414 ); 415 #ifdef CONFIG_ARM_SPE_MEM_SAMPLING 416 TRACE_EVENT(mm_spe_record, 417 TP_PROTO(struct mem_sampling_record *record), 418 419 TP_ARGS(record), 420 421 TP_STRUCT__entry( 422 __field(u64, vaddr) 423 __field(u64, paddr) 424 __field(int, pid) 425 ), 426 427 TP_fast_assign( > 428 __entry->vaddr = record->virt_addr; 429 __entry->paddr = record->phys_addr; 430 __entry->pid = record->context_id; 431 432 ), 433 434 TP_printk("vaddr=%llu paddr=%llu pid=%d", 435 __entry->vaddr, __entry->paddr, __entry->pid) 436 ); 437 #endif /* CONFIG_ARM_SPE_MEM_SAMPLING */ 438 #endif /* _TRACE_KMEM_H */ 439 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] kernel/trace/trace_output.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 03 Jul '25

03 Jul '25

Hi Steven, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5536700e483b14a193ce40d6be90b95fb2d7532e commit: 31bf327231bb582ec7dca0490cc90c364b36e095 [1605/1605] tracing: Make sure trace_printk() can output as soon as it can be used config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507031719.pl3k7B4C-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507031719.pl3k7B4C-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507031719.pl3k7B4C-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/trace/trace_output.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] mm/vmacache.o: warning: objtool: missing symbol for section .text
by kernel test robot 03 Jul '25

03 Jul '25

Hi David, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5536700e483b14a193ce40d6be90b95fb2d7532e commit: ddbf369c0a33924f76d092985bd20d9310f43d7f [1605/1605] mm, vmacache: hash addresses based on pmd config: x86_64-buildonly-randconfig-2001-20250501 (https://download.01.org/0day-ci/archive/20250703/202507031600.pMMU65PM-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507031600.pMMU65PM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507031600.pMMU65PM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/vmacache.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] lib/prime_numbers.c:8:9: warning: 'bitmap_size' macro redefined
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26d81348fb134a6bffb49fd1b55d8842cbf6424d commit: 9e8111c56a2515c7634662d19c29fde636758a02 [1605/1605] bitmap: introduce generic optimized bitmap_size() config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507031536.p8mTTL5J-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507031536.p8mTTL5J-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507031536.p8mTTL5J-lkp@intel.com/ All warnings (new ones prefixed by >>): >> lib/prime_numbers.c:8:9: warning: 'bitmap_size' macro redefined [-Wmacro-redefined] 8 | #define bitmap_size(nbits) (BITS_TO_LONGS(nbits) * sizeof(unsigned long)) | ^ include/linux/bitmap.h:215:9: note: previous definition is here 215 | #define bitmap_size(nbits) (ALIGN(nbits, BITS_PER_LONG) / BITS_PER_BYTE) | ^ 1 warning generated. vim +/bitmap_size +8 lib/prime_numbers.c cf4a7207b1cb4a Chris Wilson 2016-12-22 7 cf4a7207b1cb4a Chris Wilson 2016-12-22 @8 #define bitmap_size(nbits) (BITS_TO_LONGS(nbits) * sizeof(unsigned long)) cf4a7207b1cb4a Chris Wilson 2016-12-22 9 :::::: The code at line 8 was first introduced by commit :::::: cf4a7207b1cb4a3c3fe3aa11a83c9d673722a7f5 lib: Add a simple prime number generator :::::: TO: Chris Wilson <chris(a)chris-wilson.co.uk> :::::: CC: Daniel Vetter <daniel.vetter(a)ffwll.ch> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 01/15] cpu/SMT: Provide a default topology_is_primary_thread()
by Qi Xi 03 Jul '25

03 Jul '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBZQQR ---------------------------------------------------------------------- Currently if architectures want to support HOTPLUG_SMT they need to provide a topology_is_primary_thread() telling the framework which thread in the SMT cannot offline. However arm64 doesn't have a restriction on which thread in the SMT cannot offline, a simplest choice is that just make 1st thread as the "primary" thread. So just make this as the default implementation in the framework and let architectures like x86 that have special primary thread to override this function (which they've already done). There's no need to provide a stub function if !CONFIG_SMP or !CONFIG_HOTPLUG_SMT. In such case the testing CPU is already the 1st CPU in the SMT so it's always the primary thread. Reviewed-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Reviewed-by: Pierre Gondois <pierre.gondois(a)arm.com> Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> Reviewed-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Hongye Lin <linhongye(a)h-partners.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/x86/include/asm/topology.h | 1 - arch/x86/kernel/smpboot.c | 1 + include/linux/topology.h | 24 ++++++++++++++++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h index 5b4f87329031..8bf8d5546e97 100644 --- a/arch/x86/include/asm/topology.h +++ b/arch/x86/include/asm/topology.h @@ -152,7 +152,6 @@ static inline int topology_phys_to_logical_die(unsigned int die, unsigned int cpu) { return 0; } static inline int topology_max_die_per_package(void) { return 1; } static inline int topology_max_smt_threads(void) { return 1; } -static inline bool topology_is_primary_thread(unsigned int cpu) { return true; } static inline bool topology_smt_supported(void) { return false; } #endif diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c index 5726a3c9623e..2c897ad8b014 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -284,6 +284,7 @@ bool topology_is_primary_thread(unsigned int cpu) { return apic_id_is_primary_thread(per_cpu(x86_cpu_to_apicid, cpu)); } +#define topology_is_primary_thread topology_is_primary_thread /** * topology_smt_supported - Check whether SMT is supported by the CPUs diff --git a/include/linux/topology.h b/include/linux/topology.h index 80d27d717631..3aa7a3ef6771 100644 --- a/include/linux/topology.h +++ b/include/linux/topology.h @@ -212,6 +212,30 @@ static inline const struct cpumask *cpu_smt_mask(int cpu) } #endif +#ifndef topology_is_primary_thread + +#define topology_is_primary_thread topology_is_primary_thread + +static inline bool topology_is_primary_thread(unsigned int cpu) +{ + /* + * When disabling SMT the primary thread of the SMT will remain + * enabled/active. Architectures do have a special primary thread + * (e.g. x86) needs to override this function. Otherwise can make + * the first thread in the SMT as the primary thread. + * + * The sibling cpumask of an offline CPU contains always the CPU + * itself for architectures using the implementation of + * CONFIG_GENERIC_ARCH_TOPOLOGY for building their topology. + * Other architectures not using CONFIG_GENERIC_ARCH_TOPOLOGY for + * building their topology have to check whether to use this default + * implementation or to override it. + */ + return cpu == cpumask_first(topology_sibling_cpumask(cpu)); +} + +#endif + static inline const struct cpumask *cpu_cpu_mask(int cpu) { return cpumask_of_node(cpu_to_node(cpu)); -- 2.33.0

2 15

[PATCH OLK-6.6] virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN
by Zheng Qixing 03 Jul '25

03 Jul '25

From: Zhongqiu Han <quic_zhonhan(a)quicinc.com> stable inclusion from stable-v6.6.93 commit b49b5132e4c7307599492aee1cdc6d89f7f2a7da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAHF CVE: CVE-2025-38048 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e2f925fe737576df2373931c95e1a2b66efdfef ] syzbot reports a data-race when accessing the event_triggered, here is the simplified stack when the issue occurred: ================================================================== BUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed write to 0xffff8881025bc452 of 1 bytes by task 3288 on cpu 0: virtqueue_enable_cb_delayed+0x42/0x3c0 drivers/virtio/virtio_ring.c:2653 start_xmit+0x230/0x1310 drivers/net/virtio_net.c:3264 __netdev_start_xmit include/linux/netdevice.h:5151 [inline] netdev_start_xmit include/linux/netdevice.h:5160 [inline] xmit_one net/core/dev.c:3800 [inline] read to 0xffff8881025bc452 of 1 bytes by interrupt on cpu 1: virtqueue_disable_cb_split drivers/virtio/virtio_ring.c:880 [inline] virtqueue_disable_cb+0x92/0x180 drivers/virtio/virtio_ring.c:2566 skb_xmit_done+0x5f/0x140 drivers/net/virtio_net.c:777 vring_interrupt+0x161/0x190 drivers/virtio/virtio_ring.c:2715 __handle_irq_event_percpu+0x95/0x490 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:193 [inline] value changed: 0x01 -> 0x00 ================================================================== When the data race occurs, the function virtqueue_enable_cb_delayed() sets event_triggered to false, and virtqueue_disable_cb_split/packed() reads it as false due to the race condition. Since event_triggered is an unreliable hint used for optimization, this should only cause the driver temporarily suggest that the device not send an interrupt notification when the event index is used. Fix this KCSAN reported data-race issue by explicitly tagging the access as data_racy. Reported-by: syzbot+efe683d57990864b8c8e(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67c7761a.050a0220.15b4b9.0018.GAE@google.com/ Signed-off-by: Zhongqiu Han <quic_zhonhan(a)quicinc.com> Message-Id: <20250312130412.3516307-1-quic_zhonhan(a)quicinc.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/virtio/virtio_ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c index 2b702392d20b..6a3f335e5fcd 100644 --- a/drivers/virtio/virtio_ring.c +++ b/drivers/virtio/virtio_ring.c @@ -2533,7 +2533,7 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq) struct vring_virtqueue *vq = to_vvq(_vq); if (vq->event_triggered) - vq->event_triggered = false; + data_race(vq->event_triggered = false); return vq->packed_ring ? virtqueue_enable_cb_delayed_packed(_vq) : virtqueue_enable_cb_delayed_split(_vq); -- 2.39.2

2 1

[PATCH OLK-6.6] dm: fix unconditional IO throttle caused by REQ_PREFLUSH
by Zheng Qixing 03 Jul '25

03 Jul '25

From: Jinliang Zheng <alexjlzheng(a)gmail.com> stable inclusion from stable-v6.6.93 commit 52aa28f7b1708d76e315d78b5ed397932a1a97c3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEX CVE: CVE-2025-38063 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 88f7f56d16f568f19e1a695af34a7f4a6ce537a6 ] When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC, which causes the flush_bio to be throttled by wbt_wait(). An example from v5.4, similar problem also exists in upstream: crash> bt 2091206 PID: 2091206 TASK: ffff2050df92a300 CPU: 109 COMMAND: "kworker/u260:0" #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8 #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4 #2 [ffff800084a2f880] schedule at ffff800040bfa4b4 #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4 #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0 #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254 #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38 #8 [ffff800084a2fa60] generic_make_request at ffff800040570138 #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4 #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs] #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs] #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs] #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs] #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs] #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs] #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08 #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc #18 [ffff800084a2fe70] kthread at ffff800040118de4 After commit 2def2845cc33 ("xfs: don't allow log IO to be throttled"), the metadata submitted by xlog_write_iclog() should not be throttled. But due to the existence of the dm layer, throttling flush_bio indirectly causes the metadata bio to be throttled. Fix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes wbt_should_throttle() return false to avoid wbt_wait(). Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Reviewed-by: Tianxiang Peng <txpeng(a)tencent.com> Reviewed-by: Hao Peng <flyingpeng(a)tencent.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/dm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index bb455dc38fbe..ffa469ececb9 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1538,14 +1538,18 @@ static void __send_empty_flush(struct clone_info *ci) { struct dm_table *t = ci->map; struct bio flush_bio; + blk_opf_t opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC; + + if ((ci->io->orig_bio->bi_opf & (REQ_IDLE | REQ_SYNC)) == + (REQ_IDLE | REQ_SYNC)) + opf |= REQ_IDLE; /* * Use an on-stack bio for this, it's safe since we don't * need to reference it after submit. It's just used as * the basis for the clone(s). */ - bio_init(&flush_bio, ci->io->md->disk->part0, NULL, 0, - REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC); + bio_init(&flush_bio, ci->io->md->disk->part0, NULL, 0, opf); ci->bio = &flush_bio; ci->sector_count = 0; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md: call __md_stop_writes in md_stop
by Zheng Qixing 03 Jul '25

03 Jul '25

From: Guoqing Jiang <guoqing.jiang(a)linux.dev> stable inclusion from stable-v4.19.257 commit 690b5c90fd2d81fd1d2b6110fa36783232f6dce2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG956 CVE: CVE-2022-49987 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 0dd84b319352bb8ba64752d4e45396d8b13e6018 upstream. From the link [1], we can see raid1d was running even after the path raid_dtr -> md_stop -> __md_stop. Let's stop write first in destructor to align with normal md-raid to fix the KASAN issue. [1]. https://lore.kernel.org/linux-raid/CAPhsuW5gc4AakdGNdF8ubpezAuDLFOYUO_sfMZc… Fixes: 48df498daf62 ("md: move bitmap_destroy to the beginning of __md_stop") Reported-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Signed-off-by: Song Liu <song(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/md.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/md/md.c b/drivers/md/md.c index b9748a0a0e30..73ac6e6fee35 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -6103,6 +6103,7 @@ void md_stop(struct mddev *mddev) /* stop the array and free an attached data structures. * This is called from dm-raid */ + __md_stop_writes(mddev); __md_stop(mddev); bioset_exit(&mddev->bio_set); bioset_exit(&mddev->sync_set); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md-raid10: fix KASAN warning
by Zheng Qixing 03 Jul '25

03 Jul '25

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.256 commit 7a6ccc8fa192fd357c2d5d4c6ce67c834a179e23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9PP CVE: CVE-2022-50211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit d17f744e883b2f8d13cca252d71cfe8ace346f7d upstream. There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is valid. BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10] Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682 CPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? raid10_remove_disk+0x61/0x2a0 [raid10] kasan_report+0xa8/0xe0 ? raid10_remove_disk+0x61/0x2a0 [raid10] raid10_remove_disk+0x61/0x2a0 [raid10] Buffer I/O error on dev dm-76, logical block 15344, async page read ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0 remove_and_add_spares+0x367/0x8a0 [md_mod] ? super_written+0x1c0/0x1c0 [md_mod] ? mutex_trylock+0xac/0x120 ? _raw_spin_lock+0x72/0xc0 ? _raw_spin_lock_bh+0xc0/0xc0 md_check_recovery+0x848/0x960 [md_mod] raid10d+0xcf/0x3360 [raid10] ? sched_clock_cpu+0x185/0x1a0 ? rb_erase+0x4d4/0x620 ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid10_sync_request+0x36c0/0x36c0 [raid10] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? _raw_spin_unlock_irq+0x11/0x24 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 124495: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 setup_conf+0x140/0x5c0 [raid10] raid10_run+0x4cd/0x740 [raid10] md_run+0x6f9/0x1300 [md_mod] raid_ctr+0x2531/0x4ac0 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 L __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff889108f3d200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff889108f3d200, ffff889108f3d300) The buggy address belongs to the physical page: page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=2) raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff889108f3d280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff889108f3d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff889108f3d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff889108f3d400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Song Liu <song(a)kernel.org> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid10.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 07d58e88eb7b..6ac9ea253f51 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1893,9 +1893,12 @@ static int raid10_remove_disk(struct mddev *mddev, struct md_rdev *rdev) int err = 0; int number = rdev->raid_disk; struct md_rdev **rdevp; - struct raid10_info *p = conf->mirrors + number; + struct raid10_info *p; print_conf(conf); + if (unlikely(number >= mddev->raid_disks)) + return 0; + p = conf->mirrors + number; if (rdev == p->rdev) rdevp = &p->rdev; else if (rdev == p->replacement) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header
by Zhang Changzhong 03 Jul '25

03 Jul '25

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.267 commit 55a253a6753a603e80b95932ca971ba514aa6ce7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BS7 CVE: CVE-2022-49862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1c075b192fe41030457cd4a5f7dea730412bca40 ] This is a follow-up for commit 974cb0e3e7c9 ("tipc: fix uninit-value in tipc_nl_compat_name_table_dump") where it should have type casted sizeof(..) to int to work when TLV_GET_DATA_LEN() returns a negative value. syzbot reported a call trace because of it: BUG: KMSAN: uninit-value in ... tipc_nl_compat_name_table_dump+0x841/0xea0 net/tipc/netlink_compat.c:934 __tipc_nl_compat_dumpit+0xab2/0x1320 net/tipc/netlink_compat.c:238 tipc_nl_compat_dumpit+0x991/0xb50 net/tipc/netlink_compat.c:321 tipc_nl_compat_recv+0xb6e/0x1640 net/tipc/netlink_compat.c:1324 genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] genl_rcv_msg+0x103f/0x1260 net/netlink/genetlink.c:792 netlink_rcv_skb+0x3a5/0x6c0 net/netlink/af_netlink.c:2501 genl_rcv+0x3c/0x50 net/netlink/genetlink.c:803 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] Reported-by: syzbot+e5dbaaa238680ce206ea(a)syzkaller.appspotmail.com Fixes: 974cb0e3e7c9 ("tipc: fix uninit-value in tipc_nl_compat_name_table_dump") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://lore.kernel.org/r/ccd6a7ea801b15aec092c3b532a883b4c5708695.16675949… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/tipc/netlink_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c index f8e1112..f0171d4 100644 --- a/net/tipc/netlink_compat.c +++ b/net/tipc/netlink_compat.c @@ -865,7 +865,7 @@ static int tipc_nl_compat_name_table_dump_header(struct tipc_nl_compat_msg *msg) }; ntq = (struct tipc_name_table_query *)TLV_DATA(msg->req); - if (TLV_GET_DATA_LEN(msg->req) < sizeof(struct tipc_name_table_query)) + if (TLV_GET_DATA_LEN(msg->req) < (int)sizeof(struct tipc_name_table_query)) return -EINVAL; depth = ntohl(ntq->depth); -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] net: mdio: fix undefined behavior in bit shift for __mdiobus_register
by Zhang Changzhong 03 Jul '25

03 Jul '25

From: Cui GaoSheng <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.265 commit a3fafc974be37319679f36dc4e7cca7db1e02973 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BVD CVE: CVE-2022-49907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40e4eb324c59e11fcb927aa46742d28aba6ecb8a ] Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0 fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> Fixes: 4fd5f812c23c ("phylib: allow incremental scanning of an mii bus") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://lore.kernel.org/r/20221031132645.168421-1-cuigaosheng1@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 60c732d..0f0cdb4 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -416,7 +416,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) bus->reset(bus); for (i = 0; i < PHY_MAX_ADDR; i++) { - if ((bus->phy_mask & (1 << i)) == 0) { + if ((bus->phy_mask & BIT(i)) == 0) { struct phy_device *phydev; phydev = mdiobus_scan(bus, i); -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] ipvs: fix WARNING in ip_vs_app_net_cleanup()
by Zhang Changzhong 03 Jul '25

03 Jul '25

From: Zhengchao Shao <shaozhengchao(a)huawei.com> stable inclusion from stable-v4.19.265 commit adc76740ccd52e4a1d910767cd1223e134a7078b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BRU CVE: CVE-2022-49917 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5663ed63adb9619c98ab7479aa4606fa9b7a548c ] During the initialization of ip_vs_app_net_init(), if file ip_vs_app fails to be created, the initialization is successful by default. Therefore, the ip_vs_app file doesn't be found during the remove in ip_vs_app_net_cleanup(). It will cause WRNING. The following is the stack information: name 'ip_vs_app' WARNING: CPU: 1 PID: 9 at fs/proc/generic.c:712 remove_proc_entry+0x389/0x460 Modules linked in: Workqueue: netns cleanup_net RIP: 0010:remove_proc_entry+0x389/0x460 Call Trace: <TASK> ops_exit_list+0x125/0x170 cleanup_net+0x4ea/0xb00 process_one_work+0x9bf/0x1710 worker_thread+0x665/0x1080 kthread+0x2e4/0x3a0 ret_from_fork+0x1f/0x30 </TASK> Fixes: 457c4cbc5a3d ("[NET]: Make /proc/net per network namespace") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Acked-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/netfilter/ipvs/ip_vs_app.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipvs/ip_vs_app.c b/net/netfilter/ipvs/ip_vs_app.c index 80759aa..21149f4 100644 --- a/net/netfilter/ipvs/ip_vs_app.c +++ b/net/netfilter/ipvs/ip_vs_app.c @@ -604,13 +604,19 @@ static const struct seq_operations ip_vs_app_seq_ops = { int __net_init ip_vs_app_net_init(struct netns_ipvs *ipvs) { INIT_LIST_HEAD(&ipvs->app_list); - proc_create_net("ip_vs_app", 0, ipvs->net->proc_net, &ip_vs_app_seq_ops, - sizeof(struct seq_net_private)); +#ifdef CONFIG_PROC_FS + if (!proc_create_net("ip_vs_app", 0, ipvs->net->proc_net, + &ip_vs_app_seq_ops, + sizeof(struct seq_net_private))) + return -ENOMEM; +#endif return 0; } void __net_exit ip_vs_app_net_cleanup(struct netns_ipvs *ipvs) { unregister_ip_vs_app(ipvs, NULL /* all */); +#ifdef CONFIG_PROC_FS remove_proc_entry("ip_vs_app", ipvs->net->proc_net); +#endif } -- 2.9.5

2 1

[PATCH OLK-5.10] nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
by Wang Zhaolong 03 Jul '25

03 Jul '25

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v6.16-rc3 commit e8d6f3ab59468e230f3253efe5cb63efa35289f7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJTYD Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed. Later, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning is logged as the directory is not empty. Let's handle the error of nfs_fs_proc_net_init() properly. [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> [1]: remove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs' WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Modules linked in: CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00 RSP: 0018:ffffc90003637b08 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8 RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001 RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00 R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000 FS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253 setup_net+0x2e1/0x510 net/core/net_namespace.c:457 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121 __do_sys_unshare kernel/fork.c:3192 [inline] __se_sys_unshare kernel/fork.c:3190 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa1a6b8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff3a090368 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fa1a6db5fa0 RCX: 00007fa1a6b8e929 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 RBP: 00007fa1a6c10b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa1a6db5fa0 R14: 00007fa1a6db5fa0 R15: 0000000000000001 </TASK> Fixes: d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") Reported-by: syzbot+a4cc4ac22daa4a71b87c(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a4cc4ac22daa4a71b87c Tested-by: syzbot+a4cc4ac22daa4a71b87c(a)syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/nfs/inode.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index 22d425f21087..628b1a87caf3 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -2226,19 +2226,30 @@ unsigned int nfs_net_id; EXPORT_SYMBOL_GPL(nfs_net_id); static int nfs_net_init(struct net *net) { struct nfs_net *nn = net_generic(net, nfs_net_id); + int err; nfs_clients_init(net); if (!rpc_proc_register(net, &nn->rpcstats)) { - nfs_clients_exit(net); - return -ENOMEM; + err = -ENOMEM; + goto err_proc_rpc; } - return nfs_fs_proc_net_init(net); + err = nfs_fs_proc_net_init(net); + if (err) + goto err_proc_nfs; + + return 0; + +err_proc_nfs: + rpc_proc_unregister(net, "nfs"); +err_proc_rpc: + nfs_clients_exit(net); + return err; } static void nfs_net_exit(struct net *net) { rpc_proc_unregister(net, "nfs"); -- 2.34.3

2 1

[PATCH OLK-6.6] nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
by Wang Zhaolong 03 Jul '25

03 Jul '25

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v6.16-rc3 commit e8d6f3ab59468e230f3253efe5cb63efa35289f7 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJTYD Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() fails, /proc/net/rpc/nfs is not removed. Later, rpc_proc_exit() tries to remove /proc/net/rpc, and the warning is logged as the directory is not empty. Let's handle the error of nfs_fs_proc_net_init() properly. [0]: FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) should_fail_ex (lib/fault-inject.c:73 lib/fault-inject.c:174) should_failslab (mm/failslab.c:46) kmem_cache_alloc_noprof (mm/slub.c:4178 mm/slub.c:4204) __proc_create (fs/proc/generic.c:427) proc_create_reg (fs/proc/generic.c:554) proc_create_net_data (fs/proc/proc_net.c:120) nfs_fs_proc_net_init (fs/nfs/client.c:1409) nfs_net_init (fs/nfs/inode.c:2600) ops_init (net/core/net_namespace.c:138) setup_net (net/core/net_namespace.c:443) copy_net_ns (net/core/net_namespace.c:576) create_new_namespaces (kernel/nsproxy.c:110) unshare_nsproxy_namespaces (kernel/nsproxy.c:218 (discriminator 4)) ksys_unshare (kernel/fork.c:3123) __x64_sys_unshare (kernel/fork.c:3190) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> [1]: remove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs' WARNING: CPU: 1 PID: 6120 at fs/proc/generic.c:727 remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Modules linked in: CPU: 1 UID: 0 PID: 6120 Comm: syz.2.27 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:remove_proc_entry+0x45e/0x530 fs/proc/generic.c:727 Code: 3c 02 00 0f 85 85 00 00 00 48 8b 93 d8 00 00 00 4d 89 f0 4c 89 e9 48 c7 c6 40 ba a2 8b 48 c7 c7 60 b9 a2 8b e8 33 81 1d ff 90 <0f> 0b 90 90 e9 5f fe ff ff e8 04 69 5e ff 90 48 b8 00 00 00 00 00 RSP: 0018:ffffc90003637b08 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88805f534140 RCX: ffffffff817a92c8 RDX: ffff88807da99e00 RSI: ffffffff817a92d5 RDI: 0000000000000001 RBP: ffff888033431ac0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff888033431a00 R13: ffff888033431ae4 R14: ffff888033184724 R15: dffffc0000000000 FS: 0000555580328500(0000) GS:ffff888124a62000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f71733743e0 CR3: 000000007f618000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sunrpc_exit_net+0x46/0x90 net/sunrpc/sunrpc_syms.c:76 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x2eb/0xab0 net/core/net_namespace.c:253 setup_net+0x2e1/0x510 net/core/net_namespace.c:457 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:574 create_new_namespaces+0x3ea/0xa90 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:218 ksys_unshare+0x45b/0xa40 kernel/fork.c:3121 __do_sys_unshare kernel/fork.c:3192 [inline] __se_sys_unshare kernel/fork.c:3190 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3190 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x490 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa1a6b8e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff3a090368 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fa1a6db5fa0 RCX: 00007fa1a6b8e929 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080 RBP: 00007fa1a6c10b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa1a6db5fa0 R14: 00007fa1a6db5fa0 R15: 0000000000000001 </TASK> Fixes: d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") Reported-by: syzbot+a4cc4ac22daa4a71b87c(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a4cc4ac22daa4a71b87c Tested-by: syzbot+a4cc4ac22daa4a71b87c(a)syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/nfs/inode.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index db917dd2a6a7..01d26beb3418 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -2442,19 +2442,30 @@ unsigned int nfs_net_id; EXPORT_SYMBOL_GPL(nfs_net_id); static int nfs_net_init(struct net *net) { struct nfs_net *nn = net_generic(net, nfs_net_id); + int err; nfs_clients_init(net); if (!rpc_proc_register(net, &nn->rpcstats)) { - nfs_clients_exit(net); - return -ENOMEM; + err = -ENOMEM; + goto err_proc_rpc; } - return nfs_fs_proc_net_init(net); + err = nfs_fs_proc_net_init(net); + if (err) + goto err_proc_nfs; + + return 0; + +err_proc_nfs: + rpc_proc_unregister(net, "nfs"); +err_proc_rpc: + nfs_clients_exit(net); + return err; } static void nfs_net_exit(struct net *net) { rpc_proc_unregister(net, "nfs"); -- 2.34.3

2 1

[PATCH OLK-6.6 v2 0/2] support enable pci sriov concurrently
by Xiongfeng Wang 03 Jul '25

03 Jul '25

Jialin Zhang (2): PCI/IOV: Add pci_sriov_numvfs_lock to support enable pci sriov concurrently PCI/IOV: Improve performance of creating VFs concurrently drivers/pci/iov.c | 40 +++++++++++++++++++++++++++++++++++----- include/linux/pci.h | 8 ++++++++ 2 files changed, 43 insertions(+), 5 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-1.0-LTS] PM: hibernate: defer device probing when resuming from hibernation
by Zeng Heng 03 Jul '25

03 Jul '25

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v4.19.256 commit 5a283b59bce72c05c60e9f0fa92a28b5b850d8bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9OR CVE: CVE-2022-50202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------------------------------- syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count variable. Currently wait_for_device_probe() from snapshot_open() from misc_open() can sleep forever with misc_mtx held if probe_count cannot become 0. When a device is probed by hub_event() work function, probe_count is incremented before the probe function starts, and probe_count is decremented after the probe function completed. There are three cases that can prevent probe_count from dropping to 0. (a) A device being probed stopped responding (i.e. broken/malicious hardware). (b) A process emulating a USB device using /dev/raw-gadget interface stopped responding for some reason. (c) New device probe requests keeps coming in before existing device probe requests complete. The phenomenon syzbot is reporting is (b). A process which is holding system_transition_mutex and misc_mtx is waiting for probe_count to become 0 inside wait_for_device_probe(), but the probe function which is called from hub_event() work function is waiting for the processes which are blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface. This patch mitigates (b) by deferring wait_for_device_probe() from snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that the possibility of (b) remains as long as any thread which is emulating a USB device via /dev/raw-gadget interface can be blocked by uninterruptible blocking operations (e.g. mutex_lock()). Please also note that (a) and (c) are not addressed. Regarding (c), we should change the code to wait for only one device which contains the image for resuming from hibernation. I don't know how to address (a), for use of timeout for wait_for_device_probe() might result in loss of user data in the image. Maybe we should require the userland to wait for the image device before opening /dev/snapshot interface. Link: https://syzkaller.appspot.com/bug?extid=358c9ab4c93da7b7238c [1] Reported-by: syzbot <syzbot+358c9ab4c93da7b7238c(a)syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+358c9ab4c93da7b7238c(a)syzkaller.appspotmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: kernel/power/user.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- kernel/power/user.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kernel/power/user.c b/kernel/power/user.c index 2d8b60a3c86b..6a11154b3d52 100644 --- a/kernel/power/user.c +++ b/kernel/power/user.c @@ -29,6 +29,7 @@ #include "power.h" +static bool need_wait; #define SNAPSHOT_MINOR 231 @@ -82,7 +83,7 @@ static int snapshot_open(struct inode *inode, struct file *filp) * Resuming. We may need to wait for the image device to * appear. */ - wait_for_device_probe(); + need_wait = true; data->swap = -1; data->mode = O_WRONLY; @@ -174,6 +175,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, ssize_t res; loff_t pg_offp = *offp & ~PAGE_MASK; + if (need_wait) { + wait_for_device_probe(); + need_wait = false; + } + lock_system_sleep(); data = filp->private_data; @@ -209,6 +215,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd, loff_t size; sector_t offset; + if (need_wait) { + wait_for_device_probe(); + need_wait = false; + } + if (_IOC_TYPE(cmd) != SNAPSHOT_IOC_MAGIC) return -ENOTTY; if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR) -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] kernel/cgroup/cgroup.c:2240: warning: Excess function parameter 'lock_threadgroup' description in 'cgroup_attach_lock'
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 26d81348fb134a6bffb49fd1b55d8842cbf6424d commit: 4924308a1ca9cc2f791398836a8744c22078ffbd [1605/1605] cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507031346.HRMtINKf-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507031346.HRMtINKf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507031346.HRMtINKf-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/cgroup/cgroup.c:2240: warning: Excess function parameter 'lock_threadgroup' description in 'cgroup_attach_lock' >> kernel/cgroup/cgroup.c:2250: warning: Excess function parameter 'lock_threadgroup' description in 'cgroup_attach_unlock' vim +2240 kernel/cgroup/cgroup.c 2215 2216 /** 2217 * cgroup_attach_lock - Lock for ->attach() 2218 * @lock_threadgroup: whether to down_write cgroup_threadgroup_rwsem 2219 * 2220 * cgroup migration sometimes needs to stabilize threadgroups against forks and 2221 * exits by write-locking cgroup_threadgroup_rwsem. However, some ->attach() 2222 * implementations (e.g. cpuset), also need to disable CPU hotplug. 2223 * Unfortunately, letting ->attach() operations acquire cpus_read_lock() can 2224 * lead to deadlocks. 2225 * 2226 * Bringing up a CPU may involve creating and destroying tasks which requires 2227 * read-locking threadgroup_rwsem, so threadgroup_rwsem nests inside 2228 * cpus_read_lock(). If we call an ->attach() which acquires the cpus lock while 2229 * write-locking threadgroup_rwsem, the locking order is reversed and we end up 2230 * waiting for an on-going CPU hotplug operation which in turn is waiting for 2231 * the threadgroup_rwsem to be released to create new tasks. For more details: 2232 * 2233 * http://lkml.kernel.org/r/20220711174629.uehfmqegcwn2lqzu@wubuntu 2234 * 2235 * Resolve the situation by always acquiring cpus_read_lock() before optionally 2236 * write-locking cgroup_threadgroup_rwsem. This allows ->attach() to assume that 2237 * CPU hotplug is disabled on entry. 2238 */ 2239 static void cgroup_attach_lock(void) > 2240 { 2241 cpus_read_lock(); 2242 percpu_down_write(&cgroup_threadgroup_rwsem); 2243 } 2244 2245 /** 2246 * cgroup_attach_unlock - Undo cgroup_attach_lock() 2247 * @lock_threadgroup: whether to up_write cgroup_threadgroup_rwsem 2248 */ 2249 static void cgroup_attach_unlock(void) > 2250 { 2251 percpu_up_write(&cgroup_threadgroup_rwsem); 2252 cpus_read_unlock(); 2253 } 2254 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v2] irqchip/gic-v3: Fix xint sleeping function called from invalid context
by Jinjie Ruan 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICEDX1 ------------------ disable_irq() and debugfs_create_symlink() might sleep, local_irq_disable() will mask IRQS on current PE. Because sleep is not allowed when interrupts are disabled, the following bug occurs. So move them out of local_irq_disable/enable() to fix it. BUG: sleeping function called from invalid context at kernel/irq/manage.c:737 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1033, name: bash preempt_count: 0, expected: 0 CPU: 1 PID: 1033 Comm: bash Not tainted 6.6.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0xf8/0x290 show_stack+0x3c/0x70 dump_stack_lvl+0x1a8/0x2e8 dump_stack+0x34/0x50 __might_resched+0x31c/0x5f8 __might_sleep+0xc8/0x1d8 disable_irq+0x48/0xb8 xint_proc_write+0x1b0/0x3f8 proc_reg_write+0x218/0x348 vfs_write+0x244/0xfd0 ksys_write+0x11c/0x290 __arm64_sys_write+0x8c/0xd8 invoke_syscall+0xb4/0x300 el0_svc_common.constprop.0+0x1f8/0x310 do_el0_svc+0x5c/0x88 el0_svc+0x44/0x200 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3b8/0x3c0 BUG: sleeping function called from invalid context at mm/slab.h:494 in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 414, name: bash CPU: 0 PID: 414 Comm: bash Tainted: G W 5.10.0-00033-gee505d161ada #4 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x430 show_stack+0x34/0x4c dump_stack+0x1d0/0x248 ___might_sleep+0x15c/0x1bc __might_sleep+0x7c/0x114 __kmalloc_track_caller+0x198/0x87c kstrdup+0x134/0x1d0 debugfs_create_symlink+0x3c/0x250 xint_add_debugfs_entry+0xd4/0x140 xint_transform+0x1f4/0x210 xint_proc_write+0x26c/0x344 proc_reg_write+0x184/0x210 vfs_write+0x17c/0x634 ksys_write+0x104/0x230 __arm64_sys_write+0x54/0x80 invoke_syscall+0x84/0x230 el0_xcall_common.constprop.0+0x1ec/0x204 do_el0_xcall+0x98/0x18c el0_xcall_handler+0x24/0x3c el0_sync+0x17c/0x194 Fixes: 63f9ef213a47 ("arm64: Add debugfs dir for xint") Fixes: 3053668e6b21 ("arm64: Introduce Xint software solution") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index 5686ca0b960c..b91ff6a8b8e9 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -1030,11 +1030,9 @@ static bool xint_transform(int irqno, enum xint_op op) switch (op) { case IRQ_TO_XINT: set_bit(hwirq, irqnr_xint_map); - xint_add_debugfs_entry(irqno); return true; case XINT_TO_IRQ: clear_bit(hwirq, irqnr_xint_map); - xint_remove_debugfs_entry(irqno); return false; case XINT_SET_CHECK: return test_bit(hwirq, irqnr_xint_map); @@ -1049,6 +1047,7 @@ static ssize_t xint_proc_write(struct file *file, const char __user *buffer, size_t count, loff_t *pos) { int irq = (int)(long)pde_data(file_inode(file)); + enum xint_op switch_type; bool xint_state = false; unsigned long val; char *buf = NULL; @@ -1071,13 +1070,21 @@ static ssize_t xint_proc_write(struct file *file, return -EBUSY; } - local_irq_disable(); + if (xint_state) { + switch_type = XINT_TO_IRQ; + xint_remove_debugfs_entry(irq); + } else { + switch_type = IRQ_TO_XINT; + xint_add_debugfs_entry(irq); + } + disable_irq(irq); + local_irq_disable(); - xint_transform(irq, xint_state ? XINT_TO_IRQ : IRQ_TO_XINT); + xint_transform(irq, switch_type); - enable_irq(irq); local_irq_enable(); + enable_irq(irq); kfree(buf); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] support enable pci sriov concurrently
by Xiongfeng Wang 03 Jul '25

03 Jul '25

Jialin Zhang (2): PCI/IOV: Add pci_sriov_numvfs_lock to support enable pci sriov concurrently PCI/IOV: Improve performance of creating VFs concurrently drivers/pci/iov.c | 40 +++++++++++++++++++++++++++++++++++----- include/linux/pci.h | 8 ++++++++ 2 files changed, 43 insertions(+), 5 deletions(-) -- 2.20.1

2 3

[openeuler:openEuler-1.0-LTS 1605/1605] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool'
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: fc7fe8d28044724c4f29058aeb93f2e492585380 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1605/1605] dhugetlb: backport dynamic hugetlb feature config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507031140.U5GKFBc9-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507031140.U5GKFBc9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507031140.U5GKFBc9-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ mm/hugetlb.c:1370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ | static In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 2 warnings generated. vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: tunnels: annotate lockless accesses to dev->needed_headroom
by Wang Liang 03 Jul '25

03 Jul '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v4.19.279 commit 51f3bd3765bc5ca4583af07a00833da00d2ace1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5DCE CVE: CVE-2023-53109 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4b397c06cb987935b1b097336532aa6b4210e091 ] IP tunnels can apparently update dev->needed_headroom in their xmit path. This patch takes care of three tunnels xmit, and also the core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA() helpers. More changes might be needed for completeness. BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1: ip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 write to 0xffff88815b9da0ec of 2 bytes by task 2379 on cpu 0: ip_tunnel_xmit+0x1294/0x1730 net/ipv4/ip_tunnel.c:804 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip6_finish_output2+0x9bc/0xc50 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x39a/0x4e0 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0xeb/0x220 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:444 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] mld_sendpack+0x438/0x6a0 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x519/0x7b0 net/ipv6/mcast.c:2653 process_one_work+0x3e6/0x750 kernel/workqueue.c:2390 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2537 kthread+0x1ac/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 value changed: 0x0dd4 -> 0x0e14 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 2379 Comm: kworker/0:0 Not tainted 6.3.0-rc1-syzkaller-00002-g8ca09d5fa354-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Workqueue: mld mld_ifc_work Fixes: 8eb30be0352d ("ipv6: Create ip6_tnl_xmit") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20230310191109.2384387-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/ipv4/ip_tunnel.c [conflicts due to merged mainline 5ae1e9922bbd ("net: ip_tunnel: prevent perpetual headroom growth")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/linux/netdevice.h | 6 ++++-- net/ipv6/ip6_tunnel.c | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index dfddf928a16b..a5089c3fe9e6 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -294,9 +294,11 @@ struct hh_cache { * relationship HH alignment <= LL alignment. */ #define LL_RESERVED_SPACE(dev) \ - ((((dev)->hard_header_len+(dev)->needed_headroom)&~(HH_DATA_MOD - 1)) + HH_DATA_MOD) + ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom)) \ + & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD) #define LL_RESERVED_SPACE_EXTRA(dev,extra) \ - ((((dev)->hard_header_len+(dev)->needed_headroom+(extra))&~(HH_DATA_MOD - 1)) + HH_DATA_MOD) + ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom) + (extra)) \ + & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD) struct header_ops { int (*create) (struct sk_buff *skb, struct net_device *dev, diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 69792012da3d..cd32d859e4da 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1221,8 +1221,8 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, */ max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr) + dst->header_len + t->hlen; - if (max_headroom > dev->needed_headroom) - dev->needed_headroom = max_headroom; + if (max_headroom > READ_ONCE(dev->needed_headroom)) + WRITE_ONCE(dev->needed_headroom, max_headroom); err = ip6_tnl_encap(skb, t, &proto, fl6); if (err) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net: atlantic: fix aq_vec index out of range error
by Wang Liang 03 Jul '25

03 Jul '25

From: "Chia-Lin Kao (AceLan)" <acelan.kao(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 2ba5e47fb75fbb8fab45f5c1bc8d5c33d8834bd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGA4Q CVE: CVE-2022-50066 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The final update statement of the for loop exceeds the array range, the dereference of self->aq_vec[i] is not checked and then leads to the index out of range error. Also fixed this kind of coding style in other for loop. [ 97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48 [ 97.937607] index 8 is out of range for type 'aq_vec_s *[8]' [ 97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2 [ 97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022 [ 97.937611] Workqueue: events_unbound async_run_entry_fn [ 97.937616] Call Trace: [ 97.937617] <TASK> [ 97.937619] dump_stack_lvl+0x49/0x63 [ 97.937624] dump_stack+0x10/0x16 [ 97.937626] ubsan_epilogue+0x9/0x3f [ 97.937627] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 97.937629] ? __scm_send+0x348/0x440 [ 97.937632] ? aq_vec_stop+0x72/0x80 [atlantic] [ 97.937639] aq_nic_stop+0x1b6/0x1c0 [atlantic] [ 97.937644] aq_suspend_common+0x88/0x90 [atlantic] [ 97.937648] aq_pm_suspend_poweroff+0xe/0x20 [atlantic] [ 97.937653] pci_pm_suspend+0x7e/0x1a0 [ 97.937655] ? pci_pm_suspend_noirq+0x2b0/0x2b0 [ 97.937657] dpm_run_callback+0x54/0x190 [ 97.937660] __device_suspend+0x14c/0x4d0 [ 97.937661] async_suspend+0x23/0x70 [ 97.937663] async_run_entry_fn+0x33/0x120 [ 97.937664] process_one_work+0x21f/0x3f0 [ 97.937666] worker_thread+0x4a/0x3c0 [ 97.937668] ? process_one_work+0x3f0/0x3f0 [ 97.937669] kthread+0xf0/0x120 [ 97.937671] ? kthread_complete_and_exit+0x20/0x20 [ 97.937672] ret_from_fork+0x22/0x30 [ 97.937676] </TASK> v2. fixed "warning: variable 'aq_vec' set but not used" v3. simplified a for loop Fixes: 97bde5c4f909 ("net: ethernet: aquantia: Support for NIC-specific code") Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> Acked-by: Sudarsana Reddy Kalluru <skalluru(a)marvell.com> Link: https://lore.kernel.org/r/20220808081845.42005-1-acelan.kao@canonical.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/aquantia/atlantic/aq_nic.c [conflicts due to not merge 04a1839950d9 ("net: aquantia: implement data PTP datapath"), conflicts due to not merge 4272ba8b11f8 ("net: atlantic: per-TC queue statistics")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- .../net/ethernet/aquantia/atlantic/aq_nic.c | 22 ++++++++----------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c index 8cc34b0bedc3..a29a4f804448 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c @@ -181,12 +181,10 @@ static void aq_nic_service_timer_cb(struct timer_list *t) static void aq_nic_polling_timer_cb(struct timer_list *t) { struct aq_nic_s *self = from_timer(self, t, polling_timer); - struct aq_vec_s *aq_vec = NULL; unsigned int i = 0U; - for (i = 0U, aq_vec = self->aq_vec[0]; - self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) - aq_vec_isr(i, (void *)aq_vec); + for (i = 0U; self->aq_vecs > i; ++i) + aq_vec_isr(i, (void *)self->aq_vec[i]); mod_timer(&self->polling_timer, jiffies + AQ_CFG_POLLING_TIMER_INTERVAL); @@ -643,7 +641,6 @@ void aq_nic_get_stats(struct aq_nic_s *self, u64 *data) { unsigned int i = 0U; unsigned int count = 0U; - struct aq_vec_s *aq_vec = NULL; struct aq_stats_s *stats = self->aq_hw_ops->hw_get_hw_stats(self->aq_hw); if (!stats) @@ -676,10 +673,11 @@ void aq_nic_get_stats(struct aq_nic_s *self, u64 *data) data += i; - for (i = 0U, aq_vec = self->aq_vec[0]; - aq_vec && self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) { + for (i = 0U; self->aq_vecs > i; ++i) { + if (!self->aq_vec[i]) + break; data += count; - aq_vec_get_sw_stats(aq_vec, data, &count); + aq_vec_get_sw_stats(self->aq_vec[i], data, &count); } err_exit:; @@ -855,7 +853,6 @@ u32 aq_nic_get_fw_version(struct aq_nic_s *self) int aq_nic_stop(struct aq_nic_s *self) { - struct aq_vec_s *aq_vec = NULL; unsigned int i = 0U; netif_tx_disable(self->ndev); @@ -870,9 +867,8 @@ int aq_nic_stop(struct aq_nic_s *self) else aq_pci_func_free_irqs(self); - for (i = 0U, aq_vec = self->aq_vec[0]; - self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) - aq_vec_stop(aq_vec); + for (i = 0U; self->aq_vecs > i; ++i) + aq_vec_stop(self->aq_vec[i]); return self->aq_hw_ops->hw_stop(self->aq_hw); } @@ -974,4 +970,4 @@ void aq_nic_shutdown(struct aq_nic_s *self) err_exit: rtnl_unlock(); -} \ No newline at end of file +} -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] Backport mainline patches
by Wang Liang 03 Jul '25

03 Jul '25

Florian Westphal (4): xfrm: pass struct net to xfrm_decode_session wrappers xfrm: move mark and oif flowi decode into common code xfrm: policy: replace session decode with flow dissector xfrm: policy: fix layer 4 flowi decoding Guillaume Nault (1): xfrm: Clear low order bits of ->flowi4_tos in decode_session4(). include/net/xfrm.h | 12 +- net/ipv4/icmp.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/netfilter.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/netfilter.c | 2 +- net/netfilter/nf_nat_proto.c | 2 +- net/xfrm/xfrm_interface_core.c | 4 +- net/xfrm/xfrm_policy.c | 299 ++++++++++++++------------------- 10 files changed, 142 insertions(+), 191 deletions(-) -- 2.34.1

2 6

[openeuler:OLK-5.10 2999/2999] arch/x86/kernel/cpu/resctrl/rdtgroup.c:1504:13: warning: variable 'h' set but not used
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 63325b01e46c2933270cf6bdc0c0e859b664d6fe commit: 540e1ae2f7aca5a427a52f12bef657b1e3e81fc1 [2999/2999] x86/resctrl: Add interface to read mbm_total_bytes_config config: x86_64-buildonly-randconfig-2003-20250702 (https://download.01.org/0day-ci/archive/20250703/202507030942.l6gjiDwl-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030942.l6gjiDwl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030942.l6gjiDwl-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/cpu/resctrl/rdtgroup.c: In function 'rdt_last_cmd_printf': arch/x86/kernel/cpu/resctrl/rdtgroup.c:74:9: warning: function 'rdt_last_cmd_printf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 74 | seq_buf_vprintf(&last_cmd_status, fmt, ap); | ^~~~~~~~~~~~~~~ arch/x86/kernel/cpu/resctrl/rdtgroup.c: In function 'mon_event_config_read': >> arch/x86/kernel/cpu/resctrl/rdtgroup.c:1504:13: warning: variable 'h' set but not used [-Wunused-but-set-variable] 1504 | u32 h; | ^ vim +/h +1504 arch/x86/kernel/cpu/resctrl/rdtgroup.c 1499 1500 static void mon_event_config_read(void *info) 1501 { 1502 struct mon_config_info *mon_info = info; 1503 unsigned int index; > 1504 u32 h; 1505 1506 index = mon_event_config_index_get(mon_info->evtid); 1507 if (index == INVALID_CONFIG_INDEX) { 1508 pr_warn_once("Invalid event id %d\n", mon_info->evtid); 1509 return; 1510 } 1511 rdmsr(MSR_IA32_EVT_CFG_BASE + index, mon_info->mon_config, h); 1512 1513 /* Report only the valid event configuration bits */ 1514 mon_info->mon_config &= MAX_EVT_CONFIG_BITS; 1515 } 1516 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] nfs: handle failure of nfs_get_lock_context in unlock path
by Li Lingfeng 03 Jul '25

03 Jul '25

mainline inclusion from mainline-v6.15-rc7 commit c457dc1ec770a22636b473ce5d35614adfe97636 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAL9 CVE: CVE-2025-38023 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM) as valid and proceed to execute rpc_run_task(), this will trigger a NULL pointer dereference in nfs4_locku_prepare. For example: BUG: kernel NULL pointer dereference, address: 000000000000000c PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 Workqueue: rpciod rpc_async_schedule RIP: 0010:nfs4_locku_prepare+0x35/0xc2 Code: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3 RSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246 RAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: fffffffffffffff4 RDI: ffff9ba53fddbf40 RBP: ffff9ba539934000 R08: 0000000000000000 R09: ffffbbafc006bc38 R10: ffffffffb6b689c8 R11: 0000000000000003 R12: ffff9ba539934030 R13: 0000000000000001 R14: 0000000004248060 R15: ffffffffb56d1c30 FS: 0000000000000000(0000) GS:ffff9ba5881f0000(0000) knlGS:00000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 000000093f244000 CR4: 00000000000006f0 Call Trace: <TASK> __rpc_execute+0xbc/0x480 rpc_async_schedule+0x2f/0x40 process_one_work+0x232/0x5d0 worker_thread+0x1da/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x10d/0x240 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: CR2: 000000000000000c ---[ end trace 0000000000000000 ]--- Free the allocated nfs4_unlockdata when nfs_get_lock_context() fails and return NULL to terminate subsequent rpc_run_task, preventing NULL pointer dereference. Fixes: f30cb757f680 ("NFS: Always wait for I/O completion before unlock") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Link: https://lore.kernel.org/r/20250417072508.3850532-1-lilingfeng3@huawei.com Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/nfs/nfs4proc.c [Commit 32c6e7eee399 ("NFSv4: Handle NFS4ERR_OLD_STATEID in LOCKU") added a local variable state; commit 7b587e1a5a6c ("NFS: use locks_copy_lock() to copy locks.") initialized lock with locks_init_lock and locks_copy_lock instead of memcpy.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 282e5559b176..6d47a1922a1b 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6415,10 +6415,18 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, { struct nfs4_unlockdata *p; struct inode *inode = lsp->ls_state->inode; + struct nfs_lock_context *l_ctx; p = kzalloc(sizeof(*p), GFP_NOFS); if (p == NULL) return NULL; + l_ctx = nfs_get_lock_context(ctx); + if (!IS_ERR(l_ctx)) { + p->l_ctx = l_ctx; + } else { + kfree(p); + return NULL; + } p->arg.fh = NFS_FH(inode); p->arg.fl = &p->fl; p->arg.seqid = seqid; @@ -6427,7 +6435,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, refcount_inc(&lsp->ls_count); /* Ensure we don't close file until we're done freeing locks! */ p->ctx = get_nfs_open_context(ctx); - p->l_ctx = nfs_get_lock_context(ctx); memcpy(&p->fl, fl, sizeof(p->fl)); p->server = NFS_SERVER(inode); return p; -- 2.31.1

2 1

[PATCH OLK-5.10 0/4] Backport mainline patches
by Wang Liang 03 Jul '25

03 Jul '25

Eric Dumazet (2): net: add more sanity check in virtio_net_hdr_to_skb() net: test for not too small csum_start in virtio_net_hdr_to_skb() Wang Liang (2): net: fix crash when config small gso_max_size/gso_ipv4_max_size net: virtio: Fix kabi broken include/linux/virtio_net.h | 13 +++++++++++-- net/core/rtnetlink.c | 2 +- 2 files changed, 12 insertions(+), 3 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 03 Jul '25

03 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-50228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] arch/x86/mm/maccess.o: warning: objtool: missing symbol for section .text
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: 22058d2bdaf6b0526395ceec2736c72c3b5f435a [1605/1605] uaccess: Add strict non-pagefault kernel-space read function config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030925.ESXy0WXt-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030925.ESXy0WXt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030925.ESXy0WXt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/mm/maccess.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net: fix slab-use-after-free read in decode_session6
by Wang Liang 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRT1V CVE: NA ------------------ The skb->cb may be modified in qdisc enqueue() functions, like fq_enqueue and sfb_enqueue. So the cb field should not be visited as IP6CB() after qdisc dequeue(). However, decode_session6() visit IP6CB(skb). If qdisc enqueue() modify the cb field, IP6CB(skb)->nhoff may be also modified, which may trigger a KASAN issue. The stack information is as follows: dump_backtrace+0x12c/0x220 arch/arm64/kernel/stacktrace.c:233 show_stack+0x34/0x50 arch/arm64/kernel/stacktrace.c:240 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x80/0x118 lib/dump_stack.c:106 print_address_description.constprop.0+0x84/0x3c8 mm/kasan/report.c:364 print_report+0xb0/0x280 mm/kasan/report.c:475 kasan_report+0x84/0xd0 mm/kasan/report.c:588 __asan_report_load1_noabort+0x20/0x30 mm/kasan/report_generic.c:378 decode_session6+0xf74/0x1198 net/xfrm/xfrm_policy.c:3491 __xfrm_decode_session+0x78/0xf8 net/xfrm/xfrm_policy.c:3597 xfrm_decode_session_reverse include/net/xfrm.h:1257 [inline] icmpv6_route_lookup+0x30c/0x498 net/ipv6/icmp.c:392 icmp6_send+0x94c/0x1af8 net/ipv6/icmp.c:601 __icmpv6_send include/linux/icmpv6.h:28 [inline] icmpv6_send include/linux/icmpv6.h:49 [inline] ip6_link_failure+0x3c/0x1b0 net/ipv6/route.c:2791 dst_link_failure include/net/dst.h:447 [inline] ip6_tnl_xmit+0x3cc/0x2778 net/ipv6/ip6_tunnel.c:1283 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1399 [inline] ip6_tnl_start_xmit+0x774/0x1138 net/ipv6/ip6_tunnel.c:1447 __netdev_start_xmit include/linux/netdevice.h:4965 [inline] netdev_start_xmit include/linux/netdevice.h:4979 [inline] xmit_one.constprop.0+0x114/0x3c0 net/core/dev.c:3580 dev_hard_start_xmit+0xb0/0x180 net/core/dev.c:3596 sch_direct_xmit+0x17c/0x1088 net/sched/sch_generic.c:342 qdisc_restart net/sched/sch_generic.c:407 [inline] __qdisc_run+0x1a4/0x358 net/sched/sch_generic.c:415 __dev_xmit_skb net/core/dev.c:3886 [inline] __dev_queue_xmit+0x156c/0x3380 net/core/dev.c:4358 dev_queue_xmit include/linux/netdevice.h:3146 [inline] neigh_connected_output+0x2e8/0x3e0 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:553 [inline] ip6_finish_output2+0xb58/0x17b0 net/ipv6/ip6_output.c:141 ip6_fragment+0x1778/0x1d70 net/ipv6/ip6_output.c:962 __ip6_finish_output+0x61c/0x9f0 net/ipv6/ip6_output.c:206 ip6_finish_output+0x48/0x2d8 net/ipv6/ip6_output.c:219 NF_HOOK_COND include/linux/netfilter.h:297 [inline] ip6_output+0x1cc/0x3a0 net/ipv6/ip6_output.c:240 dst_output include/net/dst.h:468 [inline] ip6_local_out+0xa4/0xe0 net/ipv6/output_core.c:155 ip6_send_skb+0x88/0x1f0 net/ipv6/ip6_output.c:2038 udp_v6_send_skb+0xa7c/0x10b8 net/ipv6/udp.c:1295 udpv6_sendmsg+0x1b04/0x2320 net/ipv6/udp.c:1591 inet6_sendmsg+0xb0/0x110 net/ipv6/af_inet6.c:657 sock_sendmsg_nosec net/socket.c:734 [inline] __sock_sendmsg net/socket.c:749 [inline] __sock_sendmsg+0xc8/0x190 net/socket.c:744 sock_sendmsg+0x120/0x210 net/socket.c:772 splice_to_socket+0x8d8/0xc88 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0x100/0x1a0 fs/splice.c:1142 splice_direct_to_actor+0x300/0x898 fs/splice.c:1088 do_splice_direct+0x190/0x268 fs/splice.c:1194 do_sendfile+0xa50/0xf50 fs/read_write.c:1256 __do_sys_sendfile64 fs/read_write.c:1324 [inline] __se_sys_sendfile64+0x2e4/0x3a0 fs/read_write.c:1310 __arm64_sys_sendfile64+0x94/0xe0 fs/read_write.c:1310 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:134 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:176 el0_svc+0x44/0x1d8 arch/arm64/kernel/entry-common.c:806 el0t_64_sync_handler+0x100/0x130 arch/arm64/kernel/entry-common.c:844 el0t_64_sync+0x188/0x190 arch/arm64/kernel/entry.S:757 Therefore, set the cb field in the skb to 0 before xfrm decode process. Fixes: e5d25a90886d ("[IPV6] XFRM: Fix decoding session with preceding extension header(s).") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index d1f819238414..dc8d7ed637ef 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1227,6 +1227,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, t->err_time + IP6TUNNEL_ERR_TIMEO)) { t->err_count--; + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); dst_link_failure(skb); } else { t->err_count = 0; @@ -1302,6 +1303,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, return 0; tx_err_link_failure: stats->tx_carrier_errors++; + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); dst_link_failure(skb); tx_err_dst_release: dst_release(dst); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] drm/amd/display: clear optc underflow before turn off odm clock
by Lin Ruifeng 03 Jul '25

03 Jul '25

From: Fudong Wang <Fudong.Wang(a)amd.com> stable inclusion from stable-v4.19.257 commit 443687798d6f094412b7312b64b3bb4d99aedff7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9B8 CVE: CVE-2022-49969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b2a93490201300a749ad261b5c5d05cb50179c44 ] [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock off. [How] Clear that if have when clock off. Reviewed-by: Alvin Lee <alvin.lee2(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Fudong Wang <Fudong.Wang(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c index 411f89218e01..cb5c44b339e0 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c @@ -452,6 +452,11 @@ void optc1_enable_optc_clock(struct timing_generator *optc, bool enable) OTG_CLOCK_ON, 1, 1, 1000); } else { + + //last chance to clear underflow, otherwise, it will always there due to clock is off. + if (optc->funcs->is_optc_underflow_occurred(optc) == true) + optc->funcs->clear_optc_underflow(optc); + REG_UPDATE_2(OTG_CLOCK_CONTROL, OTG_CLOCK_GATE_DIS, 0, OTG_CLOCK_EN, 0); -- 2.22.0

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] net/ipv4/arp.c:1106:5: warning: comparison of distinct pointer types ('typeof (dev->addr_len) *' (aka 'unsigned char *') and 'typeof (sizeof (r->arp_ha.sa_data)) *' (aka 'unsigned long *'))
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: 7ad207616673722d5cf52c18d9464e0d3184ffc9 [1605/1605] arp: Prevent overflow in arp_req_get(). config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030748.cQODcYRb-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030748.cQODcYRb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030748.cQODcYRb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/ipv4/arp.c:1106:5: warning: comparison of distinct pointer types ('typeof (dev->addr_len) *' (aka 'unsigned char *') and 'typeof (sizeof (r->arp_ha.sa_data)) *' (aka 'unsigned long *')) [-Wcompare-distinct-pointer-types] 1106 | min(dev->addr_len, sizeof(r->arp_ha.sa_data))); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:884:19: note: expanded from macro 'min' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:875:24: note: expanded from macro '__careful_cmp' 875 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~~~~~~~ include/linux/kernel.h:865:4: note: expanded from macro '__safe_cmp' 865 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~~~~~~~ include/linux/kernel.h:851:29: note: expanded from macro '__typecheck' 851 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ 1 warning generated. net/ipv4/arp.o: warning: objtool: missing symbol for section .init.text vim +1106 net/ipv4/arp.c 1090 1091 /* 1092 * Get an ARP cache entry. 1093 */ 1094 1095 static int arp_req_get(struct arpreq *r, struct net_device *dev) 1096 { 1097 __be32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr; 1098 struct neighbour *neigh; 1099 int err = -ENXIO; 1100 1101 neigh = neigh_lookup(&arp_tbl, &ip, dev); 1102 if (neigh) { 1103 if (!(neigh->nud_state & NUD_NOARP)) { 1104 read_lock_bh(&neigh->lock); 1105 memcpy(r->arp_ha.sa_data, neigh->ha, > 1106 min(dev->addr_len, sizeof(r->arp_ha.sa_data))); 1107 r->arp_flags = arp_state_to_flags(neigh); 1108 read_unlock_bh(&neigh->lock); 1109 r->arp_ha.sa_family = dev->type; 1110 strlcpy(r->arp_dev, dev->name, sizeof(r->arp_dev)); 1111 err = 0; 1112 } 1113 neigh_release(neigh); 1114 } 1115 return err; 1116 } 1117 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] drivers/pwm/pwm-pca9685.c:173:21: warning: variable 'pwm' set but not used
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: 0e0a61eb0d758e7fd91a0543e7d12fc065df5b70 [1605/1605] pwm: Clear chip_data in pwm_put() config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030648.wv6Tc1L9-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030648.wv6Tc1L9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030648.wv6Tc1L9-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/pwm/pwm-pca9685.c:173:21: warning: variable 'pwm' set but not used [-Wunused-but-set-variable] 173 | struct pwm_device *pwm; | ^ 1 warning generated. vim +/pwm +173 drivers/pwm/pwm-pca9685.c bccec89f0a35f65 Mika Westerberg 2016-09-20 169 c40c461e1944b9c Sven Van Asbroeck 2017-04-13 170 static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset) c40c461e1944b9c Sven Van Asbroeck 2017-04-13 171 { c40c461e1944b9c Sven Van Asbroeck 2017-04-13 172 struct pca9685 *pca = gpiochip_get_data(gpio); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 @173 struct pwm_device *pwm; c40c461e1944b9c Sven Van Asbroeck 2017-04-13 174 c40c461e1944b9c Sven Van Asbroeck 2017-04-13 175 pca9685_pwm_gpio_set(gpio, offset, 0); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 176 pm_runtime_put(pca->chip.dev); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 177 mutex_lock(&pca->lock); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 178 pwm = &pca->chip.pwms[offset]; c40c461e1944b9c Sven Van Asbroeck 2017-04-13 179 mutex_unlock(&pca->lock); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 180 } c40c461e1944b9c Sven Van Asbroeck 2017-04-13 181 :::::: The code at line 173 was first introduced by commit :::::: c40c461e1944b9cfb520e04184ec1e5c80fb210b pwm: pca9685: Fix GPIO-only operation :::::: TO: Sven Van Asbroeck <thesven73(a)gmail.com> :::::: CC: Thierry Reding <thierry.reding(a)gmail.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 03 Jul '25

03 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> mainline inclusion from mainline-v4.19.258 commit 1668c38ef2e5bb80dbee88afcecfcdc3e7abc2aa category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9EE CVE: CVE-2022-49964 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
by Wupeng Ma 03 Jul '25

03 Jul '25

From: "Maciej S. Szmigiero" <maciej.szmigiero(a)oracle.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-50228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f17c31c48e5cde9895a491d91c424eeeada3e134 upstream. Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct for KVM internally generated injections). kernel BUG at arch/x86/kvm/svm/svm.c:3386! invalid opcode: 0000 [#1] SMP CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd] Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53 RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0 RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000 FS: 0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0 Call Trace: <TASK> inject_pending_event+0x2f7/0x4c0 [kvm] kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm] kvm_vcpu_ioctl+0x26d/0x650 [kvm] __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> Fixes: 219b65dcf6c0 ("KVM: SVM: Improve nested interrupt injection") Cc: stable(a)vger.kernel.org Co-developed-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> Message-Id: <35426af6e123cbe91ec7ce5132ce72521f02b1b5.1651440202.git.maciej.szmigiero(a)oracle.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/x86/kvm/svm.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 74b4c98c6607..e62bcdb0822e 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -5127,8 +5127,6 @@ static void svm_set_irq(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); - BUG_ON(!(gif_set(svm))); - trace_kvm_inj_virq(vcpu->arch.interrupt.nr); ++vcpu->stat.irq_injections; -- 2.43.0

2 1

[PATCH OLK-6.6 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 03 Jul '25

03 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

2 12

[PATCH OLK-5.10] mm/hugetlb: fix incorrect gfp flag for mempolicy MPOL_PREFERRED_MANY
by Wupeng Ma 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6I1Z2 -------------------------------- Commit 27a782f719fd ("mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY") bring mempolicy MPOL_PREFERRED_MANY for hugetlb, however the gfp flag is incorrect. Fix this. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202507020936.wpYnAMsn-lkp@intel.com/ Fixes: 27a782f719fd ("mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 967c97c42653..ec0ab09e1b56 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2223,7 +2223,7 @@ struct page *alloc_buddy_huge_page_with_mpol(struct hstate *h, gfp_t gfp = gfp_mask | __GFP_NOWARN; gfp &= ~(__GFP_DIRECT_RECLAIM | __GFP_NOFAIL); - page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); + page = alloc_surplus_huge_page(h, gfp, nid, nodemask); /* Fallback to all nodes if page==NULL */ nodemask = NULL; -- 2.43.0

2 1

[PATCH OLK-6.6 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 03 Jul '25

03 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

2 12

[PATCH OLK-6.6 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 03 Jul '25

03 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

2 13

[openeuler:openEuler-1.0-LTS 1605/1605] net/netfilter/nf_conntrack_core.c:1017: warning: Function parameter or member 'reply_hash' not described in 'nf_ct_resolve_clash'
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: cc12c927ac504e99fc176ea49e85226b6aeadcd5 [1605/1605] netfilter: conntrack: allow insertion of clashing entries config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030549.czVv179y-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030549.czVv179y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030549.czVv179y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/netfilter/nf_conntrack_core.c:1017: warning: Function parameter or member 'reply_hash' not described in 'nf_ct_resolve_clash' >> net/netfilter/nf_conntrack_core.c:1017: warning: Excess function parameter 'hash_reply' description in 'nf_ct_resolve_clash' vim +1017 net/netfilter/nf_conntrack_core.c cc12c927ac504e Florian Westphal 2023-11-02 980 6199b71796bcaa Florian Westphal 2023-11-02 981 /** 6199b71796bcaa Florian Westphal 2023-11-02 982 * nf_ct_resolve_clash - attempt to handle clash without packet drop 6199b71796bcaa Florian Westphal 2023-11-02 983 * 6199b71796bcaa Florian Westphal 2023-11-02 984 * @skb: skb that causes the clash 6199b71796bcaa Florian Westphal 2023-11-02 985 * @h: tuplehash of the clashing entry already in table cc12c927ac504e Florian Westphal 2023-11-02 986 * @hash_reply: hash slot for reply direction 6199b71796bcaa Florian Westphal 2023-11-02 987 * 6199b71796bcaa Florian Westphal 2023-11-02 988 * A conntrack entry can be inserted to the connection tracking table 6199b71796bcaa Florian Westphal 2023-11-02 989 * if there is no existing entry with an identical tuple. 6199b71796bcaa Florian Westphal 2023-11-02 990 * 6199b71796bcaa Florian Westphal 2023-11-02 991 * If there is one, @skb (and the assocated, unconfirmed conntrack) has 6199b71796bcaa Florian Westphal 2023-11-02 992 * to be dropped. In case @skb is retransmitted, next conntrack lookup 6199b71796bcaa Florian Westphal 2023-11-02 993 * will find the already-existing entry. 6199b71796bcaa Florian Westphal 2023-11-02 994 * 6199b71796bcaa Florian Westphal 2023-11-02 995 * The major problem with such packet drop is the extra delay added by 6199b71796bcaa Florian Westphal 2023-11-02 996 * the packet loss -- it will take some time for a retransmit to occur 6199b71796bcaa Florian Westphal 2023-11-02 997 * (or the sender to time out when waiting for a reply). 6199b71796bcaa Florian Westphal 2023-11-02 998 * 6199b71796bcaa Florian Westphal 2023-11-02 999 * This function attempts to handle the situation without packet drop. 6199b71796bcaa Florian Westphal 2023-11-02 1000 * 6199b71796bcaa Florian Westphal 2023-11-02 1001 * If @skb has no NAT transformation or if the colliding entries are 6199b71796bcaa Florian Westphal 2023-11-02 1002 * exactly the same, only the to-be-confirmed conntrack entry is discarded 6199b71796bcaa Florian Westphal 2023-11-02 1003 * and @skb is associated with the conntrack entry already in the table. 6199b71796bcaa Florian Westphal 2023-11-02 1004 * cc12c927ac504e Florian Westphal 2023-11-02 1005 * Failing that, the new, unconfirmed conntrack is still added to the table cc12c927ac504e Florian Westphal 2023-11-02 1006 * provided that the collision only occurs in the ORIGINAL direction. cc12c927ac504e Florian Westphal 2023-11-02 1007 * The new entry will be added after the existing one in the hash list, cc12c927ac504e Florian Westphal 2023-11-02 1008 * so packets in the ORIGINAL direction will continue to match the existing cc12c927ac504e Florian Westphal 2023-11-02 1009 * entry. The new entry will also have a fixed timeout so it expires -- cc12c927ac504e Florian Westphal 2023-11-02 1010 * due to the collision, it will not see bidirectional traffic. cc12c927ac504e Florian Westphal 2023-11-02 1011 * 6199b71796bcaa Florian Westphal 2023-11-02 1012 * Returns NF_DROP if the clash could not be resolved. 6199b71796bcaa Florian Westphal 2023-11-02 1013 */ 115dffa33ea6f5 Florian Westphal 2023-11-02 1014 static __cold noinline int cc12c927ac504e Florian Westphal 2023-11-02 1015 nf_ct_resolve_clash(struct sk_buff *skb, struct nf_conntrack_tuple_hash *h, cc12c927ac504e Florian Westphal 2023-11-02 1016 u32 reply_hash) 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 @1017 { 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1018 /* This is the conntrack entry already in hashes that won race. */ 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1019 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); b3480fe059ac91 Florian Westphal 2017-08-12 1020 const struct nf_conntrack_l4proto *l4proto; 6199b71796bcaa Florian Westphal 2023-11-02 1021 enum ip_conntrack_info ctinfo; 6199b71796bcaa Florian Westphal 2023-11-02 1022 struct nf_conn *loser_ct; 6199b71796bcaa Florian Westphal 2023-11-02 1023 struct net *net; 94ebb264459f97 Florian Westphal 2023-11-02 1024 int ret; 6199b71796bcaa Florian Westphal 2023-11-02 1025 6199b71796bcaa Florian Westphal 2023-11-02 1026 loser_ct = nf_ct_get(skb, &ctinfo); 94ebb264459f97 Florian Westphal 2023-11-02 1027 net = nf_ct_net(loser_ct); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1028 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1029 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); 6199b71796bcaa Florian Westphal 2023-11-02 1030 if (!l4proto->allow_clash) 6199b71796bcaa Florian Westphal 2023-11-02 1031 goto drop; 6199b71796bcaa Florian Westphal 2023-11-02 1032 94ebb264459f97 Florian Westphal 2023-11-02 1033 ret = __nf_ct_resolve_clash(skb, h); 94ebb264459f97 Florian Westphal 2023-11-02 1034 if (ret == NF_ACCEPT) 94ebb264459f97 Florian Westphal 2023-11-02 1035 return ret; 6199b71796bcaa Florian Westphal 2023-11-02 1036 cc12c927ac504e Florian Westphal 2023-11-02 1037 ret = nf_ct_resolve_clash_harder(skb, reply_hash); cc12c927ac504e Florian Westphal 2023-11-02 1038 if (ret == NF_ACCEPT) cc12c927ac504e Florian Westphal 2023-11-02 1039 return ret; cc12c927ac504e Florian Westphal 2023-11-02 1040 6199b71796bcaa Florian Westphal 2023-11-02 1041 drop: 94ebb264459f97 Florian Westphal 2023-11-02 1042 nf_ct_add_to_dying_list(loser_ct); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1043 NF_CT_STAT_INC(net, drop); 94ebb264459f97 Florian Westphal 2023-11-02 1044 NF_CT_STAT_INC(net, insert_failed); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1045 return NF_DROP; 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1046 } 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1047 :::::: The code at line 1017 was first introduced by commit :::::: 71d8c47fc653711c41bc3282e5b0e605b3727956 netfilter: conntrack: introduce clash resolution on insertion race :::::: TO: Pablo Neira Ayuso <pablo(a)netfilter.org> :::::: CC: Pablo Neira Ayuso <pablo(a)netfilter.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] OLK-6.6 Bperf
by Xiaomeng Zhang 03 Jul '25

03 Jul '25

Ian Rogers (1): perf test bpf-counters: Add test for BPF event modifier Tengda Wu (2): perf stat: Support inherit events during fork() for bperf perf test: Use sqrtloop workload to test bperf event Veronika Molnarova (1): perf test stat_bpf_counter.sh: Stabilize the test results Xiaomeng Zhang (2): perf stat: Increase perf_attr_map entries perf stat: Fix incorrect display of bperf when event count is 0 tools/lib/perf/include/perf/bpf_perf.h | 1 + tools/perf/builtin-stat.c | 1 + tools/perf/tests/shell/stat_bpf_counters.sh | 79 ++++++++++----- tools/perf/util/bpf_counter.c | 61 +++++++++--- tools/perf/util/bpf_skel/bperf_follower.bpf.c | 98 +++++++++++++++++-- tools/perf/util/bpf_skel/bperf_u.h | 5 + tools/perf/util/target.h | 1 + 7 files changed, 198 insertions(+), 48 deletions(-) -- 2.34.1

2 7

[openeuler:openEuler-1.0-LTS 1605/1605] fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 8f44df8094e0d4dcd28122eab732820e5c639ccd [1605/1605] net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030301.JSR1Dol1-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030301.JSR1Dol1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030301.JSR1Dol1-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/ocfs2/dlm/dlmdomain.c:43: >> fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined [-Wmacro-redefined] 709 | #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) | ^ include/linux/bitops.h:9:9: note: previous definition is here 9 | #define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) | ^ 1 warning generated. -- In file included from fs/ocfs2/dlm/dlmthread.c:48: >> fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined [-Wmacro-redefined] 709 | #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) | ^ include/linux/bitops.h:9:9: note: previous definition is here 9 | #define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) | ^ fs/ocfs2/dlm/dlmthread.c:534:18: warning: equality comparison with extraneous parentheses [-Wparentheses-equality] 534 | if ((res->owner == dlm->node_num)) { | ~~~~~~~~~~~^~~~~~~~~~~~~~~~ fs/ocfs2/dlm/dlmthread.c:534:18: note: remove extraneous parentheses around the comparison to silence this warning 534 | if ((res->owner == dlm->node_num)) { | ~ ^ ~ fs/ocfs2/dlm/dlmthread.c:534:18: note: use '=' to turn this equality comparison into an assignment 534 | if ((res->owner == dlm->node_num)) { | ^~ | = 2 warnings generated. vim +/BITS_TO_BYTES +709 fs/ocfs2/dlm/dlmcommon.h 6714d8e86bf443 Kurt Hackel 2005-12-15 706 6714d8e86bf443 Kurt Hackel 2005-12-15 707 1faf289454b9ee Srinivas Eeda 2007-01-29 708 #define BITS_PER_BYTE 8 1faf289454b9ee Srinivas Eeda 2007-01-29 @709 #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) 1faf289454b9ee Srinivas Eeda 2007-01-29 710 :::::: The code at line 709 was first introduced by commit :::::: 1faf289454b9eeb6e463da3eee47f7009668370d ocfs2_dlm: disallow a domain join if node maps mismatch :::::: TO: Srinivas Eeda <srinivas.eeda(a)oracle.com> :::::: CC: Mark Fasheh <mark.fasheh(a)oracle.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] crypto: algif_hash - fix double free in hash_accept
by Gu Bowen 03 Jul '25

03 Jul '25

From: Ivan Pravdin <ipravdin.official(a)gmail.com> mainline inclusion from mainline-v6.15 commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGACQ CVE: CVE-2025-38079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/algif_hash.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/algif_hash.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index bfcf595fd8f9..3547db4ac4b2 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -267,10 +267,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags, return err; err = crypto_ahash_import(&ctx2->req, state); - if (err) { - sock_orphan(sk2); - sock_put(sk2); - } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] rseq: Fix segfault on registration when rseq_cs is non-zero
by Wang Tao 03 Jul '25

03 Jul '25

From: Michael Jeanson <mjeanson(a)efficios.com> mainline inclusion from mainline-v6.15-rc1 commit fd881d0a085fc54354414aed990ccf05f282ba53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAFQ CVE: CVE-2025-38067 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field doesn't point to a valid struct rseq_cs. The correct solution to this would be to fail the rseq registration when the rseq_cs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseq_cs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseq_cs does point to a valid struct rseq_cs. What we can do is clear the rseq_cs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation. Signed-off-by: Michael Jeanson <mjeanson(a)efficios.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Link: https://lore.kernel.org/r/20250306211223.109455-1-mjeanson@efficios.com Conflicts: kernel/rseq.c [In method SYSCALL_DEFINE4(), there are some code in mainline but OLK-6.6 has not merged] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/rseq.c | 60 ++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 12 deletions(-) diff --git a/kernel/rseq.c b/kernel/rseq.c index 9de6e35fe679..b4136ec87737 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -149,6 +149,29 @@ static int rseq_reset_rseq_cpu_node_id(struct task_struct *t) return 0; } +/* + * Get the user-space pointer value stored in the 'rseq_cs' field. + */ +static int rseq_get_rseq_cs_ptr_val(struct rseq __user *rseq, u64 *rseq_cs) +{ + if (!rseq_cs) + return -EFAULT; + +#ifdef CONFIG_64BIT + if (get_user(*rseq_cs, &rseq->rseq_cs)) + return -EFAULT; +#else + if (copy_from_user(rseq_cs, &rseq->rseq_cs, sizeof(*rseq_cs))) + return -EFAULT; +#endif + + return 0; +} + +/* + * If the rseq_cs field of 'struct rseq' contains a valid pointer to + * user-space, copy 'struct rseq_cs' from user-space and validate its fields. + */ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) { struct rseq_cs __user *urseq_cs; @@ -157,17 +180,16 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) u32 sig; int ret; -#ifdef CONFIG_64BIT - if (get_user(ptr, &t->rseq->rseq_cs)) - return -EFAULT; -#else - if (copy_from_user(&ptr, &t->rseq->rseq_cs, sizeof(ptr))) - return -EFAULT; -#endif + ret = rseq_get_rseq_cs_ptr_val(t->rseq, &ptr); + if (ret) + return ret; + + /* If the rseq_cs pointer is NULL, return a cleared struct rseq_cs. */ if (!ptr) { memset(rseq_cs, 0, sizeof(*rseq_cs)); return 0; } + /* Check that the pointer value fits in the user-space process space. */ if (ptr >= TASK_SIZE) return -EINVAL; urseq_cs = (struct rseq_cs __user *)(unsigned long)ptr; @@ -243,7 +265,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) return !!event_mask; } -static int clear_rseq_cs(struct task_struct *t) +static int clear_rseq_cs(struct rseq __user *rseq) { /* * The rseq_cs field is set to NULL on preemption or signal @@ -254,9 +276,9 @@ static int clear_rseq_cs(struct task_struct *t) * Set rseq_cs to NULL. */ #ifdef CONFIG_64BIT - return put_user(0UL, &t->rseq->rseq_cs); + return put_user(0UL, &rseq->rseq_cs); #else - if (clear_user(&t->rseq->rseq_cs, sizeof(t->rseq->rseq_cs))) + if (clear_user(&rseq->rseq_cs, sizeof(rseq->rseq_cs))) return -EFAULT; return 0; #endif @@ -288,11 +310,11 @@ static int rseq_ip_fixup(struct pt_regs *regs) * Clear the rseq_cs pointer and return. */ if (!in_rseq_cs(ip, &rseq_cs)) - return clear_rseq_cs(t); + return clear_rseq_cs(t->rseq); ret = rseq_need_restart(t, rseq_cs.flags); if (ret <= 0) return ret; - ret = clear_rseq_cs(t); + ret = clear_rseq_cs(t->rseq); if (ret) return ret; trace_rseq_ip_fixup(ip, rseq_cs.start_ip, rseq_cs.post_commit_offset, @@ -366,6 +388,7 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, int, flags, u32, sig) { int ret; + u64 rseq_cs; if (flags & RSEQ_FLAG_UNREGISTER) { if (flags & ~RSEQ_FLAG_UNREGISTER) @@ -420,6 +443,19 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, return -EINVAL; if (!access_ok(rseq, rseq_len)) return -EFAULT; + + /* + * If the rseq_cs pointer is non-NULL on registration, clear it to + * avoid a potential segfault on return to user-space. The proper thing + * to do would have been to fail the registration but this would break + * older libcs that reuse the rseq area for new threads without + * clearing the fields. + */ + if (rseq_get_rseq_cs_ptr_val(rseq, &rseq_cs)) + return -EFAULT; + if (rseq_cs && clear_rseq_cs(rseq)) + return -EFAULT; + current->rseq = rseq; current->rseq_len = rseq_len; current->rseq_sig = sig; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] drivers/pci/hotplug/pciehp_core.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 03 Jul '25

03 Jul '25

Hi Keith, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 58d584102f06f870f118644f1022c751e015e7bb [1605/1605] PCI: portdrv: Initialize service drivers directly config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030314.c8FttoWL-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030314.c8FttoWL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030314.c8FttoWL-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/pci/hotplug/pciehp_core.c:214: warning: Function parameter or member 'ctrl' not described in 'pciehp_check_presence' >> drivers/pci/hotplug/pciehp_core.o: warning: objtool: missing symbol for section .init.text -- drivers/pci/pcie/aer.c:217: warning: Function parameter or member 'str' not described in 'pcie_ecrc_get_policy' >> drivers/pci/pcie/aer.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: mdio: fix undefined behavior in bit shift for __mdiobus_register
by Zhang Changzhong 03 Jul '25

03 Jul '25

From: Cui GaoSheng <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.265 commit a3fafc974be37319679f36dc4e7cca7db1e02973 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BVD CVE: CVE-2022-49907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40e4eb324c59e11fcb927aa46742d28aba6ecb8a ] Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0 fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> Fixes: 4fd5f812c23c ("phylib: allow incremental scanning of an mii bus") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://lore.kernel.org/r/20221031132645.168421-1-cuigaosheng1@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 60c732d..0f0cdb4 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -416,7 +416,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) bus->reset(bus); for (i = 0; i < PHY_MAX_ADDR; i++) { - if ((bus->phy_mask & (1 << i)) == 0) { + if ((bus->phy_mask & BIT(i)) == 0) { struct phy_device *phydev; phydev = mdiobus_scan(bus, i); -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] wifi: mac80211: Fix UAF in ieee80211_scan_rx()
by Wang Liang 03 Jul '25

03 Jul '25

From: Siddh Raman Pant <code(a)siddh.me> stable inclusion from stable-v4.19.260 commit 78a07732fbb0934d14827d8f09b9aa6a49ee1aa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9IO CVE: CVE-2022-49934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 60deb9f10eec5c6a20252ed36238b55d8b614a2c ] ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req. Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done(). Cc: stable(a)vger.kernel.org Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d Reported-by: syzbot+f9acff9bf08a845f225d(a)syzkaller.appspotmail.com Suggested-by: Johannes Berg <johannes(a)sipsolutions.net> Signed-off-by: Siddh Raman Pant <code(a)siddh.me> Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mac80211/scan.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c index 5d2a11777718..af6c512bf71d 100644 --- a/net/mac80211/scan.c +++ b/net/mac80211/scan.c @@ -402,10 +402,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) scan_req = rcu_dereference_protected(local->scan_req, lockdep_is_held(&local->mtx)); - if (scan_req != local->int_scan_req) { - local->scan_info.aborted = aborted; - cfg80211_scan_done(scan_req, &local->scan_info); - } RCU_INIT_POINTER(local->scan_req, NULL); scan_sdata = rcu_dereference_protected(local->scan_sdata, @@ -415,6 +411,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) local->scanning = 0; local->scan_chandef.chan = NULL; + synchronize_rcu(); + + if (scan_req != local->int_scan_req) { + local->scan_info.aborted = aborted; + cfg80211_scan_done(scan_req, &local->scan_info); + } + /* Set power back to normal operating levels. */ ieee80211_hw_config(local, 0); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] some optimization patches for inet_diag dump
by Liu Jian 03 Jul '25

03 Jul '25

some optimization patches for inet_diag dump Eric Dumazet (4): inet_diag: add module pointer to "struct inet_diag_handler" inet_diag: allow concurrent operations sock_diag: remove sock_diag_mutex inet_diag: skip over empty buckets include/linux/inet_diag.h | 1 + net/core/sock_diag.c | 4 -- net/dccp/diag.c | 1 + net/ipv4/inet_diag.c | 84 ++++++++++++++++++++------------------- net/ipv4/raw_diag.c | 1 + net/ipv4/tcp_diag.c | 1 + net/ipv4/udp_diag.c | 2 + net/mptcp/mptcp_diag.c | 1 + net/sctp/diag.c | 1 + 9 files changed, 52 insertions(+), 44 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] cachefiles: Fix the incorrect return value in cachefiles_ondemand_fd_write_iter()
by Zizhi Wo 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJHNT -------------------------------- In __cachefiles_write(), if the return value of the write operation > 0, it is set to 0. This makes it impossible to distinguish scenarios where a partial write has occurred, and causes the outer function cachefiles_ondemand_fd_write_iter() to unconditionally return the full length specified by user space. Fix it by modifying "ret" to reflect the actual number of bytes written. Furthermore, returning a value greater than 0 from __cachefiles_write() does not affect other call paths, such as fscache_write_to_cache() and fscache_write(). Fixes: c8383054506c ("cachefiles: notify the user daemon when looking up cookie") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cachefiles/io.c | 2 -- fs/cachefiles/ondemand.c | 4 +--- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/fs/cachefiles/io.c b/fs/cachefiles/io.c index f7a507ddd668..2ba98f3861e8 100644 --- a/fs/cachefiles/io.c +++ b/fs/cachefiles/io.c @@ -357,8 +357,6 @@ int __cachefiles_write(struct cachefiles_object *object, default: ki->was_async = false; cachefiles_write_complete(&ki->iocb, ret); - if (ret > 0) - ret = 0; break; } diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c index 6a0921f31a8a..8b0d123b51b1 100644 --- a/fs/cachefiles/ondemand.c +++ b/fs/cachefiles/ondemand.c @@ -84,10 +84,8 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb, trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len); ret = __cachefiles_write(object, file, pos, iter, NULL, NULL); - if (!ret) { - ret = len; + if (ret > 0) kiocb->ki_pos += ret; - } out: fput(file); return ret; -- 2.39.2

2 1

[openeuler:OLK-6.6 2439/2439] drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c:545:5: error: no previous prototype for function 'ps3_pci_init'
by kernel test robot 03 Jul '25

03 Jul '25

Hi liujie_answer, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: efca360340f27e62df372b2e2e707a7ccf5b142e commit: 97a2bb6ece556f3882263ee8df2b77f10c511311 [2439/2439] SCSI: Linkdata: Supports Linkdata HBA/RAID Controllers config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250703/202507030812.DUobYsCi-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030812.DUobYsCi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030812.DUobYsCi-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:5: In file included from include/linux/pci.h:1669: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:307:5: error: no previous prototype for function 'ps3_hard_reset_to_ready' [-Werror,-Wmissing-prototypes] 307 | int ps3_hard_reset_to_ready(struct ps3_instance *instance) | ^ drivers/scsi/linkdata/ps3stor/ps3_ioc_manager.c:307:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 307 | int ps3_hard_reset_to_ready(struct ps3_instance *instance) | ^ | static 6 errors generated. -- In file included from drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:5: In file included from include/linux/pci.h:1669: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:876:6: error: no previous prototype for function 'ps3_set_task_manager_busy' [-Werror,-Wmissing-prototypes] 876 | void ps3_set_task_manager_busy(struct ps3_instance *instance, | ^ drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:876:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 876 | void ps3_set_task_manager_busy(struct ps3_instance *instance, | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1110:5: error: no previous prototype for function 'ps3_wait_for_outstanding_complete' [-Werror,-Wmissing-prototypes] 1110 | int ps3_wait_for_outstanding_complete(struct ps3_instance *instance) | ^ drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c:1110:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1110 | int ps3_wait_for_outstanding_complete(struct ps3_instance *instance) | ^ | static 7 errors generated. -- In file included from drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:14: In file included from drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.h:6: In file included from drivers/scsi/linkdata/ps3stor/ps3_irq.h:8: In file included from include/scsi/scsi_host.h:11: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:9: In file included from include/linux/blk_types.h:10: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:131:6: error: no previous prototype for function 'ps3_trigger_irq_poll' [-Werror,-Wmissing-prototypes] 131 | void ps3_trigger_irq_poll(struct ps3_irq *irq) | ^ drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:131:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 131 | void ps3_trigger_irq_poll(struct ps3_irq *irq) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:243:5: error: no previous prototype for function 'ps3_resp_status_convert' [-Werror,-Wmissing-prototypes] 243 | int ps3_resp_status_convert(unsigned int resp_status) | ^ drivers/scsi/linkdata/ps3stor/ps3_cmd_complete.c:243:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 243 | int ps3_resp_status_convert(unsigned int resp_status) | ^ | static 7 errors generated. -- In file included from drivers/scsi/linkdata/ps3stor/ps3_qos.c:7: In file included from include/scsi/scsi_host.h:11: In file included from include/linux/blk-mq.h:5: In file included from include/linux/blkdev.h:9: In file included from include/linux/blk_types.h:10: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:211:1: error: no previous prototype for function 'ps3_qos_cmd_waitq_get' [-Werror,-Wmissing-prototypes] 211 | ps3_qos_cmd_waitq_get(struct ps3_qos_tg_context *qos_tg_ctx, | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:210:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 210 | struct qos_wait_queue * | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:335:15: error: no previous prototype for function 'ps3_qos_vd_cmdword_get' [-Werror,-Wmissing-prototypes] 335 | unsigned char ps3_qos_vd_cmdword_get(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:335:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 335 | unsigned char ps3_qos_vd_cmdword_get(struct ps3_cmd *cmd) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:351:15: error: no previous prototype for function 'ps3_qos_exclusive_cmdword_get' [-Werror,-Wmissing-prototypes] 351 | unsigned char ps3_qos_exclusive_cmdword_get(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:351:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 351 | unsigned char ps3_qos_exclusive_cmdword_get(struct ps3_cmd *cmd) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:363:15: error: no previous prototype for function 'ps3_qos_tg_decision' [-Werror,-Wmissing-prototypes] 363 | unsigned char ps3_qos_tg_decision(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:363:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 363 | unsigned char ps3_qos_tg_decision(struct ps3_cmd *cmd) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:749:15: error: no previous prototype for function 'ps3_qos_all_pd_rc_get' [-Werror,-Wmissing-prototypes] 749 | unsigned char ps3_qos_all_pd_rc_get(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:749:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 749 | unsigned char ps3_qos_all_pd_rc_get(struct ps3_cmd *cmd) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:876:6: error: no previous prototype for function 'ps3_pd_quota_waitq_clear_all' [-Werror,-Wmissing-prototypes] 876 | void ps3_pd_quota_waitq_clear_all(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:876:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 876 | void ps3_pd_quota_waitq_clear_all(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:892:6: error: no previous prototype for function 'ps3_pd_quota_waitq_clean' [-Werror,-Wmissing-prototypes] 892 | void ps3_pd_quota_waitq_clean(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:892:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 892 | void ps3_pd_quota_waitq_clean(struct ps3_qos_pd_mgr *qos_pd_mgr, | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:1058:6: error: no previous prototype for function 'ps3_qos_pd_waitq_ratio_update' [-Werror,-Wmissing-prototypes] 1058 | void ps3_qos_pd_waitq_ratio_update(struct ps3_qos_pd_mgr *qos_pd_mgr) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:1058:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1058 | void ps3_qos_pd_waitq_ratio_update(struct ps3_qos_pd_mgr *qos_pd_mgr) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2019:15: error: no previous prototype for function 'ps3_hba_qos_decision' [-Werror,-Wmissing-prototypes] 2019 | unsigned char ps3_hba_qos_decision(struct ps3_cmd *cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2019:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2019 | unsigned char ps3_hba_qos_decision(struct ps3_cmd *cmd) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2040:6: error: no previous prototype for function 'ps3_hba_qos_waitq_notify' [-Werror,-Wmissing-prototypes] 2040 | void ps3_hba_qos_waitq_notify(struct ps3_instance *instance) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2040:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2040 | void ps3_hba_qos_waitq_notify(struct ps3_instance *instance) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2100:6: error: no previous prototype for function 'ps3_cmd_waitq_abort' [-Werror,-Wmissing-prototypes] 2100 | bool ps3_cmd_waitq_abort(struct ps3_cmd *aborted_cmd) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2100:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2100 | bool ps3_cmd_waitq_abort(struct ps3_cmd *aborted_cmd) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2463:6: error: no previous prototype for function 'ps3_hba_qos_waitq_clear_all' [-Werror,-Wmissing-prototypes] 2463 | void ps3_hba_qos_waitq_clear_all(struct ps3_instance *instance, int resp_status) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2463:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2463 | void ps3_hba_qos_waitq_clear_all(struct ps3_instance *instance, int resp_status) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2827:6: error: no previous prototype for function 'ps3_hba_qos_vd_init' [-Werror,-Wmissing-prototypes] 2827 | void ps3_hba_qos_vd_init(struct ps3_instance *instance, | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2827:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2827 | void ps3_hba_qos_vd_init(struct ps3_instance *instance, | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_qos.c:2936:6: error: no previous prototype for function 'ps3_hba_qos_vd_reset' [-Werror,-Wmissing-prototypes] 2936 | void ps3_hba_qos_vd_reset(struct ps3_instance *instance, unsigned short disk_id) | ^ drivers/scsi/linkdata/ps3stor/ps3_qos.c:2936:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2936 | void ps3_hba_qos_vd_reset(struct ps3_instance *instance, unsigned short disk_id) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. -- In file included from drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:6: In file included from drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.h:7: In file included from include/scsi/scsi_cmnd.h:5: In file included from include/linux/dma-mapping.h:11: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: error: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Werror,-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:85:6: error: no previous prototype for function 'ps3_cmd_stat_content_clear' [-Werror,-Wmissing-prototypes] 85 | void ps3_cmd_stat_content_clear(struct ps3_instance *instance) | ^ drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:85:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 85 | void ps3_cmd_stat_content_clear(struct ps3_instance *instance) | ^ | static >> drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:403:6: error: no previous prototype for function 'ps3_io_recv_ok_stat_inc' [-Werror,-Wmissing-prototypes] 403 | void ps3_io_recv_ok_stat_inc(struct ps3_instance *ins, | ^ drivers/scsi/linkdata/ps3stor/ps3_cmd_statistics.c:403:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 403 | void ps3_io_recv_ok_stat_inc(struct ps3_instance *ins, | ^ | static 7 errors generated. .. vim +/ps3_pci_init +545 drivers/scsi/linkdata/ps3stor/./linux/ps3_base.c 544 > 545 int ps3_pci_init(struct pci_dev *pdev, struct ps3_instance *instance) 546 { 547 resource_size_t base_addr = 0; 548 int ret = PS3_SUCCESS; 549 550 ret = pci_enable_device_mem(pdev); 551 if (ret != PS3_SUCCESS) { 552 LOG_ERROR("hno:%u pci id[%u] pci enable failed\n", 553 PS3_HOST(instance), pdev->dev.id); 554 goto l_pci_enable_device_mem_failed; 555 } 556 557 pci_set_master(pdev); 558 559 instance->reg_bar = PS3_REGISTER_BAR_INDEX; 560 ret = (pci_resource_flags(pdev, instance->reg_bar) & IORESOURCE_MEM); 561 if (!ret) { 562 LOG_ERROR("hno:%u Bar %lu isnot IORESOURCE_MEM\n", 563 PS3_HOST(instance), instance->reg_bar); 564 goto l_bar_check_failed; 565 } 566 ret = pci_request_selected_regions(pdev, 1 << instance->reg_bar, 567 "PS3 pci regions"); 568 if (ret != PS3_SUCCESS) { 569 LOG_ERROR("hno:%u IO memory region busy\n", PS3_HOST(instance)); 570 goto l_pci_request_selected_regions_failed; 571 } 572 #if defined(PS3_SUPPORT_PCIE_REPORT) 573 pci_enable_pcie_error_reporting(pdev); 574 #endif 575 if (instance->ioc_adpter->reg_set) { 576 instance->reg_set = 577 (struct Ps3Fifo __iomem *)instance->ioc_adpter->reg_set( 578 pdev, instance->reg_bar); 579 } else { 580 instance->reg_set = (struct Ps3Fifo __iomem *)ioremap( 581 pci_resource_start(pdev, instance->reg_bar), 582 PS3_REGISTER_SET_SIZE); 583 } 584 if (instance->reg_set == NULL) { 585 LOG_ERROR("hno:%u ioremap failed\n", PS3_HOST(instance)); 586 goto l_ioremap_failed; 587 } else { 588 pci_set_drvdata(pdev, instance); 589 } 590 591 ps3_atomic_set(&instance->watchdog_reg_read_fail_count, 0); 592 LOG_INFO( 593 "reg_bar_idx = %lu, bar_base_paddr = 0x%llx, reg_set_vaddr = 0x%p\n", 594 instance->reg_bar, (unsigned long long)base_addr, instance->reg_set); 595 596 return PS3_SUCCESS; 597 l_ioremap_failed: 598 pci_release_selected_regions(instance->pdev, 1 << instance->reg_bar); 599 #if defined(PS3_SUPPORT_PCIE_REPORT) 600 pci_disable_pcie_error_reporting(pdev); 601 #endif 602 l_pci_request_selected_regions_failed: 603 pci_disable_device(instance->pdev); 604 l_bar_check_failed: 605 l_pci_enable_device_mem_failed: 606 return -PS3_FAILED; 607 } 608 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0