- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 14 Mar '25

14 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-6.6 0/1] CVE-2024-58069
by Liao Chen 13 Mar '25

13 Mar '25

fix CVE-2024-58069 Oleksij Rempel (1): rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read drivers/rtc/rtc-pcf85063.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/2] CVE-2025-21816
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 102 ++++++++++++++++++++++++++++++++-------- 2 files changed, 84 insertions(+), 19 deletions(-) -- 2.20.1

2 3

[PATCH OLK-5.10] PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: King Dix <kingdix10(a)qq.com> mainline inclusion from mainline-v6.14-rc1 commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK2 CVE: CVE-2025-21804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows: $ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff : Sometimes, garbage may appear after the colon. In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack. Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support") Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.c… Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Signed-off-by: King Dix <kingdix10(a)qq.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/controller/pcie-rcar-ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c index c91d85b151290..fc85263797e91 100644 --- a/drivers/pci/controller/pcie-rcar-ep.c +++ b/drivers/pci/controller/pcie-rcar-ep.c @@ -110,7 +110,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, } if (!devm_request_mem_region(&pdev->dev, res->start, resource_size(res), - outbound_name)) { + res->name)) { dev_err(pcie->dev, "Cannot request memory region %s.\n", outbound_name); return -EIO; -- 2.20.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21816
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Frederic Weisbecker (1): hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING Xiongfeng Wang (1): hrtimer: Fix kabi broken of struct hrtimer_cpu_base include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++-------- 2 files changed, 83 insertions(+), 21 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6] hrtimer: Fix kabi broken of struct hrtimer_cpu_base
by Xiongfeng Wang 13 Mar '25

13 Mar '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLI0 -------------------------------- Fix kabi broken caused by the following commit. Because the reserved size is not enough, and struct hrtimer_cpu_base is not contained by any other stucture, we use KABI_EXTEND to fix the kabi. Fixes: 14548083da37 ("[Backport] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- include/linux/hrtimer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 1ec9be2ce4be..623537ee5c48 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -244,10 +244,10 @@ struct hrtimer_cpu_base { ktime_t softirq_expires_next; struct hrtimer *softirq_next_timer; struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES]; - call_single_data_t csd; KABI_RESERVE(1) KABI_RESERVE(2) + KABI_EXTEND(call_single_data_t csd) } ____cacheline_aligned; static inline void hrtimer_set_expires(struct hrtimer *timer, ktime_t time) -- 2.20.1

2 1

[PATCH OLK-6.6] hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Frederic Weisbecker <frederic(a)kernel.org> mainline inclusion from mainline-v6.14-rc2 commit 53dac345395c0d2493cbc2f4c85fe38aef5b63f5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLI0 CVE: CVE-2025-21816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hrtimers are migrated away from the dying CPU to any online target at the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers handling tasks involved in the CPU hotplug forward progress. However wakeups can still be performed by the outgoing CPU after CPUHP_AP_HRTIMERS_DYING. Those can result again in bandwidth timers being armed. Depending on several considerations (crystal ball power management based election, earliest timer already enqueued, timer migration enabled or not), the target may eventually be the current CPU even if offline. If that happens, the timer is eventually ignored. The most notable example is RCU which had to deal with each and every of those wake-ups by deferring them to an online CPU, along with related workarounds: _ e787644caf76 (rcu: Defer RCU kthreads wakeup when CPU is dying) _ 9139f93209d1 (rcu/nocb: Fix RT throttling hrtimer armed from offline CPU) _ f7345ccc62a4 (rcu/nocb: Fix rcuog wake-up from offline softirq) The problem isn't confined to RCU though as the stop machine kthread (which runs CPUHP_AP_HRTIMERS_DYING) reports its completion at the end of its work through cpu_stop_signal_done() and performs a wake up that eventually arms the deadline server timer: WARNING: CPU: 94 PID: 588 at kernel/time/hrtimer.c:1086 hrtimer_start_range_ns+0x289/0x2d0 CPU: 94 UID: 0 PID: 588 Comm: migration/94 Not tainted Stopper: multi_cpu_stop+0x0/0x120 <- stop_machine_cpuslocked+0x66/0xc0 RIP: 0010:hrtimer_start_range_ns+0x289/0x2d0 Call Trace: <TASK> start_dl_timer enqueue_dl_entity dl_server_start enqueue_task_fair enqueue_task ttwu_do_activate try_to_wake_up complete cpu_stopper_thread Instead of providing yet another bandaid to work around the situation, fix it in the hrtimers infrastructure instead: always migrate away a timer to an online target whenever it is enqueued from an offline CPU. This will also allow to revert all the above RCU disgraceful hacks. Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Reported-by: Vlad Poenaru <vlad.wing(a)gmail.com> Reported-by: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Tested-by: Paul E. McKenney <paulmck(a)kernel.org> Link: https://lore.kernel.org/all/20250117232433.24027-1-frederic@kernel.org Closes: 20241213203739.1519801-1-usamaarif642(a)gmail.com Conflicts: include/linux/hrtimer_defs.h include/linux/hrtimer.h [wxf: fix conflicts because 'struct hrtimer_cpu_base' is moved to another file.] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 103 ++++++++++++++++++++++++++++++++-------- 2 files changed, 83 insertions(+), 21 deletions(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 30df0b35aafe..1ec9be2ce4be 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -244,6 +244,7 @@ struct hrtimer_cpu_base { ktime_t softirq_expires_next; struct hrtimer *softirq_next_timer; struct hrtimer_clock_base clock_base[HRTIMER_MAX_CLOCK_BASES]; + call_single_data_t csd; KABI_RESERVE(1) KABI_RESERVE(2) diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index 57e5cb36f1bc..a64c644df4ce 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -58,6 +58,8 @@ #define HRTIMER_ACTIVE_SOFT (HRTIMER_ACTIVE_HARD << MASK_SHIFT) #define HRTIMER_ACTIVE_ALL (HRTIMER_ACTIVE_SOFT | HRTIMER_ACTIVE_HARD) +static void retrigger_next_event(void *arg); + /* * The timer bases: * @@ -111,7 +113,8 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) = .clockid = CLOCK_TAI, .get_time = &ktime_get_clocktai, }, - } + }, + .csd = CSD_INIT(retrigger_next_event, NULL) }; static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { @@ -124,6 +127,14 @@ static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { [CLOCK_TAI] = HRTIMER_BASE_TAI, }; +static inline bool hrtimer_base_is_online(struct hrtimer_cpu_base *base) +{ + if (!IS_ENABLED(CONFIG_HOTPLUG_CPU)) + return true; + else + return likely(base->online); +} + /* * Functions and macros which are different for UP/SMP systems are kept in a * single place @@ -183,27 +194,54 @@ struct hrtimer_clock_base *lock_hrtimer_base(const struct hrtimer *timer, } /* - * We do not migrate the timer when it is expiring before the next - * event on the target cpu. When high resolution is enabled, we cannot - * reprogram the target cpu hardware and we would cause it to fire - * late. To keep it simple, we handle the high resolution enabled and - * disabled case similar. + * Check if the elected target is suitable considering its next + * event and the hotplug state of the current CPU. + * + * If the elected target is remote and its next event is after the timer + * to queue, then a remote reprogram is necessary. However there is no + * guarantee the IPI handling the operation would arrive in time to meet + * the high resolution deadline. In this case the local CPU becomes a + * preferred target, unless it is offline. + * + * High and low resolution modes are handled the same way for simplicity. * * Called with cpu_base->lock of target cpu held. */ -static int -hrtimer_check_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base) +static bool hrtimer_suitable_target(struct hrtimer *timer, struct hrtimer_clock_base *new_base, + struct hrtimer_cpu_base *new_cpu_base, + struct hrtimer_cpu_base *this_cpu_base) { ktime_t expires; + /* + * The local CPU clockevent can be reprogrammed. Also get_target_base() + * guarantees it is online. + */ + if (new_cpu_base == this_cpu_base) + return true; + + /* + * The offline local CPU can't be the default target if the + * next remote target event is after this timer. Keep the + * elected new base. An IPI will we issued to reprogram + * it as a last resort. + */ + if (!hrtimer_base_is_online(this_cpu_base)) + return true; + expires = ktime_sub(hrtimer_get_expires(timer), new_base->offset); - return expires < new_base->cpu_base->expires_next; + + return expires >= new_base->cpu_base->expires_next; } -static inline -struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, - int pinned) +static inline struct hrtimer_cpu_base *get_target_base(struct hrtimer_cpu_base *base, int pinned) { + if (!hrtimer_base_is_online(base)) { + int cpu = cpumask_any_and(cpu_online_mask, housekeeping_cpumask(HK_TYPE_TIMER)); + + return &per_cpu(hrtimer_bases, cpu); + } + #if defined(CONFIG_SMP) && defined(CONFIG_NO_HZ_COMMON) if (static_branch_likely(&timers_migration_enabled) && !pinned) return &per_cpu(hrtimer_bases, get_nohz_timer_target()); @@ -254,8 +292,8 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, raw_spin_unlock(&base->cpu_base->lock); raw_spin_lock(&new_base->cpu_base->lock); - if (new_cpu_base != this_cpu_base && - hrtimer_check_target(timer, new_base)) { + if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, + this_cpu_base)) { raw_spin_unlock(&new_base->cpu_base->lock); raw_spin_lock(&base->cpu_base->lock); new_cpu_base = this_cpu_base; @@ -264,8 +302,7 @@ switch_hrtimer_base(struct hrtimer *timer, struct hrtimer_clock_base *base, } WRITE_ONCE(timer->base, new_base); } else { - if (new_cpu_base != this_cpu_base && - hrtimer_check_target(timer, new_base)) { + if (!hrtimer_suitable_target(timer, new_base, new_cpu_base, this_cpu_base)) { new_cpu_base = this_cpu_base; goto again; } @@ -730,8 +767,6 @@ static inline int hrtimer_is_hres_enabled(void) return hrtimer_hres_enabled; } -static void retrigger_next_event(void *arg); - /* * Switch to high resolution mode */ @@ -1218,6 +1253,7 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, u64 delta_ns, const enum hrtimer_mode mode, struct hrtimer_clock_base *base) { + struct hrtimer_cpu_base *this_cpu_base = this_cpu_ptr(&hrtimer_bases); struct hrtimer_clock_base *new_base; bool force_local, first; @@ -1229,9 +1265,15 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, * and enforce reprogramming after it is queued no matter whether * it is the new first expiring timer again or not. */ - force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases); + force_local = base->cpu_base == this_cpu_base; force_local &= base->cpu_base->next_timer == timer; + /* + * Don't force local queuing if this enqueue happens on a unplugged + * CPU after hrtimer_cpu_dying() has been invoked. + */ + force_local &= this_cpu_base->online; + /* * Remove an active timer from the queue. In case it is not queued * on the current CPU, make sure that remove_hrtimer() updates the @@ -1261,8 +1303,27 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, } first = enqueue_hrtimer(timer, new_base, mode); - if (!force_local) - return first; + if (!force_local) { + /* + * If the current CPU base is online, then the timer is + * never queued on a remote CPU if it would be the first + * expiring timer there. + */ + if (hrtimer_base_is_online(this_cpu_base)) + return first; + + /* + * Timer was enqueued remote because the current base is + * already offline. If the timer is the first to expire, + * kick the remote CPU to reprogram the clock event. + */ + if (first) { + struct hrtimer_cpu_base *new_cpu_base = new_base->cpu_base; + + smp_call_function_single_async(new_cpu_base->cpu, &new_cpu_base->csd); + } + return 0; + } /* * Timer was forced to stay on the current CPU to avoid -- 2.20.1

2 1

[PATCH OLK-6.6] PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: King Dix <kingdix10(a)qq.com> stable inclusion from stable-v6.6.76 commit 2c54b9fca1755e80a343ccfde0652dc5ea4744b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK2 CVE: CVE-2025-21804 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2d2da5a4c1b4509f6f7e5a8db015cd420144beb4 ] The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A string variable that lives on the stack is then used to store a dynamically computed resource name, which is then passed on as one of the macro arguments. This can lead to undefined behavior. Depending on the current contents of the memory, the manifestations of errors may vary. One possible output may be as follows: $ cat /proc/iomem 30000000-37ffffff : 38000000-3fffffff : Sometimes, garbage may appear after the colon. In very rare cases, if no NULL-terminator is found in memory, the system might crash because the string iterator will overrun which can lead to access of unmapped memory above the stack. Thus, fix this by replacing outbound_name with the name of the previously requested resource. With the changes applied, the output will be as follows: $ cat /proc/iomem 30000000-37ffffff : memory2 38000000-3fffffff : memory3 Fixes: 2a6d0d63d999 ("PCI: rcar: Add endpoint mode support") Link: https://lore.kernel.org/r/tencent_DBDCC19D60F361119E76919ADAB25EC13C06@qq.c… Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Signed-off-by: King Dix <kingdix10(a)qq.com> [kwilczynski: commit log] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj(a)bp.renesas.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pci/controller/pcie-rcar-ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/controller/pcie-rcar-ep.c b/drivers/pci/controller/pcie-rcar-ep.c index f9682df1da61..209719fb6ddc 100644 --- a/drivers/pci/controller/pcie-rcar-ep.c +++ b/drivers/pci/controller/pcie-rcar-ep.c @@ -107,7 +107,7 @@ static int rcar_pcie_parse_outbound_ranges(struct rcar_pcie_endpoint *ep, } if (!devm_request_mem_region(&pdev->dev, res->start, resource_size(res), - outbound_name)) { + res->name)) { dev_err(pcie->dev, "Cannot request memory region %s.\n", outbound_name); return -EIO; -- 2.20.1

2 1

[PATCH OLK-6.6] LoongArch: Fix warnings during S3 suspend
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Huacai Chen <chenhuacai(a)loongson.cn> stable inclusion from stable-v6.6.76 commit d49ab6857d98266010f3446c9c2063014db5b654 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLK0 CVE: CVE-2025-21803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26c0a2d93af55d30a46d5f45d3e9c42cde730168 ] The enable_gpe_wakeup() function calls acpi_enable_all_wakeup_gpes(), and the later one may call the preempt_schedule_common() function, resulting in a thread switch and causing the CPU to be in an interrupt enabled state after the enable_gpe_wakeup() function returns, leading to the warnings as follow. [ C0] WARNING: ... at kernel/time/timekeeping.c:845 ktime_get+0xbc/0xc8 [ C0] ... [ C0] Call Trace: [ C0] [<90000000002243b4>] show_stack+0x64/0x188 [ C0] [<900000000164673c>] dump_stack_lvl+0x60/0x88 [ C0] [<90000000002687e4>] __warn+0x8c/0x148 [ C0] [<90000000015e9978>] report_bug+0x1c0/0x2b0 [ C0] [<90000000016478e4>] do_bp+0x204/0x3b8 [ C0] [<90000000025b1924>] exception_handlers+0x1924/0x10000 [ C0] [<9000000000343bbc>] ktime_get+0xbc/0xc8 [ C0] [<9000000000354c08>] tick_sched_timer+0x30/0xb0 [ C0] [<90000000003408e0>] __hrtimer_run_queues+0x160/0x378 [ C0] [<9000000000341f14>] hrtimer_interrupt+0x144/0x388 [ C0] [<9000000000228348>] constant_timer_interrupt+0x38/0x48 [ C0] [<90000000002feba4>] __handle_irq_event_percpu+0x64/0x1e8 [ C0] [<90000000002fed48>] handle_irq_event_percpu+0x20/0x80 [ C0] [<9000000000306b9c>] handle_percpu_irq+0x5c/0x98 [ C0] [<90000000002fd4a0>] generic_handle_domain_irq+0x30/0x48 [ C0] [<9000000000d0c7b0>] handle_cpu_irq+0x70/0xa8 [ C0] [<9000000001646b30>] handle_loongarch_irq+0x30/0x48 [ C0] [<9000000001646bc8>] do_vint+0x80/0xe0 [ C0] [<90000000002aea1c>] finish_task_switch.isra.0+0x8c/0x2a8 [ C0] [<900000000164e34c>] __schedule+0x314/0xa48 [ C0] [<900000000164ead8>] schedule+0x58/0xf0 [ C0] [<9000000000294a2c>] worker_thread+0x224/0x498 [ C0] [<900000000029d2f0>] kthread+0xf8/0x108 [ C0] [<9000000000221f28>] ret_from_kernel_thread+0xc/0xa4 [ C0] [ C0] ---[ end trace 0000000000000000 ]--- The root cause is acpi_enable_all_wakeup_gpes() uses a mutex to protect acpi_hw_enable_all_wakeup_gpes(), and acpi_ut_acquire_mutex() may cause a thread switch. Since there is no longer concurrent execution during loongarch_acpi_suspend(), we can call acpi_hw_enable_all_wakeup_gpes() directly in enable_gpe_wakeup(). The solution is similar to commit 22db06337f590d01 ("ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()"). Fixes: 366bb35a8e48 ("LoongArch: Add suspend (ACPI S3) support") Signed-off-by: Qunqin Zhao <zhaoqunqin(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- arch/loongarch/power/platform.c | 2 +- drivers/acpi/acpica/achware.h | 2 -- include/acpi/acpixf.h | 1 + 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/loongarch/power/platform.c b/arch/loongarch/power/platform.c index 3ea8e07aa225..6c7735cda4d8 100644 --- a/arch/loongarch/power/platform.c +++ b/arch/loongarch/power/platform.c @@ -17,7 +17,7 @@ void enable_gpe_wakeup(void) if (acpi_gbl_reduced_hardware) return; - acpi_enable_all_wakeup_gpes(); + acpi_hw_enable_all_wakeup_gpes(); } void enable_pci_wakeup(void) diff --git a/drivers/acpi/acpica/achware.h b/drivers/acpi/acpica/achware.h index 79bbfe00d241..b8543a34caea 100644 --- a/drivers/acpi/acpica/achware.h +++ b/drivers/acpi/acpica/achware.h @@ -103,8 +103,6 @@ acpi_hw_get_gpe_status(struct acpi_gpe_event_info *gpe_event_info, acpi_status acpi_hw_enable_all_runtime_gpes(void); -acpi_status acpi_hw_enable_all_wakeup_gpes(void); - u8 acpi_hw_check_all_gpes(acpi_handle gpe_skip_device, u32 gpe_skip_number); acpi_status diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h index a3c9dd4a1ac3..7e9e7e769043 100644 --- a/include/acpi/acpixf.h +++ b/include/acpi/acpixf.h @@ -763,6 +763,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status *event_status)) ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_dispatch_gpe(acpi_handle gpe_device, u32 gpe_number)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_disable_all_gpes(void)) +ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_enable_all_wakeup_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void)) -- 2.20.1

2 1

[PATCH OLK-6.6] wifi: wcn36xx: fix channel survey memory allocation size
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Barnabás Czémán <barnabas.czeman(a)mainlining.org> stable inclusion from stable-v6.6.76 commit e95f9c408ff8311f75eeabc8acf34a66670d8815 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBLV CVE: CVE-2024-57997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6200d947f050efdba4090dfefd8a01981363d954 ] KASAN reported a memory allocation issue in wcn->chan_survey due to incorrect size calculation. This commit uses kcalloc to allocate memory for wcn->chan_survey, ensuring proper initialization and preventing the use of uninitialized values when there are no frames on the channel. Fixes: 29696e0aa413 ("wcn36xx: Track SNR and RSSI for each RX frame") Signed-off-by: Barnabás Czémán <barnabas.czeman(a)mainlining.org> Acked-by: Loic Poulain <loic.poulain(a)linaro.org> Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Link: https://patch.msgid.link/20241104-wcn36xx-memory-allocation-v1-1-5ec901cf37… Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/net/wireless/ath/wcn36xx/main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c index 2bd1163177f0..9bbbc86fd2d9 100644 --- a/drivers/net/wireless/ath/wcn36xx/main.c +++ b/drivers/net/wireless/ath/wcn36xx/main.c @@ -1586,7 +1586,10 @@ static int wcn36xx_probe(struct platform_device *pdev) } n_channels = wcn_band_2ghz.n_channels + wcn_band_5ghz.n_channels; - wcn->chan_survey = devm_kmalloc(wcn->dev, n_channels, GFP_KERNEL); + wcn->chan_survey = devm_kcalloc(wcn->dev, + n_channels, + sizeof(struct wcn36xx_chan_survey), + GFP_KERNEL); if (!wcn->chan_survey) { ret = -ENOMEM; goto out_wq; -- 2.20.1

2 1

[PATCH OLK-6.6] OPP: add index check to assert to avoid buffer overflow in _read_freq()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Neil Armstrong <neil.armstrong(a)linaro.org> stable inclusion from stable-v6.6.76 commit eb6ffa0192ba83ece1a318b956265519c5c7dcec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBNO CVE: CVE-2024-57998 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d659bc68ed489022ea33342cfbda2911a81e7a0d ] Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called from the indexed variants: dev_pm_opp_find_freq_exact_indexed() or dev_pm_opp_find_freq_ceil/floor_indexed(). Add a secondary parameter to the assert function, unused for assert_single_clk() then add assert_clk_index() which will check for the clock index when called from the _indexed() find functions. Fixes: 142e17c1c2b4 ("OPP: Introduce dev_pm_opp_find_freq_{ceil/floor}_indexed() APIs") Fixes: a5893928bb17 ("OPP: Add dev_pm_opp_find_freq_exact_indexed()") Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/opp/core.c | 42 +++++++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/drivers/opp/core.c b/drivers/opp/core.c index bceb27b1baa1..3c26130dc75e 100644 --- a/drivers/opp/core.c +++ b/drivers/opp/core.c @@ -101,11 +101,21 @@ struct opp_table *_find_opp_table(struct device *dev) * representation in the OPP table and manage the clock configuration themselves * in an platform specific way. */ -static bool assert_single_clk(struct opp_table *opp_table) +static bool assert_single_clk(struct opp_table *opp_table, + unsigned int __always_unused index) { return !WARN_ON(opp_table->clk_count > 1); } +/* + * Returns true if clock table is large enough to contain the clock index. + */ +static bool assert_clk_index(struct opp_table *opp_table, + unsigned int index) +{ + return opp_table->clk_count > index; +} + /** * dev_pm_opp_get_voltage() - Gets the voltage corresponding to an opp * @opp: opp for which voltage has to be returned for @@ -499,12 +509,12 @@ static struct dev_pm_opp *_opp_table_find_key(struct opp_table *opp_table, unsigned long (*read)(struct dev_pm_opp *opp, int index), bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, unsigned long opp_key, unsigned long key), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { struct dev_pm_opp *temp_opp, *opp = ERR_PTR(-ERANGE); /* Assert that the requirement is met */ - if (assert && !assert(opp_table)) + if (assert && !assert(opp_table, index)) return ERR_PTR(-EINVAL); mutex_lock(&opp_table->lock); @@ -532,7 +542,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), bool (*compare)(struct dev_pm_opp **opp, struct dev_pm_opp *temp_opp, unsigned long opp_key, unsigned long key), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { struct opp_table *opp_table; struct dev_pm_opp *opp; @@ -555,7 +565,7 @@ _find_key(struct device *dev, unsigned long *key, int index, bool available, static struct dev_pm_opp *_find_key_exact(struct device *dev, unsigned long key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { /* * The value of key will be updated here, but will be ignored as the @@ -568,7 +578,7 @@ static struct dev_pm_opp *_find_key_exact(struct device *dev, static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _opp_table_find_key(opp_table, key, index, available, read, _compare_ceil, assert); @@ -577,7 +587,7 @@ static struct dev_pm_opp *_opp_table_find_key_ceil(struct opp_table *opp_table, static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _find_key(dev, key, index, available, read, _compare_ceil, assert); @@ -586,7 +596,7 @@ static struct dev_pm_opp *_find_key_ceil(struct device *dev, unsigned long *key, static struct dev_pm_opp *_find_key_floor(struct device *dev, unsigned long *key, int index, bool available, unsigned long (*read)(struct dev_pm_opp *opp, int index), - bool (*assert)(struct opp_table *opp_table)) + bool (*assert)(struct opp_table *opp_table, unsigned int index)) { return _find_key(dev, key, index, available, read, _compare_floor, assert); @@ -647,7 +657,8 @@ struct dev_pm_opp * dev_pm_opp_find_freq_exact_indexed(struct device *dev, unsigned long freq, u32 index, bool available) { - return _find_key_exact(dev, freq, index, available, _read_freq, NULL); + return _find_key_exact(dev, freq, index, available, _read_freq, + assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_exact_indexed); @@ -707,7 +718,8 @@ struct dev_pm_opp * dev_pm_opp_find_freq_ceil_indexed(struct device *dev, unsigned long *freq, u32 index) { - return _find_key_ceil(dev, freq, index, true, _read_freq, NULL); + return _find_key_ceil(dev, freq, index, true, _read_freq, + assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_ceil_indexed); @@ -760,7 +772,7 @@ struct dev_pm_opp * dev_pm_opp_find_freq_floor_indexed(struct device *dev, unsigned long *freq, u32 index) { - return _find_key_floor(dev, freq, index, true, _read_freq, NULL); + return _find_key_floor(dev, freq, index, true, _read_freq, assert_clk_index); } EXPORT_SYMBOL_GPL(dev_pm_opp_find_freq_floor_indexed); @@ -1676,7 +1688,7 @@ void dev_pm_opp_remove(struct device *dev, unsigned long freq) if (IS_ERR(opp_table)) return; - if (!assert_single_clk(opp_table)) + if (!assert_single_clk(opp_table, 0)) goto put_table; mutex_lock(&opp_table->lock); @@ -2027,7 +2039,7 @@ int _opp_add_v1(struct opp_table *opp_table, struct device *dev, unsigned long tol; int ret; - if (!assert_single_clk(opp_table)) + if (!assert_single_clk(opp_table, 0)) return -EINVAL; new_opp = _opp_allocate(opp_table); @@ -2889,7 +2901,7 @@ static int _opp_set_availability(struct device *dev, unsigned long freq, return r; } - if (!assert_single_clk(opp_table)) { + if (!assert_single_clk(opp_table, 0)) { r = -EINVAL; goto put_table; } @@ -2965,7 +2977,7 @@ int dev_pm_opp_adjust_voltage(struct device *dev, unsigned long freq, return r; } - if (!assert_single_clk(opp_table)) { + if (!assert_single_clk(opp_table, 0)) { r = -EINVAL; goto put_table; } -- 2.20.1

2 1

[PATCH OLK-6.6] iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Qasim Ijaz <qasdev00(a)gmail.com> stable inclusion from stable-v6.6.76 commit 38ac76fc06bc6826a3e4b12a98efbe98432380a9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBI4 CVE: CVE-2025-21724 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e24c1551059268b37f6f40639883eafb281b8b9c ] Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type. To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type to match the operand's type. Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Link: https://patch.msgid.link/r/20250113223820.10713-1-qasdev00@gmail.com Reported-by: syzbot <syzbot+85992ace37d5b7b51635(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=85992ace37d5b7b51635 Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com> Reviewed-by: Joao Martins <joao.m.martins(a)oracle.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/iommu/iommufd/iova_bitmap.c drivers/vfio/iova_bitmap.c [Context conflicts] Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/iommu/iommufd/iova_bitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iommufd/iova_bitmap.c b/drivers/iommu/iommufd/iova_bitmap.c index ca5a1757adcd..9527db8d7ba1 100644 --- a/drivers/iommu/iommufd/iova_bitmap.c +++ b/drivers/iommu/iommufd/iova_bitmap.c @@ -130,7 +130,7 @@ struct iova_bitmap { static unsigned long iova_bitmap_offset_to_index(struct iova_bitmap *bitmap, unsigned long iova) { - unsigned long pgsize = 1 << bitmap->mapped.pgshift; + unsigned long pgsize = 1UL << bitmap->mapped.pgshift; return iova / (BITS_PER_TYPE(*bitmap->bitmap) * pgsize); } -- 2.20.1

2 1

[PATCH OLK-6.6] PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
by Xiongfeng Wang 13 Mar '25

13 Mar '25

From: Niklas Cassel <cassel(a)kernel.org> mainline inclusion from mainline-v6.14-rc1 commit 3708acbd5f169ebafe1faa519cb28adc56295546 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC3J CVE: CVE-2024-58006 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") set_bar() was modified to support dynamically changing the backing physical address of a BAR that was already configured. This means that set_bar() can be called twice, without ever calling clear_bar() (as calling clear_bar() would clear the BAR's PCI address assigned by the host). This can only be done if the new BAR size/flags does not differ from the existing BAR configuration. Add these missing checks. If we allow set_bar() to set e.g. a new BAR size that differs from the existing BAR size, the new address translation range will be smaller than the BAR size already determined by the host, which would mean that a read past the new BAR size would pass the iATU untranslated, which could allow the host to read memory not belonging to the new struct pci_epf_bar. While at it, add comments which clarifies the support for dynamically changing the physical address of a BAR. (Which was also missing.) Fixes: 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") Link: https://lore.kernel.org/r/20241213143301.4158431-10-cassel@kernel.org Signed-off-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Cc: stable(a)vger.kernel.org Conflicts: drivers/pci/controller/dwc/pcie-designware-ep.c [wxf: fix conflicts because of the following commit is not merged. commit 33a6938e0c337 "PCI: dwc: ep: Write BAR_MASK before iATU registers in pci_epc_set_bar()"] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- .../pci/controller/dwc/pcie-designware-ep.c | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c index f2e5feba5526..7fd64ac2cea1 100644 --- a/drivers/pci/controller/dwc/pcie-designware-ep.c +++ b/drivers/pci/controller/dwc/pcie-designware-ep.c @@ -256,8 +256,28 @@ static int dw_pcie_ep_set_bar(struct pci_epc *epc, u8 func_no, u8 vfunc_no, if (ret) return ret; - if (ep->epf_bar[bar]) + /* + * Certain EPF drivers dynamically change the physical address of a BAR + * (i.e. they call set_bar() twice, without ever calling clear_bar(), as + * calling clear_bar() would clear the BAR's PCI address assigned by the + * host). + */ + if (ep->epf_bar[bar]) { + /* + * We can only dynamically change a BAR if the new BAR size and + * BAR flags do not differ from the existing configuration. + */ + if (ep->epf_bar[bar]->barno != bar || + ep->epf_bar[bar]->size != size || + ep->epf_bar[bar]->flags != flags) + return -EINVAL; + + /* + * When dynamically changing a BAR, skip writing the BAR reg, as + * that would clear the BAR's PCI address assigned by the host. + */ return 0; + } dw_pcie_dbi_ro_wr_en(pci); -- 2.20.1

2 1

[PATCH OLK-6.6] afs: Fix the maximum cell name length
by Qi Xi 13 Mar '25

13 Mar '25

From: David Howells <dhowells(a)redhat.com> mainline inclusion from mainline-v6.13-rc7 commit 8fd56ad6e7c90ac2bddb0741c6b248c8c5d56ac8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQQL CVE: CVE-2025-21646 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning: WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405 because procfs limits the maximum filename length to 255. However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL). Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too. Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253. Fixes: c3e9f888263b ("afs: Implement client support for the YFSVL.GetCellName RPC op") Reported-by: syzbot+7848fee1f1e5c53f912b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/6776d25d.050a0220.3a8527.0048.GAE@google.com/ Signed-off-by: David Howells <dhowells(a)redhat.com> Link: https://lore.kernel.org/r/376236.1736180460@warthog.procyon.org.uk Tested-by: syzbot+7848fee1f1e5c53f912b(a)syzkaller.appspotmail.com cc: Marc Dionne <marc.dionne(a)auristor.com> cc: linux-afs(a)lists.infradead.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- fs/afs/afs.h | 2 +- fs/afs/afs_vl.h | 1 + fs/afs/vl_alias.c | 8 ++++++-- fs/afs/vlclient.c | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/afs/afs.h b/fs/afs/afs.h index 81815724db6c..25c17100798b 100644 --- a/fs/afs/afs.h +++ b/fs/afs/afs.h @@ -10,7 +10,7 @@ #include <linux/in.h> -#define AFS_MAXCELLNAME 256 /* Maximum length of a cell name */ +#define AFS_MAXCELLNAME 253 /* Maximum length of a cell name (DNS limited) */ #define AFS_MAXVOLNAME 64 /* Maximum length of a volume name */ #define AFS_MAXNSERVERS 8 /* Maximum servers in a basic volume record */ #define AFS_NMAXNSERVERS 13 /* Maximum servers in a N/U-class volume record */ diff --git a/fs/afs/afs_vl.h b/fs/afs/afs_vl.h index 9c65ffb8a523..8da0899fbc08 100644 --- a/fs/afs/afs_vl.h +++ b/fs/afs/afs_vl.h @@ -13,6 +13,7 @@ #define AFS_VL_PORT 7003 /* volume location service port */ #define VL_SERVICE 52 /* RxRPC service ID for the Volume Location service */ #define YFS_VL_SERVICE 2503 /* Service ID for AuriStor upgraded VL service */ +#define YFS_VL_MAXCELLNAME 256 /* Maximum length of a cell name in YFS protocol */ enum AFSVL_Operations { VLGETENTRYBYID = 503, /* AFS Get VLDB entry by ID */ diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c index f04a80e4f5c3..83cf1bfbe343 100644 --- a/fs/afs/vl_alias.c +++ b/fs/afs/vl_alias.c @@ -302,6 +302,7 @@ static char *afs_vl_get_cell_name(struct afs_cell *cell, struct key *key) static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) { struct afs_cell *master; + size_t name_len; char *cell_name; cell_name = afs_vl_get_cell_name(cell, key); @@ -313,8 +314,11 @@ static int yfs_check_canonical_cell_name(struct afs_cell *cell, struct key *key) return 0; } - master = afs_lookup_cell(cell->net, cell_name, strlen(cell_name), - NULL, false); + name_len = strlen(cell_name); + if (!name_len || name_len > AFS_MAXCELLNAME) + master = ERR_PTR(-EOPNOTSUPP); + else + master = afs_lookup_cell(cell->net, cell_name, name_len, NULL, false); kfree(cell_name); if (IS_ERR(master)) return PTR_ERR(master); diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c index 00fca3c66ba6..16653f2ffe4f 100644 --- a/fs/afs/vlclient.c +++ b/fs/afs/vlclient.c @@ -671,7 +671,7 @@ static int afs_deliver_yfsvl_get_cell_name(struct afs_call *call) return ret; namesz = ntohl(call->tmp); - if (namesz > AFS_MAXCELLNAME) + if (namesz > YFS_VL_MAXCELLNAME) return afs_protocol_error(call, afs_eproto_cellname_len); paddedsz = (namesz + 3) & ~3; call->count = namesz; -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] powerpc/pseries: Fix use after free in remove_phb_dynamic()
by Qi Xi 13 Mar '25

13 Mar '25

From: Michael Ellerman <mpe(a)ellerman.id.au> mainline inclusion from mainline-v5.18-rc1 commit fe2640bd7a62f1f7c3f55fbda31084085075bc30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1SK CVE: CVE-2022-49196 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In remove_phb_dynamic() we use &phb->io_resource, after we've called device_unregister(&host_bridge->dev). But the unregister may have freed phb, because pcibios_free_controller_deferred() is the release function for the host_bridge. If there are no outstanding references when we call device_unregister() then phb will be freed out from under us. This has gone mainly unnoticed, but with slub_debug and page_poison enabled it can lead to a crash: PID: 7574 TASK: c0000000d492cb80 CPU: 13 COMMAND: "drmgr" #0 [c0000000e4f075a0] crash_kexec at c00000000027d7dc #1 [c0000000e4f075d0] oops_end at c000000000029608 #2 [c0000000e4f07650] __bad_page_fault at c0000000000904b4 #3 [c0000000e4f076c0] do_bad_slb_fault at c00000000009a5a8 #4 [c0000000e4f076f0] data_access_slb_common_virt at c000000000008b30 Data SLB Access [380] exception frame: R0: c000000000167250 R1: c0000000e4f07a00 R2: c000000002a46100 R3: c000000002b39ce8 R4: 00000000000000c0 R5: 00000000000000a9 R6: 3894674d000000c0 R7: 0000000000000000 R8: 00000000000000ff R9: 0000000000000100 R10: 6b6b6b6b6b6b6b6b R11: 0000000000008000 R12: c00000000023da80 R13: c0000009ffd38b00 R14: 0000000000000000 R15: 000000011c87f0f0 R16: 0000000000000006 R17: 0000000000000003 R18: 0000000000000002 R19: 0000000000000004 R20: 0000000000000005 R21: 000000011c87ede8 R22: 000000011c87c5a8 R23: 000000011c87d3a0 R24: 0000000000000000 R25: 0000000000000001 R26: c0000000e4f07cc8 R27: c00000004d1cc400 R28: c0080000031d00e8 R29: c00000004d23d800 R30: c00000004d1d2400 R31: c00000004d1d2540 NIP: c000000000167258 MSR: 8000000000009033 OR3: c000000000e9f474 CTR: 0000000000000000 LR: c000000000167250 XER: 0000000020040003 CCR: 0000000024088420 MQ: 0000000000000000 DAR: 6b6b6b6b6b6b6ba3 DSISR: c0000000e4f07920 Syscall Result: fffffffffffffff2 [NIP : release_resource+56] [LR : release_resource+48] #5 [c0000000e4f07a00] release_resource at c000000000167258 (unreliable) #6 [c0000000e4f07a30] remove_phb_dynamic at c000000000105648 #7 [c0000000e4f07ab0] dlpar_remove_slot at c0080000031a09e8 [rpadlpar_io] #8 [c0000000e4f07b50] remove_slot_store at c0080000031a0b9c [rpadlpar_io] #9 [c0000000e4f07be0] kobj_attr_store at c000000000817d8c #10 [c0000000e4f07c00] sysfs_kf_write at c00000000063e504 #11 [c0000000e4f07c20] kernfs_fop_write_iter at c00000000063d868 #12 [c0000000e4f07c70] new_sync_write at c00000000054339c #13 [c0000000e4f07d10] vfs_write at c000000000546624 #14 [c0000000e4f07d60] ksys_write at c0000000005469f4 #15 [c0000000e4f07db0] system_call_exception at c000000000030840 #16 [c0000000e4f07e10] system_call_vectored_common at c00000000000c168 To avoid it, we can take a reference to the host_bridge->dev until we're done using phb. Then when we drop the reference the phb will be freed. Fixes: 2dd9c11b9d4d ("powerpc/pseries: use pci_host_bridge.release_fn() to kfree(phb)") Reported-by: David Dai <zdai(a)linux.ibm.com> Signed-off-by: Michael Ellerman <mpe(a)ellerman.id.au> Tested-by: Sachin Sant <sachinp(a)linux.ibm.com> Link: https://lore.kernel.org/r/20220318034219.1188008-1-mpe@ellerman.id.au Conflicts: arch/powerpc/platforms/pseries/pci_dlpar.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/powerpc/platforms/pseries/pci_dlpar.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c index 561917fa54a8..bf4ca557c32d 100644 --- a/arch/powerpc/platforms/pseries/pci_dlpar.c +++ b/arch/powerpc/platforms/pseries/pci_dlpar.c @@ -89,6 +89,9 @@ int remove_phb_dynamic(struct pci_controller *phb) } } + /* Keep a reference so phb isn't freed yet */ + get_device(&host_bridge->dev); + /* Remove the PCI bus and unregister the bridge device from sysfs */ phb->bus = NULL; pci_remove_bus(b); @@ -111,6 +114,7 @@ int remove_phb_dynamic(struct pci_controller *phb) * the pcibios_free_controller_deferred() callback; * see pseries_root_bridge_prepare(). */ + put_device(&host_bridge->dev); return 0; } -- 2.33.0

2 1

[PATCH OLK-6.6 v2 1/2] fuse: cleanup request queuing towards virtiofs
by Yang Erkun 13 Mar '25

13 Mar '25

From: Miklos Szeredi <mszeredi(a)redhat.com> mainline inclusion from mainline-v6.12-rc1 commit 5de8acb41c86f1d335d165e0a350441ea3a1f480 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBT4CQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Virtiofs has its own queuing mechanism, but still requests are first queued on fiq->pending to be immediately dequeued and queued onto the virtio queue. The queuing on fiq->pending is unnecessary and might even have some performance impact due to being a contention point. Forget requests are handled similarly. Move the queuing of requests and forgets into the fiq->ops->*. fuse_iqueue_ops are renamed to reflect the new semantics. Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Fixed-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Reviewed-by: Jingbo Xu <jefflexu(a)linux.alibaba.com> Tested-by: Peter-Jan Gootzen <pgootzen(a)nvidia.com> Reviewed-by: Peter-Jan Gootzen <pgootzen(a)nvidia.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/dev.c fs/fuse/fuse_i.h fs/fuse/virtio_fs.c [Context conflicts] Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/fuse/dev.c | 157 ++++++++++++++++++++++++-------------------- fs/fuse/fuse_i.h | 19 ++---- fs/fuse/virtio_fs.c | 41 ++++-------- 3 files changed, 105 insertions(+), 112 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 8573d79ef29c..51330a688b17 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -192,11 +192,22 @@ unsigned int fuse_len_args(unsigned int numargs, struct fuse_arg *args) } EXPORT_SYMBOL_GPL(fuse_len_args); -u64 fuse_get_unique(struct fuse_iqueue *fiq) +static u64 fuse_get_unique_locked(struct fuse_iqueue *fiq) { fiq->reqctr += FUSE_REQ_ID_STEP; return fiq->reqctr; } + +u64 fuse_get_unique(struct fuse_iqueue *fiq) +{ + u64 ret; + + spin_lock(&fiq->lock); + ret = fuse_get_unique_locked(fiq); + spin_unlock(&fiq->lock); + + return ret; +} EXPORT_SYMBOL_GPL(fuse_get_unique); static unsigned int fuse_req_hash(u64 unique) @@ -215,22 +226,68 @@ __releases(fiq->lock) spin_unlock(&fiq->lock); } +static void fuse_dev_queue_forget(struct fuse_iqueue *fiq, struct fuse_forget_link *forget) +{ + spin_lock(&fiq->lock); + if (fiq->connected) { + fiq->forget_list_tail->next = forget; + fiq->forget_list_tail = forget; + fuse_dev_wake_and_unlock(fiq); + } else { + kfree(forget); + spin_unlock(&fiq->lock); + } +} + +static void fuse_dev_queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) +{ + spin_lock(&fiq->lock); + if (list_empty(&req->intr_entry)) { + list_add_tail(&req->intr_entry, &fiq->interrupts); + /* + * Pairs with smp_mb() implied by test_and_set_bit() + * from fuse_request_end(). + */ + smp_mb(); + if (test_bit(FR_FINISHED, &req->flags)) { + list_del_init(&req->intr_entry); + spin_unlock(&fiq->lock); + } else { + fuse_dev_wake_and_unlock(fiq); + } + } else { + spin_unlock(&fiq->lock); + } +} + +static void fuse_dev_queue_req(struct fuse_iqueue *fiq, struct fuse_req *req) +{ + spin_lock(&fiq->lock); + if (fiq->connected) { + if (req->in.h.opcode != FUSE_NOTIFY_REPLY) + req->in.h.unique = fuse_get_unique_locked(fiq); + list_add_tail(&req->list, &fiq->pending); + fuse_dev_wake_and_unlock(fiq); + } else { + spin_unlock(&fiq->lock); + req->out.h.error = -ENOTCONN; + fuse_request_end(req); + } +} + const struct fuse_iqueue_ops fuse_dev_fiq_ops = { - .wake_forget_and_unlock = fuse_dev_wake_and_unlock, - .wake_interrupt_and_unlock = fuse_dev_wake_and_unlock, - .wake_pending_and_unlock = fuse_dev_wake_and_unlock, + .send_forget = fuse_dev_queue_forget, + .send_interrupt = fuse_dev_queue_interrupt, + .send_req = fuse_dev_queue_req, }; EXPORT_SYMBOL_GPL(fuse_dev_fiq_ops); -static void queue_request_and_unlock(struct fuse_iqueue *fiq, - struct fuse_req *req) -__releases(fiq->lock) +static void fuse_send_one(struct fuse_iqueue *fiq, struct fuse_req *req) { req->in.h.len = sizeof(struct fuse_in_header) + fuse_len_args(req->args->in_numargs, (struct fuse_arg *) req->args->in_args); - list_add_tail(&req->list, &fiq->pending); - fiq->ops->wake_pending_and_unlock(fiq); + fiq->ops->send_req(fiq, req); } void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, @@ -241,15 +298,7 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, forget->forget_one.nodeid = nodeid; forget->forget_one.nlookup = nlookup; - spin_lock(&fiq->lock); - if (fiq->connected) { - fiq->forget_list_tail->next = forget; - fiq->forget_list_tail = forget; - fiq->ops->wake_forget_and_unlock(fiq); - } else { - kfree(forget); - spin_unlock(&fiq->lock); - } + fiq->ops->send_forget(fiq, forget); } static void flush_bg_queue(struct fuse_conn *fc) @@ -263,9 +312,7 @@ static void flush_bg_queue(struct fuse_conn *fc) req = list_first_entry(&fc->bg_queue, struct fuse_req, list); list_del(&req->list); fc->active_background++; - spin_lock(&fiq->lock); - req->in.h.unique = fuse_get_unique(fiq); - queue_request_and_unlock(fiq, req); + fuse_send_one(fiq, req); } } @@ -335,29 +382,12 @@ static int queue_interrupt(struct fuse_req *req) { struct fuse_iqueue *fiq = &req->fm->fc->iq; - spin_lock(&fiq->lock); /* Check for we've sent request to interrupt this req */ - if (unlikely(!test_bit(FR_INTERRUPTED, &req->flags))) { - spin_unlock(&fiq->lock); + if (unlikely(!test_bit(FR_INTERRUPTED, &req->flags))) return -EINVAL; - } - if (list_empty(&req->intr_entry)) { - list_add_tail(&req->intr_entry, &fiq->interrupts); - /* - * Pairs with smp_mb() implied by test_and_set_bit() - * from fuse_request_end(). - */ - smp_mb(); - if (test_bit(FR_FINISHED, &req->flags)) { - list_del_init(&req->intr_entry); - spin_unlock(&fiq->lock); - return 0; - } - fiq->ops->wake_interrupt_and_unlock(fiq); - } else { - spin_unlock(&fiq->lock); - } + fiq->ops->send_interrupt(fiq, req); + return 0; } @@ -412,21 +442,15 @@ static void __fuse_request_send(struct fuse_req *req) struct fuse_iqueue *fiq = &req->fm->fc->iq; BUG_ON(test_bit(FR_BACKGROUND, &req->flags)); - spin_lock(&fiq->lock); - if (!fiq->connected) { - spin_unlock(&fiq->lock); - req->out.h.error = -ENOTCONN; - } else { - req->in.h.unique = fuse_get_unique(fiq); - /* acquire extra reference, since request is still needed - after fuse_request_end() */ - __fuse_get_request(req); - queue_request_and_unlock(fiq, req); - request_wait_answer(req); - /* Pairs with smp_wmb() in fuse_request_end() */ - smp_rmb(); - } + /* acquire extra reference, since request is still needed after + fuse_request_end() */ + __fuse_get_request(req); + fuse_send_one(fiq, req); + + request_wait_answer(req); + /* Pairs with smp_wmb() in fuse_request_end() */ + smp_rmb(); } static void fuse_adjust_compat(struct fuse_conn *fc, struct fuse_args *args) @@ -581,7 +605,6 @@ static int fuse_simple_notify_reply(struct fuse_mount *fm, { struct fuse_req *req; struct fuse_iqueue *fiq = &fm->fc->iq; - int err = 0; req = fuse_get_req(fm, false); if (IS_ERR(req)) @@ -592,16 +615,9 @@ static int fuse_simple_notify_reply(struct fuse_mount *fm, fuse_args_to_req(req, args); - spin_lock(&fiq->lock); - if (fiq->connected) { - queue_request_and_unlock(fiq, req); - } else { - err = -ENODEV; - spin_unlock(&fiq->lock); - fuse_put_request(req); - } + fuse_send_one(fiq, req); - return err; + return 0; } /* @@ -1076,9 +1092,9 @@ __releases(fiq->lock) return err ? err : reqsize; } -struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, - unsigned int max, - unsigned int *countp) +static struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, + unsigned int max, + unsigned int *countp) { struct fuse_forget_link *head = fiq->forget_list_head.next; struct fuse_forget_link **newhead = &head; @@ -1097,7 +1113,6 @@ struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, return head; } -EXPORT_SYMBOL(fuse_dequeue_forget); static int fuse_read_single_forget(struct fuse_iqueue *fiq, struct fuse_copy_state *cs, @@ -1112,7 +1127,7 @@ __releases(fiq->lock) struct fuse_in_header ih = { .opcode = FUSE_FORGET, .nodeid = forget->forget_one.nodeid, - .unique = fuse_get_unique(fiq), + .unique = fuse_get_unique_locked(fiq), .len = sizeof(ih) + sizeof(arg), }; @@ -1143,7 +1158,7 @@ __releases(fiq->lock) struct fuse_batch_forget_in arg = { .count = 0 }; struct fuse_in_header ih = { .opcode = FUSE_BATCH_FORGET, - .unique = fuse_get_unique(fiq), + .unique = fuse_get_unique_locked(fiq), .len = sizeof(ih) + sizeof(arg), }; diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 1bb136bcbe9e..8d702f96b9e5 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -416,22 +416,19 @@ struct fuse_iqueue; */ struct fuse_iqueue_ops { /** - * Signal that a forget has been queued + * Send one forget */ - void (*wake_forget_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_forget)(struct fuse_iqueue *fiq, struct fuse_forget_link *link); /** - * Signal that an INTERRUPT request has been queued + * Send interrupt for request */ - void (*wake_interrupt_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_interrupt)(struct fuse_iqueue *fiq, struct fuse_req *req); /** - * Signal that a request has been queued + * Send one request */ - void (*wake_pending_and_unlock)(struct fuse_iqueue *fiq) - __releases(fiq->lock); + void (*send_req)(struct fuse_iqueue *fiq, struct fuse_req *req); /** * Clean up when fuse_iqueue is destroyed @@ -1019,10 +1016,6 @@ void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget, struct fuse_forget_link *fuse_alloc_forget(void); -struct fuse_forget_link *fuse_dequeue_forget(struct fuse_iqueue *fiq, - unsigned int max, - unsigned int *countp); - /* * Initialize READ or READDIR request */ diff --git a/fs/fuse/virtio_fs.c b/fs/fuse/virtio_fs.c index ba816b50c1d4..a6e31e68906a 100644 --- a/fs/fuse/virtio_fs.c +++ b/fs/fuse/virtio_fs.c @@ -1083,22 +1083,13 @@ static struct virtio_driver virtio_fs_driver = { #endif }; -static void virtio_fs_wake_forget_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_forget(struct fuse_iqueue *fiq, struct fuse_forget_link *link) { - struct fuse_forget_link *link; struct virtio_fs_forget *forget; struct virtio_fs_forget_req *req; - struct virtio_fs *fs; - struct virtio_fs_vq *fsvq; - u64 unique; - - link = fuse_dequeue_forget(fiq, 1, NULL); - unique = fuse_get_unique(fiq); - - fs = fiq->priv; - fsvq = &fs->vqs[VQ_HIPRIO]; - spin_unlock(&fiq->lock); + struct virtio_fs *fs = fiq->priv; + struct virtio_fs_vq *fsvq = &fs->vqs[VQ_HIPRIO]; + u64 unique = fuse_get_unique(fiq); /* Allocate a buffer for the request */ forget = kmalloc(sizeof(*forget), GFP_NOFS | __GFP_NOFAIL); @@ -1118,8 +1109,7 @@ __releases(fiq->lock) kfree(link); } -static void virtio_fs_wake_interrupt_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) { /* * TODO interrupts. @@ -1128,7 +1118,6 @@ __releases(fiq->lock) * Exceptions are blocking lock operations; for example fcntl(F_SETLKW) * with shared lock between host and guest. */ - spin_unlock(&fiq->lock); } /* Count number of scatter-gather elements required */ @@ -1333,21 +1322,17 @@ static int virtio_fs_enqueue_req(struct virtio_fs_vq *fsvq, return ret; } -static void virtio_fs_wake_pending_and_unlock(struct fuse_iqueue *fiq) -__releases(fiq->lock) +static void virtio_fs_send_req(struct fuse_iqueue *fiq, struct fuse_req *req) { unsigned int queue_id; struct virtio_fs *fs; - struct fuse_req *req; struct virtio_fs_vq *fsvq; int ret; - WARN_ON(list_empty(&fiq->pending)); - req = list_last_entry(&fiq->pending, struct fuse_req, list); + if (req->in.h.opcode != FUSE_NOTIFY_REPLY) + req->in.h.unique = fuse_get_unique(fiq); + clear_bit(FR_PENDING, &req->flags); - list_del_init(&req->list); - WARN_ON(!list_empty(&fiq->pending)); - spin_unlock(&fiq->lock); fs = fiq->priv; queue_id = VQ_REQUEST + fs->mq_map[raw_smp_processor_id()]; @@ -1387,10 +1372,10 @@ __releases(fiq->lock) } static const struct fuse_iqueue_ops virtio_fs_fiq_ops = { - .wake_forget_and_unlock = virtio_fs_wake_forget_and_unlock, - .wake_interrupt_and_unlock = virtio_fs_wake_interrupt_and_unlock, - .wake_pending_and_unlock = virtio_fs_wake_pending_and_unlock, - .release = virtio_fs_fiq_release, + .send_forget = virtio_fs_send_forget, + .send_interrupt = virtio_fs_send_interrupt, + .send_req = virtio_fs_send_req, + .release = virtio_fs_fiq_release, }; static inline void virtio_fs_ctx_set_defaults(struct fuse_fs_context *ctx) -- 2.39.2

1 1

[PATCH OLK-6.6 0/3] some readahead improvement
by Tong Tiangen 13 Mar '25

13 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
by Guo Mengqi 13 Mar '25

13 Mar '25

From: James Smart <jsmart2021(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 577a942df3de2666f6947bdd3a5c9e8d30073424 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SH CVE: CVE-2022-49535 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 577a942df3de2666f6947bdd3a5c9e8d30073424 ] If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling. Link: https://lore.kernel.org/r/20220412222008.126521-9-jsmart2021@gmail.com Co-developed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: James Smart <jsmart2021(a)gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/lpfc/lpfc_els.c [Some contexts are not in this version] Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- drivers/scsi/lpfc/lpfc_els.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index deb9202307a9..f659a4014da3 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -1484,10 +1484,12 @@ lpfc_initial_flogi(struct lpfc_vport *vport) } if (lpfc_issue_els_flogi(vport, ndlp, 0)) { - /* This decrement of reference count to node shall kick off - * the release of the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; @@ -1531,10 +1533,12 @@ lpfc_initial_fdisc(struct lpfc_vport *vport) } if (lpfc_issue_els_fdisc(vport, ndlp, 0)) { - /* decrement node reference count to trigger the release of - * the node. + /* A node reference should be retained while registered with a + * transport or dev-loss-evt work is pending. + * Otherwise, decrement node reference to trigger release. */ - lpfc_nlp_put(ndlp); + if (!(ndlp->nlp_flag & NLP_IN_DEV_LOSS)) + lpfc_nlp_put(ndlp); return 0; } return 1; -- 2.22.0

2 1

[PATCH OLK-6-6 0/3] some readahead improvement
by Tong Tiangen 13 Mar '25

13 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

1 3

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 724815180d512a9df6b3edce9151a312b76d891d
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 724815180d512a9df6b3edce9151a312b76d891d !15461 be2net: Fix buffer overflow in be_get_module_eeprom Error/Warning (recently discovered and may have been fixed): drivers/regulator/max8973-regulator.o: warning: objtool: max8973_probe()+0x111a: can't find switch jump table samples/vfio-mdev/mdpy-fb.o: warning: objtool: missing symbol for section .text Unverified Error/Warning (likely false positive, kindly check if interested): drivers/gpu/drm/ast/ast_fb.c:114:17: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c:323:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c:353:33: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/emxx_udc/emxx_udc.c:3235:24: sparse: sparse: cast removes address space '__iomem' of expression drivers/staging/emxx_udc/emxx_udc.c:73:28: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/emxx_udc/emxx_udc.c:80:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1280:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1341:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1343:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1360:29: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1408:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1411:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1427:27: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1476:19: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1479:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1484:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1487:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1521:16: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1523:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1528:27: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1560:45: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1564:59: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1566:45: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1568:45: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1577:23: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1580:26: sparse: sparse: incorrect type in argument 1 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1611:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1616:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1641:14: sparse: sparse: incorrect type in assignment (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1646:29: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1651:13: sparse: sparse: incorrect type in initializer (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:463:66: sparse: sparse: incorrect type in argument 2 (different address spaces) drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:766:58: sparse: sparse: incorrect type in argument 2 (different address spaces) sound/soc/sunxi/sun8i-codec-analog.c:915:18: sparse: sparse: incorrect type in argument 3 (different address spaces) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-001-20250312 | |-- include-linux-uaccess.h:warning:ces32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:input-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs485-may-be-used-uninitialized | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250312 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-r132-20250309 | |-- drivers-gpu-drm-ast-ast_fb.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-got-void | |-- drivers-net-ethernet-oki-semi-pch_gbe-pch_gbe_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-reg | |-- drivers-net-ethernet-oki-semi-pch_gbe-pch_gbe_main.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-reg-got-unsigned-int-noderef-__iomem | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:cast-removes-address-space-__iomem-of-expression | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-volatile-noderef-__iomem-addr-got-void-address | |-- drivers-staging-emxx_udc-emxx_udc.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-volatile-noderef-__iomem-addr-got-void-address | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-VCHIQ_COMPLETION_DA | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_completion_da | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_dequeue_messa | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_element-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-struct-vchiq_get_config32 | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-const-noderef-__user-from-got-void-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-int-enum-VCHIQ_BULK_MODE_ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-unsigned-int-msgbufcount32 | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-to-got-void-msgbufptr | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-struct-vchiq_header_struct-usert | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-void-addressable-usertype-bulk_u | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-noderef-__user-uptr-got-void-addressable-usertype-servic | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-struct-VCHIQ_GET_CONFIG_T-usertype-args-got-void-noderef-__ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-unsigned-int-msgbufcount32-got-unsigned-int-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-msgbuf-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-assignment-(different-address-spaces)-expected-void-msgbufptr-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-int-noderef-__user-got-int | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-VCHIQ_COMPLETION_DATA_T-usertype-got-void-noderef-_ | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-VCHIQ_COMPLETION_DATA_T-usertype-noderef-__user-got | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_config_struct-usertype-got-void-noderef-__use | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_config_struct-usertype-noderef-__user-got-str | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_element-const-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-struct-vchiq_element-const-noderef-__user-got-struct-vchiq | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-int-enum-VCHIQ_BULK_MODE_T-noderef-__user-got-uns | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-unsigned-int-noderef-__user-got-unsigned-int | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-__pu_val-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-const-noderef-__user-got-void-const | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-got-void-noderef-__user | |-- drivers-staging-vc04_services-interface-vchiq_arm-vchiq_arm.c:sparse:sparse:incorrect-type-in-initializer-(different-address-spaces)-expected-void-noderef-__user-got-void | `-- sound-soc-sunxi-sun8i-codec-analog.c:sparse:sparse:incorrect-type-in-argument-(different-address-spaces)-expected-void-bus_context-got-void-noderef-__iomem-assigned-base |-- x86_64-allnoconfig | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-shmem.c:linux-share_pool.h-is-included-more-than-once. | |-- mm-swap.c:linux-memremap.h-is-included-more-than-once. | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250312 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-002-20250312 | |-- kernel-hung_task.c:error:use-of-undeclared-identifier-sysctl_hung_task_all_cpu_backtrace | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-003-20250312 | |-- drivers-rtc-rtc-ds1685.c:error:Cannot-parse-struct-or-union | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250312 | |-- drivers-regulator-max8973-regulator.o:warning:objtool:max8973_probe:can-t-find-switch-jump-table | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | |-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration | `-- samples-vfio-mdev-mdpy-fb.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-005-20250312 | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-page_alloc.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-deferred_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration `-- x86_64-defconfig |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 727m configs tested: 15 configs skipped: 100 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250312 gcc-14.2.0 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 203e3cc21c92f7c3289882030d699e95765e3e6b
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 203e3cc21c92f7c3289882030d699e95765e3e6b !15376 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.62-6.6.63 LTS Conflicts Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allmodconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250312 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- loongarch-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250312 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250312 | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier | |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-defconfig |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 728m configs tested: 17 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250312 clang-21 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch randconfig-001-20250312 gcc-14.2.0 loongarch randconfig-002-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 4fd58a13ae6e747556d318770dc39c1a58e821d9
by kernel test robot 13 Mar '25

13 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4fd58a13ae6e747556d318770dc39c1a58e821d9 !15460 v2 soc: hisilicon: Add checks against NULL pointer reference Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-003-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250312 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250312 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 765m configs tested: 14 configs skipped: 104 tested configs: arm64 allmodconfig clang-18 arm64 randconfig-001-20250312 clang-21 arm64 randconfig-002-20250312 gcc-14.2.0 arm64 randconfig-003-20250312 gcc-14.2.0 arm64 randconfig-004-20250312 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250312 clang-19 x86_64 buildonly-randconfig-002-20250312 clang-19 x86_64 buildonly-randconfig-003-20250312 gcc-12 x86_64 buildonly-randconfig-004-20250312 clang-19 x86_64 buildonly-randconfig-005-20250312 clang-19 x86_64 buildonly-randconfig-006-20250312 clang-19 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] fs/lockd: convert comma to semicolon
by longguang.yue 12 Mar '25

12 Mar '25

From: Zheng Yongjun <zhengyongjun3(a)huawei.com> stable inclusion from linux-5.11.y commit 3316fb80a0b4c1fef03a3eb1a7f0651e2133c429 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBQKK6 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ----------------- Replace a comma between expression statements by a semicolon. Signed-off-by: Zheng Yongjun <zhengyongjun3(a)huawei.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: longguang.yue <yuelg(a)chinaunicom.cn> --- fs/lockd/host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/lockd/host.c b/fs/lockd/host.c index 771c289f6df7..f802223e71ab 100644 --- a/fs/lockd/host.c +++ b/fs/lockd/host.c @@ -163,7 +163,7 @@ static struct nlm_host *nlm_alloc_host(struct nlm_lookup_host_info *ni, host->h_nsmhandle = nsm; host->h_addrbuf = nsm->sm_addrbuf; host->net = ni->net; - host->h_cred = get_cred(ni->cred), + host->h_cred = get_cred(ni->cred); strlcpy(host->nodename, utsname()->nodename, sizeof(host->nodename)); out: -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
by Zeng Heng 12 Mar '25

12 Mar '25

From: Dan Carpenter <dan.carpenter(a)oracle.com> stable inclusion from stable-v4.19.247 commit 4bdcf32c965c27f55ccc4ee71c1927131115b0bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP32T CVE: CVE-2022-49503 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ] The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to ensure that it is within the bitmap. drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept() error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()' Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept") Signed-off-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20220409061225.GA5447@kili Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/wireless/ath/ath9k/htc_drv_txrx.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index 2bca38e39721..df16b3e1f793 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -1007,6 +1007,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, goto rx_next; } + if (rxstatus->rs_keyix >= ATH_KEYMAX && + rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) { + ath_dbg(common, ANY, + "Invalid keyix, dropping (keyix: %d)\n", + rxstatus->rs_keyix); + goto rx_next; + } + /* Get the RX status information */ memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net: mdio: unexport __init-annotated mdio_bus_init()
by Wenyu Huang 12 Mar '25

12 Mar '25

From: Masahiro Yamada <masahiroy(a)kernel.org> stable inclusion from stable-v4.19.247 commit 5534bcd7c40299862237c4a8fd9c5031b3db1538 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPK8Q CVE: CVE-2022-49350 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 35b42dce619701f1300fb8498dae82c9bb1f0263 ] EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, drivers/net/phy/phy_device.c is never compiled as modular. (CONFIG_PHYLIB is boolean) Fixes: 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") Reported-by: Stephen Rothwell <sfr(a)canb.auug.org.au> Signed-off-by: Masahiro Yamada <masahiroy(a)kernel.org> Reviewed-by: Florian Fainelli <f.fainelli(a)gmail.com> Reviewed-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 82cc1983c09a..35937175c4e8 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -745,7 +745,6 @@ int __init mdio_bus_init(void) return ret; } -EXPORT_SYMBOL_GPL(mdio_bus_init); #if IS_ENABLED(CONFIG_PHYLIB) void mdio_bus_exit(void) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
by Zeng Heng 12 Mar '25

12 Mar '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.247 commit 9345122f5fb9f97a206f440f38bb656e53f46912 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KL CVE: CVE-2022-49517 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 05654431a18fe24e5e46a375d98904134628a102 ] This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. Fixes: 8625c1dbd876 ("ASoC: mediatek: Add mt2701-wm8960 machine driver") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Link: https://lore.kernel.org/r/20220404093526.30004-1-linmq006@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sound/soc/mediatek/mt2701/mt2701-wm8960.c b/sound/soc/mediatek/mt2701/mt2701-wm8960.c index 89f34efd9747..a5ede216b795 100644 --- a/sound/soc/mediatek/mt2701/mt2701-wm8960.c +++ b/sound/soc/mediatek/mt2701/mt2701-wm8960.c @@ -118,7 +118,8 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) if (!codec_node) { dev_err(&pdev->dev, "Property 'audio-codec' missing or invalid\n"); - return -EINVAL; + ret = -EINVAL; + goto put_platform_node; } for (i = 0; i < card->num_links; i++) { if (mt2701_wm8960_dai_links[i].codec_name) @@ -129,7 +130,7 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) ret = snd_soc_of_parse_audio_routing(card, "audio-routing"); if (ret) { dev_err(&pdev->dev, "failed to parse audio-routing: %d\n", ret); - return ret; + goto put_codec_node; } ret = devm_snd_soc_register_card(&pdev->dev, card); @@ -137,6 +138,10 @@ static int mt2701_wm8960_machine_probe(struct platform_device *pdev) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); +put_codec_node: + of_node_put(codec_node); +put_platform_node: + of_node_put(platform_node); return ret; } -- 2.25.1

2 1

[PATCH OLK-6-6 0/3] some readahead improvement
by Tong Tiangen 12 Mar '25

12 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() mm/readahead.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49490
by Zeng Heng 12 Mar '25

12 Mar '25

Jessica Zhang (1): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected Rob Clark (1): drm/msm/mdp5: Fix global state lock backoff drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 18 +++++++++++++----- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49490
by Zeng Heng 12 Mar '25

12 Mar '25

Jessica Zhang (1): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected Rob Clark (1): drm/msm/mdp5: Fix global state lock backoff drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 18 +++++++++++++----- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 30 insertions(+), 10 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
by Zeng Heng 12 Mar '25

12 Mar '25

From: Jessica Zhang <quic_jesszhan(a)quicinc.com> stable inclusion from stable-v4.19.247 commit 776f5c58bfe16cf322d71eeed3c5dda1eeac7e6b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP1O4 CVE: CVE-2022-49490 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d59be579fa932c46b908f37509f319cbd4ca9a68 ] mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring the modeset lock, but currently mdp5_pipe_release doesn't check for if an error is returned. Because of this, there is a possibility of mdp5_pipe_release hitting a NULL dereference error. To avoid this, let's have mdp5_pipe_release check if mdp5_get_global_state returns an error and propogate that error. Changes since v1: - Separated declaration and initialization of *new_state to avoid compiler warning - Fixed some spelling mistakes in commit message Changes since v2: - Return 0 in case where hwpipe is NULL as this is considered normal behavior - Added 2nd patch in series to fix a similar NULL dereference issue in mdp5_mixer_release Reported-by: Tomeu Vizoso <tomeu.vizoso(a)collabora.com> Signed-off-by: Jessica Zhang <quic_jesszhan(a)quicinc.com> Fixes: 7907a0d77cb4 ("drm/msm/mdp5: Use the new private_obj state") Reviewed-by: Rob Clark <robdclark(a)gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Patchwork: https://patchwork.freedesktop.org/patch/485179/ Link: https://lore.kernel.org/r/20220505214051.155-1-quic_jesszhan@quicinc.com Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +++++++++++---- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 ++++++++++++++++---- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c index 1ef26bc63163..88de12225582 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c @@ -130,18 +130,23 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, return 0; } -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) { struct msm_drm_private *priv = s->dev->dev_private; struct mdp5_kms *mdp5_kms = to_mdp5_kms(to_mdp_kms(priv->kms)); struct mdp5_global_state *state = mdp5_get_global_state(s); - struct mdp5_hw_pipe_state *new_state = &state->hwpipe; + struct mdp5_hw_pipe_state *new_state; if (!hwpipe) - return; + return 0; + + if (IS_ERR(state)) + return PTR_ERR(state); + + new_state = &state->hwpipe; if (WARN_ON(!new_state->hwpipe_to_plane[hwpipe->idx])) - return; + return -EINVAL; DBG("%s: release from plane %s", hwpipe->name, new_state->hwpipe_to_plane[hwpipe->idx]->name); @@ -152,6 +157,8 @@ void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe) } new_state->hwpipe_to_plane[hwpipe->idx] = NULL; + + return 0; } void mdp5_pipe_destroy(struct mdp5_hw_pipe *hwpipe) diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h index bb2b0ac7aa2b..072db6a99b85 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h @@ -48,7 +48,7 @@ int mdp5_pipe_assign(struct drm_atomic_state *s, struct drm_plane *plane, uint32_t caps, uint32_t blkcfg, struct mdp5_hw_pipe **hwpipe, struct mdp5_hw_pipe **r_hwpipe); -void mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); +int mdp5_pipe_release(struct drm_atomic_state *s, struct mdp5_hw_pipe *hwpipe); struct mdp5_hw_pipe *mdp5_pipe_init(enum mdp5_pipe pipe, uint32_t reg_offset, uint32_t caps); diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c index 1ddf07514de6..85bbae26b17e 100644 --- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c +++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c @@ -399,12 +399,24 @@ static int mdp5_plane_atomic_check_with_state(struct drm_crtc_state *crtc_state, mdp5_state->r_hwpipe = NULL; - mdp5_pipe_release(state->state, old_hwpipe); - mdp5_pipe_release(state->state, old_right_hwpipe); + ret = mdp5_pipe_release(state->state, old_hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, old_right_hwpipe); + if (ret) + return ret; + } } else { - mdp5_pipe_release(state->state, mdp5_state->hwpipe); - mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + ret = mdp5_pipe_release(state->state, mdp5_state->hwpipe); + if (ret) + return ret; + + ret = mdp5_pipe_release(state->state, mdp5_state->r_hwpipe); + if (ret) + return ret; + mdp5_state->hwpipe = mdp5_state->r_hwpipe = NULL; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] be2net: Fix buffer overflow in be_get_module_eeprom
by Zeng Heng 12 Mar '25

12 Mar '25

From: Hristo Venev <hristo(a)venev.name> stable inclusion from stable-v4.19.254 commit 8ff4f9df73e5c551a72ee6034886c17e8de6596d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6VF CVE: CVE-2022-49581 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d7241f679a59cfe27f92cb5c6272cb429fb1f7ec ] be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only copy the bytes once. Fixes: e36edd9d26cf ("be2net: add ethtool "-m" option support") Signed-off-by: Hristo Venev <hristo(a)venev.name> Link: https://lore.kernel.org/r/20220716085134.6095-1-hristo@venev.name Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/ethernet/emulex/benet/be_cmds.c | 10 +++--- drivers/net/ethernet/emulex/benet/be_cmds.h | 2 +- .../net/ethernet/emulex/benet/be_ethtool.c | 31 ++++++++++++------- 3 files changed, 25 insertions(+), 18 deletions(-) diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c index 1e9d882c04ef..a4a448d97451 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.c +++ b/drivers/net/ethernet/emulex/benet/be_cmds.c @@ -2291,7 +2291,7 @@ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state) /* Uses sync mcc */ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - u8 page_num, u8 *data) + u8 page_num, u32 off, u32 len, u8 *data) { struct be_dma_mem cmd; struct be_mcc_wrb *wrb; @@ -2325,10 +2325,10 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, req->port = cpu_to_le32(adapter->hba_port_num); req->page_num = cpu_to_le32(page_num); status = be_mcc_notify_wait(adapter); - if (!status) { + if (!status && len > 0) { struct be_cmd_resp_port_type *resp = cmd.va; - memcpy(data, resp->page_data, PAGE_DATA_LEN); + memcpy(data, resp->page_data + off, len); } err: mutex_unlock(&adapter->mcc_lock); @@ -2419,7 +2419,7 @@ int be_cmd_query_cable_type(struct be_adapter *adapter) int status; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { switch (adapter->phy.interface_type) { case PHY_TYPE_QSFP: @@ -2444,7 +2444,7 @@ int be_cmd_query_sfp_info(struct be_adapter *adapter) int status; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { strlcpy(adapter->phy.vendor_name, page_data + SFP_VENDOR_NAME_OFFSET, SFP_VENDOR_NAME_LEN - 1); diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethernet/emulex/benet/be_cmds.h index e8b43cf44b6f..f6f9c51a7d47 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.h +++ b/drivers/net/ethernet/emulex/benet/be_cmds.h @@ -2431,7 +2431,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, u8 beacon, int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state); int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - u8 page_num, u8 *data); + u8 page_num, u32 off, u32 len, u8 *data); int be_cmd_query_cable_type(struct be_adapter *adapter); int be_cmd_query_sfp_info(struct be_adapter *adapter); int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd, diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/ethernet/emulex/benet/be_ethtool.c index d1905d50c26c..1c1ac3488da2 100644 --- a/drivers/net/ethernet/emulex/benet/be_ethtool.c +++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c @@ -1342,7 +1342,7 @@ static int be_get_module_info(struct net_device *netdev, return -EOPNOTSUPP; status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { if (!page_data[SFP_PLUS_SFF_8472_COMP]) { modinfo->type = ETH_MODULE_SFF_8079; @@ -1360,25 +1360,32 @@ static int be_get_module_eeprom(struct net_device *netdev, { struct be_adapter *adapter = netdev_priv(netdev); int status; + u32 begin, end; if (!check_privilege(adapter, MAX_PRIVILEGES)) return -EOPNOTSUPP; - status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - data); - if (status) - goto err; + begin = eeprom->offset; + end = eeprom->offset + eeprom->len; + + if (begin < PAGE_DATA_LEN) { + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, begin, + min_t(u32, end, PAGE_DATA_LEN) - begin, + data); + if (status) + goto err; + + data += PAGE_DATA_LEN - begin; + begin = PAGE_DATA_LEN; + } - if (eeprom->offset + eeprom->len > PAGE_DATA_LEN) { - status = be_cmd_read_port_transceiver_data(adapter, - TR_PAGE_A2, - data + - PAGE_DATA_LEN); + if (end > PAGE_DATA_LEN) { + status = be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A2, + begin - PAGE_DATA_LEN, + end - begin, data); if (status) goto err; } - if (eeprom->offset) - memcpy(data, data + eeprom->offset, eeprom->len); err: return be_cmd_status(status); } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1473/1473] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:72:28: sparse: sparse: symbol 'nic_cmd_support_vf' was not declared. Should it be static?
by kernel test robot 12 Mar '25

12 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 09e192513a17ce8324302ae595ebf001e08e13b0 commit: 746ea35981b1f77e988d48642409d73f0470b3eb [1473/1473] net: hinic: Add Hardware Abstract Layer config: arm64-randconfig-r132-20250309 (https://download.01.org/0day-ci/archive/20250312/202503121425.Yho9rU1a-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20250312/202503121425.Yho9rU1a-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503121425.Yho9rU1a-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:72:28: sparse: sparse: symbol 'nic_cmd_support_vf' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:398:5: sparse: sparse: symbol 'hinic_hiovs_set_cpath_vlan' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:424:5: sparse: sparse: symbol 'hinic_hiovs_del_cpath_vlan' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] group_index @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: expected unsigned int [usertype] group_index drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1541:30: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1544:23: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] ctx @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: expected unsigned int [usertype] ctx drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1546:22: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] group_index @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: expected unsigned int [usertype] group_index drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1728:32: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1735:31: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1742:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] offset @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: expected unsigned int [usertype] offset drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1754:27: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] size @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: expected unsigned int [usertype] size drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:1755:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:2349:5: sparse: sparse: symbol 'nic_pf_mbox_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:3237:5: sparse: sparse: symbol 'hw_speed_convert' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:398:5: warning: no previous prototype for 'hinic_hiovs_set_cpath_vlan' [-Wmissing-prototypes] 398 | int hinic_hiovs_set_cpath_vlan(void *hwdev, u16 vlan_id, u16 pf_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:424:5: warning: no previous prototype for 'hinic_hiovs_del_cpath_vlan' [-Wmissing-prototypes] 424 | int hinic_hiovs_del_cpath_vlan(void *hwdev, u16 vlan_id, u16 pf_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c:2349:5: warning: no previous prototype for 'nic_pf_mbox_handler' [-Wmissing-prototypes] 2349 | int nic_pf_mbox_handler(void *hwdev, u16 vf_id, u8 cmd, void *buf_in, | ^~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:346:6: sparse: sparse: symbol 'hinic_qp_prepare_cmdq_header' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:379:24: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:365:6: sparse: sparse: symbol 'hinic_sq_prepare_ctxt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:441:24: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:427:6: sparse: sparse: symbol 'hinic_rq_prepare_ctxt' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:843:16: sparse: sparse: cast to restricted __be16 >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [usertype] db_info @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: expected unsigned int [addressable] [usertype] db_info drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:913:23: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned long long [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:917:9: sparse: got unsigned long long [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: expected unsigned short [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:974:27: sparse: got restricted __be16 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:346:6: warning: no previous prototype for 'hinic_qp_prepare_cmdq_header' [-Wmissing-prototypes] 346 | void hinic_qp_prepare_cmdq_header(struct hinic_qp_ctxt_header *qp_ctxt_hdr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:365:6: warning: no previous prototype for 'hinic_sq_prepare_ctxt' [-Wmissing-prototypes] 365 | void hinic_sq_prepare_ctxt(struct hinic_sq *sq, u16 global_qpn, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_nic_io.c:427:6: warning: no previous prototype for 'hinic_rq_prepare_ctxt' [-Wmissing-prototypes] 427 | void hinic_rq_prepare_ctxt(struct hinic_rq *rq, struct hinic_rq_ctxt *rq_ctxt) | ^~~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: sparse: incorrect type in return expression (different base types) @@ expected unsigned short @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: expected unsigned short drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:100:24: sparse: got restricted __be16 [usertype] drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c:159:22: sparse: sparse: cast removes address space '__iomem' of expression -- >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:37:16: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: expected unsigned int [usertype] val drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:43:9: sparse: sparse: cast from restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:552:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:553:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:557:23: sparse: got void *db_base >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dwqe_mapping @@ got void *dwqe_mapping @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: expected void [noderef] __iomem *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:558:28: sparse: got void *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:620:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] flag @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: expected restricted gfp_t [usertype] flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:635:65: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:52: warning: Function parameter or member 'hwdev' not described in 'hwif_ready' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:52: warning: Excess function parameter 'hwif' description in 'hwif_ready' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'hwdev' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'cfg_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'intr_reg_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'db_base_phy' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'db_base' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Function parameter or member 'dwqe_mapping' not described in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Excess function parameter 'hwif' description in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:541: warning: Excess function parameter 'pdev' description in 'hinic_init_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Function parameter or member 'hwdev' not described in 'hinic_free_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Excess function parameter 'hwif' description in 'hinic_free_hwif' drivers/net/ethernet/huawei/hinic/hinic_hwif.c:607: warning: Excess function parameter 'pdev' description in 'hinic_free_hwif' -- >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:418:29: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: sparse: mixing different enum types: drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: unsigned int enum hinic_aeq_type drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:39: sparse: unsigned int enum hinic_ucode_event_type >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:431:37: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_eqs.c:479:24: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_eqs.c:765:25: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] desc @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: expected unsigned int [usertype] desc drivers/net/ethernet/huawei/hinic/hinic_eqs.c:783:28: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_eqs.c: In function 'aeq_irq_handler': drivers/net/ethernet/huawei/hinic/hinic_eqs.c:426:37: warning: implicit conversion from 'enum hinic_aeq_type' to 'enum hinic_ucode_event_type' [-Wenum-conversion] 426 | ucode_event = event; | ^ drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Function parameter or member 'hwe_cb' not described in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'eqs' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'handle' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:238: warning: Excess function parameter 'hw_cb' description in 'hinic_aeq_register_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:258: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_unregister_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:258: warning: Excess function parameter 'eqs' description in 'hinic_aeq_unregister_hw_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Function parameter or member 'aeq_swe_cb' not described in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'eqs' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'handle' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:280: warning: Excess function parameter 'sw_cb' description in 'hinic_aeq_register_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:300: warning: Function parameter or member 'hwdev' not described in 'hinic_aeq_unregister_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:300: warning: Excess function parameter 'eqs' description in 'hinic_aeq_unregister_swe_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Function parameter or member 'hwdev' not described in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Function parameter or member 'callback' not described in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'ceqs' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'handle' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:322: warning: Excess function parameter 'ceq_cb' description in 'hinic_ceq_register_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:342: warning: Function parameter or member 'hwdev' not described in 'hinic_ceq_unregister_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:342: warning: Excess function parameter 'ceqs' description in 'hinic_ceq_unregister_cb' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:361: warning: Function parameter or member 'arm_state' not described in 'set_eq_cons_idx' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:382: warning: Function parameter or member 'ceqs' not described in 'ceq_event_handler' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:382: warning: Excess function parameter 'eqs' description in 'ceq_event_handler' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Function parameter or member 'hwdev' not described in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Excess function parameter 'hwif' description in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:954: warning: Excess function parameter 'page_size' description in 'init_eq' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Function parameter or member 'hwdev' not described in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Function parameter or member 'num_aeqs' not described in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'aeqs' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'hwif' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'num_ceqs' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'q_len' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1084: warning: Excess function parameter 'page_size' description in 'hinic_aeqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1139: warning: Function parameter or member 'hwdev' not described in 'hinic_aeqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1139: warning: Excess function parameter 'aeqs' description in 'hinic_aeqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Function parameter or member 'hwdev' not described in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'ceqs' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'hwif' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'q_len' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1171: warning: Excess function parameter 'page_size' description in 'hinic_ceqs_init' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1222: warning: Function parameter or member 'hwdev' not described in 'hinic_ceqs_free' drivers/net/ethernet/huawei/hinic/hinic_eqs.c:1222: warning: Excess function parameter 'ceqs' description in 'hinic_ceqs_free' -- >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:735:5: sparse: sparse: symbol 'set_vf_mbox_random_id' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:813:21: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:787:6: sparse: sparse: symbol 'check_vf_mbox_random_id' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_mbox.c:893:54: sparse: got unsigned char [usertype] * drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_mbox.c:909:58: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:947:6: sparse: sparse: symbol 'dump_mox_reg' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_mbox.c:962:22: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [usertype] *data @@ got unsigned char [noderef] [usertype] __iomem * @@ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: expected unsigned char [usertype] *data drivers/net/ethernet/huawei/hinic/hinic_mbox.c:1450:25: sparse: got unsigned char [noderef] [usertype] __iomem * drivers/net/ethernet/huawei/hinic/hinic_mbox.c:735:5: warning: no previous prototype for 'set_vf_mbox_random_id' [-Wmissing-prototypes] 735 | int set_vf_mbox_random_id(struct hinic_hwdev *hwdev, u16 func_id) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:787:6: warning: no previous prototype for 'check_vf_mbox_random_id' [-Wmissing-prototypes] 787 | bool check_vf_mbox_random_id(struct hinic_mbox_func_to_func *func_to_func, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:947:6: warning: no previous prototype for 'dump_mox_reg' [-Wmissing-prototypes] 947 | void dump_mox_reg(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_mbox.c:265: warning: Function parameter or member 'hwdev' not described in 'hinic_register_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:265: warning: Excess function parameter 'func_to_func' description in 'hinic_register_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:287: warning: Function parameter or member 'hwdev' not described in 'hinic_register_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:287: warning: Excess function parameter 'func_to_func' description in 'hinic_register_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:309: warning: Function parameter or member 'hwdev' not described in 'hinic_register_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:309: warning: Excess function parameter 'func_to_func' description in 'hinic_register_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:331: warning: Function parameter or member 'hwdev' not described in 'hinic_register_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:331: warning: Excess function parameter 'func_to_func' description in 'hinic_register_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:350: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:350: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:364: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:364: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:378: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:378: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_vf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:392: warning: Function parameter or member 'hwdev' not described in 'hinic_unregister_ppf_to_pf_mbox_cb' drivers/net/ethernet/huawei/hinic/hinic_mbox.c:392: warning: Excess function parameter 'func_to_func' description in 'hinic_unregister_ppf_to_pf_mbox_cb' -- >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:160:31: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:241:20: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] desc @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: expected unsigned long long [usertype] desc drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:302:20: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:353:20: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:357:25: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:417:31: sparse: sparse: cast to restricted __be64 >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_cmd_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: expected unsigned long long [usertype] hw_cmd_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:776:41: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_cmd_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: expected unsigned long long [usertype] hw_cmd_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:782:42: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] hw_wb_resp_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: expected unsigned long long [usertype] hw_wb_resp_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:809:37: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] next_cell_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: expected unsigned long long [usertype] next_cell_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:887:43: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] next_cell_paddr @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: expected unsigned long long [usertype] next_cell_paddr drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:930:31: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: expected unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:999:47: sparse: got restricted gfp_t drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:515:17: sparse: sparse: context imbalance in 'api_cmd' - different lock contexts for basic block drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c: In function 'api_chain_init': drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1033:41: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] 1033 | sema_deinit(&chain->sem); | ^ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c: In function 'api_chain_free': drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1056:41: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] 1056 | sema_deinit(&chain->sem); | ^ drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:197: warning: Function parameter or member 'cmd_size' not described in 'get_cell_data_size' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:411: warning: Function parameter or member 'ctxt' not described in 'wait_for_resp_polling' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:411: warning: Excess function parameter 'chain' description in 'wait_for_resp_polling' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ctxt' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ack' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:443: warning: Function parameter or member 'ack_size' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'cmd_size' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'ack' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Function parameter or member 'ack_size' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:502: warning: Excess function parameter 'size' description in 'api_cmd' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:565: warning: Function parameter or member 'cmd_chain' not described in 'api_cmd_hw_restart' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:565: warning: Excess function parameter 'chain' description in 'api_cmd_hw_restart' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1068: warning: Function parameter or member 'cmd_chain' not described in 'api_cmd_create_chain' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1068: warning: Excess function parameter 'chain' description in 'api_cmd_create_chain' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1132: warning: Function parameter or member 'hwdev' not described in 'hinic_api_cmd_init' drivers/net/ethernet/huawei/hinic/hinic_api_cmd.c:1132: warning: Excess function parameter 'hwif' description in 'hinic_api_cmd_init' -- >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected unsigned int flag @@ got restricted gfp_t @@ drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: expected unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_wq.c:208:55: sparse: got restricted gfp_t >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_wq.c:214:24: sparse: got restricted __be64 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_wq.c:587:16: sparse: sparse: cast to restricted __be64 -- >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [usertype] db_info @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: expected unsigned int [addressable] [usertype] db_info drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:366:20: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:369:9: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:511:31: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long [usertype] @@ got restricted __be64 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: expected unsigned long long [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:517:40: sparse: got restricted __be64 [usertype] drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:531:21: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1080:27: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1151:25: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1217:37: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1245:31: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:26: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got unsigned char [usertype] * @@ drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1315:23: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1334:5: sparse: sparse: symbol 'hinic_set_cmdq_ctxts' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cmdq.c:1334:5: warning: no previous prototype for 'hinic_set_cmdq_ctxts' [-Wmissing-prototypes] 1334 | int hinic_set_cmdq_ctxts(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~ -- >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:223:5: sparse: sparse: symbol 'hinic_hw_rx_buf_size' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:629:28: sparse: sparse: symbol 'hw_cmd_support_vf' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:659:30: sparse: sparse: symbol 'mgmt_status_log' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:722:6: sparse: sparse: symbol 'hinic_print_status_info' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1039:5: sparse: sparse: symbol 'hinic_msg_to_mgmt_no_ack' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: expected unsigned int [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1106:22: sparse: got restricted __be32 [usertype] >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1128:24: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1826:5: sparse: sparse: symbol 'hinic_sync_heartbeat_status' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1928:5: sparse: sparse: symbol 'comm_pf_mbox_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2617:5: sparse: sparse: symbol 'ppf_ht_gpa_set' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2663:5: sparse: sparse: symbol 'hinic_ppf_ht_gpa_init' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2709:6: sparse: sparse: symbol 'hinic_ppf_ht_gpa_deinit' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4205:6: sparse: sparse: symbol 'pf_fault_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4213:6: sparse: sparse: symbol 'mgmt_watchdog_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4220:6: sparse: sparse: symbol 'mgmt_fmw_act_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4227:6: sparse: sparse: symbol 'mgmt_pcie_dfx_event_handler' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4234:6: sparse: sparse: symbol 'mgmt_get_mctp_event_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4517:5: sparse: sparse: symbol '_set_led_status' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4603:5: sparse: sparse: symbol 'hinic_get_phy_init_status' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4807:5: sparse: sparse: symbol 'hinic_read_reg' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4985:23: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [addressable] [assigned] [usertype] val @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: expected unsigned int [addressable] [assigned] [usertype] val drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4991:21: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:722:6: warning: no previous prototype for 'hinic_print_status_info' [-Wmissing-prototypes] 722 | void hinic_print_status_info(void *hwdev, enum hinic_mod_type mod, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1039:5: warning: no previous prototype for 'hinic_msg_to_mgmt_no_ack' [-Wmissing-prototypes] 1039 | int hinic_msg_to_mgmt_no_ack(void *hwdev, enum hinic_mod_type mod, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1826:5: warning: no previous prototype for 'hinic_sync_heartbeat_status' [-Wmissing-prototypes] 1826 | int hinic_sync_heartbeat_status(struct hinic_hwdev *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1928:5: warning: no previous prototype for 'comm_pf_mbox_handler' [-Wmissing-prototypes] 1928 | int comm_pf_mbox_handler(void *handle, u16 vf_id, u8 cmd, void *buf_in, | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2617:5: warning: no previous prototype for 'ppf_ht_gpa_set' [-Wmissing-prototypes] 2617 | int ppf_ht_gpa_set(struct hinic_hwdev *hwdev, struct hinic_page_addr *pg0, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2663:5: warning: no previous prototype for 'hinic_ppf_ht_gpa_init' [-Wmissing-prototypes] 2663 | int hinic_ppf_ht_gpa_init(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2709:6: warning: no previous prototype for 'hinic_ppf_ht_gpa_deinit' [-Wmissing-prototypes] 2709 | void hinic_ppf_ht_gpa_deinit(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2786:5: warning: no previous prototype for 'mqm_eqm_try_alloc_mem' [-Wmissing-prototypes] 2786 | int mqm_eqm_try_alloc_mem(struct hinic_hwdev *hwdev, u32 page_size, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2823:5: warning: no previous prototype for 'mqm_eqm_alloc_page_mem' [-Wmissing-prototypes] 2823 | int mqm_eqm_alloc_page_mem(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2848:6: warning: no previous prototype for 'mqm_eqm_free_page_mem' [-Wmissing-prototypes] 2848 | void mqm_eqm_free_page_mem(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2864:5: warning: no previous prototype for 'mqm_eqm_set_cfg_2_hw' [-Wmissing-prototypes] 2864 | int mqm_eqm_set_cfg_2_hw(struct hinic_hwdev *hwdev, u32 valid) | ^~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2889:5: warning: no previous prototype for 'mqm_eqm_set_page_2_hw' [-Wmissing-prototypes] 2889 | int mqm_eqm_set_page_2_hw(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:2967:5: warning: no previous prototype for 'mqm_eqm_init' [-Wmissing-prototypes] 2967 | int mqm_eqm_init(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3030:6: warning: no previous prototype for 'mqm_eqm_deinit' [-Wmissing-prototypes] 3030 | void mqm_eqm_deinit(struct hinic_hwdev *hwdev) | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3932:6: warning: no previous prototype for 'print_hilink_info' [-Wmissing-prototypes] 3932 | void print_hilink_info(struct hinic_hwdev *hwdev, | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4205:6: warning: no previous prototype for 'pf_fault_event_handler' [-Wmissing-prototypes] 4205 | void pf_fault_event_handler(void *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4213:6: warning: no previous prototype for 'mgmt_watchdog_event_handler' [-Wmissing-prototypes] 4213 | void mgmt_watchdog_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4220:6: warning: no previous prototype for 'mgmt_fmw_act_event_handler' [-Wmissing-prototypes] 4220 | void mgmt_fmw_act_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4227:6: warning: no previous prototype for 'mgmt_pcie_dfx_event_handler' [-Wmissing-prototypes] 4227 | void mgmt_pcie_dfx_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4234:6: warning: no previous prototype for 'mgmt_get_mctp_event_handler' [-Wmissing-prototypes] 4234 | void mgmt_get_mctp_event_handler(void *hwdev, void *buf_in, u16 in_size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4517:5: warning: no previous prototype for '_set_led_status' [-Wmissing-prototypes] 4517 | int _set_led_status(struct hinic_hwdev *hwdev, u8 port, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4603:5: warning: no previous prototype for 'hinic_get_phy_init_status' [-Wmissing-prototypes] 4603 | int hinic_get_phy_init_status(void *hwdev, | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4807:5: warning: no previous prototype for 'hinic_read_reg' [-Wmissing-prototypes] 4807 | int hinic_read_reg(void *hwdev, u32 reg_addr, u32 *val) | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4894:5: warning: no previous prototype for 'hinic_register_fault_recover' [-Wmissing-prototypes] 4894 | int hinic_register_fault_recover(void *hwdev, void *pri_handle, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:4916:5: warning: no previous prototype for 'hinic_unregister_fault_recover' [-Wmissing-prototypes] 4916 | int hinic_unregister_fault_recover(void *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c: In function '__print_cable_info.isra': drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3849:29: warning: ', Temperature: ' directive output may be truncated writing 15 bytes into a region of size between 0 and 511 [-Wformat-truncation=] 3849 | "%s, Temperature: %u", tmp_str, | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3849:26: note: directive argument in the range [0, 255] 3849 | "%s, Temperature: %u", tmp_str, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3848:17: note: 'snprintf' output between 17 and 530 bytes into a destination of size 511 3848 | snprintf(tmp_str, sizeof(tmp_str) - 1, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3849 | "%s, Temperature: %u", tmp_str, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3850 | info->cable_temp); | ~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3848:17: warning: 'snprintf' argument 4 overlaps destination object 'tmp_str' [-Wrestrict] drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:3812:14: note: destination object referenced by 'restrict'-qualified argument 1 was declared here 3812 | char tmp_str[512] = {0}; | ^~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1721: warning: Function parameter or member 'hwdev' not described in 'set_pf_dma_attr_entry' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1721: warning: Excess function parameter 'hwif' description in 'set_pf_dma_attr_entry' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1780: warning: Function parameter or member 'hwdev' not described in 'dma_attr_table_init' drivers/net/ethernet/huawei/hinic/hinic_hwdev.c:1780: warning: Excess function parameter 'hwif' description in 'dma_attr_table_init' -- >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:41:6: sparse: sparse: symbol 'g_test_qpc_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:42:6: sparse: sparse: symbol 'g_test_qpc_resvd_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:43:6: sparse: sparse: symbol 'g_test_pagesize_reorder' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:44:6: sparse: sparse: symbol 'g_test_xid_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:45:6: sparse: sparse: symbol 'g_test_gpa_check_enable' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:46:6: sparse: sparse: symbol 'g_test_qpc_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:47:6: sparse: sparse: symbol 'g_test_scqc_alloc_mode' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:48:6: sparse: sparse: symbol 'g_test_max_conn' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:49:6: sparse: sparse: symbol 'g_test_max_cache_conn' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:50:6: sparse: sparse: symbol 'g_test_scqc_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:51:6: sparse: sparse: symbol 'g_test_mpt_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:52:6: sparse: sparse: symbol 'g_test_mpt_resvd' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:53:6: sparse: sparse: symbol 'g_test_scq_resvd' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:54:6: sparse: sparse: symbol 'g_test_hash_num' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:55:6: sparse: sparse: symbol 'g_test_reorder_num' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1411:5: sparse: sparse: symbol 'init_cfg_mgmt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1458:6: sparse: sparse: symbol 'free_cfg_mgmt' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1493:5: sparse: sparse: symbol 'init_capability' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1522:6: sparse: sparse: symbol 'free_capability' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1732:5: sparse: sparse: symbol 'cfg_set_func_sf_en' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1770:5: sparse: sparse: symbol 'cfg_get_func_sf_en' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1096:5: warning: no previous prototype for 'hinic_vector_to_irq' [-Wmissing-prototypes] 1096 | int hinic_vector_to_irq(void *hwdev, enum hinic_service_type type, int vector) | ^~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1411:5: warning: no previous prototype for 'init_cfg_mgmt' [-Wmissing-prototypes] 1411 | int init_cfg_mgmt(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1458:6: warning: no previous prototype for 'free_cfg_mgmt' [-Wmissing-prototypes] 1458 | void free_cfg_mgmt(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1493:5: warning: no previous prototype for 'init_capability' [-Wmissing-prototypes] 1493 | int init_capability(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1522:6: warning: no previous prototype for 'free_capability' [-Wmissing-prototypes] 1522 | void free_capability(struct hinic_hwdev *dev) | ^~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1732:5: warning: no previous prototype for 'cfg_set_func_sf_en' [-Wmissing-prototypes] 1732 | int cfg_set_func_sf_en(void *hwdev, u32 enbits, u32 enmask) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_cfg.c:1770:5: warning: no previous prototype for 'cfg_get_func_sf_en' [-Wmissing-prototypes] 1770 | int cfg_get_func_sf_en(void *hwdev, u32 *enbits) | ^~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:66:6: sparse: sparse: symbol 'get_slave_host_enable' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:589:6: sparse: sparse: symbol 'comm_ppf_to_pf_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:607:5: sparse: sparse: symbol 'hinic_nic_ppf_mbox_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:616:6: sparse: sparse: symbol 'hinic_nic_ppf_to_pf_handler' was not declared. Should it be static? >> drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:625:5: sparse: sparse: symbol 'hinic_register_slave_ppf' was not declared. Should it be static? drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:66:6: warning: no previous prototype for 'get_slave_host_enable' [-Wmissing-prototypes] 66 | bool get_slave_host_enable(struct hinic_hwdev *hwdev, u8 host_id) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:209:5: warning: no previous prototype for '__mbox_to_host' [-Wmissing-prototypes] 209 | int __mbox_to_host(struct hinic_hwdev *hwdev, enum hinic_mod_type mod, | ^~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:483:5: warning: no previous prototype for 'sw_func_ppf_mbox_handler' [-Wmissing-prototypes] 483 | int sw_func_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:506:5: warning: no previous prototype for '__ppf_process_mbox_msg' [-Wmissing-prototypes] 506 | int __ppf_process_mbox_msg(struct hinic_hwdev *hwdev, u16 pf_idx, u16 vf_id, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:580:5: warning: no previous prototype for 'comm_ppf_mbox_handler' [-Wmissing-prototypes] 580 | int comm_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:589:6: warning: no previous prototype for 'comm_ppf_to_pf_handler' [-Wmissing-prototypes] 589 | void comm_ppf_to_pf_handler(void *handle, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:598:5: warning: no previous prototype for 'hilink_ppf_mbox_handler' [-Wmissing-prototypes] 598 | int hilink_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:607:5: warning: no previous prototype for 'hinic_nic_ppf_mbox_handler' [-Wmissing-prototypes] 607 | int hinic_nic_ppf_mbox_handler(void *handle, u16 pf_idx, u16 vf_id, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:616:6: warning: no previous prototype for 'hinic_nic_ppf_to_pf_handler' [-Wmissing-prototypes] 616 | void hinic_nic_ppf_to_pf_handler(void *handle, u8 cmd, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:625:5: warning: no previous prototype for 'hinic_register_slave_ppf' [-Wmissing-prototypes] 625 | int hinic_register_slave_ppf(struct hinic_hwdev *hwdev, bool registered) | ^~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/huawei/hinic/hinic_multi_host_mgmt.c:686:5: warning: no previous prototype for 'set_slave_func_nic_state' [-Wmissing-prototypes] 686 | int set_slave_func_nic_state(struct hinic_hwdev *hwdev, u16 func_idx, u8 en) | ^~~~~~~~~~~~~~~~~~~~~~~~ vim +/nic_cmd_support_vf +72 drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c 71 > 72 struct vf_cmd_check_handle nic_cmd_support_vf[] = { 73 {HINIC_PORT_CMD_VF_REGISTER, NULL}, 74 {HINIC_PORT_CMD_VF_UNREGISTER, NULL}, 75 76 {HINIC_PORT_CMD_CHANGE_MTU, hinic_mbox_check_func_id_8B}, 77 78 {HINIC_PORT_CMD_ADD_VLAN, hinic_mbox_check_func_id_8B}, 79 {HINIC_PORT_CMD_DEL_VLAN, hinic_mbox_check_func_id_8B}, 80 81 {HINIC_PORT_CMD_SET_MAC, hinic_mbox_check_func_id_8B}, 82 {HINIC_PORT_CMD_GET_MAC, hinic_mbox_check_func_id_8B}, 83 {HINIC_PORT_CMD_DEL_MAC, hinic_mbox_check_func_id_8B}, 84 85 {HINIC_PORT_CMD_SET_RX_MODE, hinic_mbox_check_func_id_8B}, 86 87 {HINIC_PORT_CMD_GET_PAUSE_INFO, hinic_mbox_check_func_id_8B}, 88 89 {HINIC_PORT_CMD_GET_LINK_STATE, hinic_mbox_check_func_id_8B}, 90 {HINIC_PORT_CMD_SET_LRO, hinic_mbox_check_func_id_8B}, 91 {HINIC_PORT_CMD_SET_RX_CSUM, hinic_mbox_check_func_id_8B}, 92 {HINIC_PORT_CMD_SET_RX_VLAN_OFFLOAD, hinic_mbox_check_func_id_8B}, 93 94 {HINIC_PORT_CMD_GET_VPORT_STAT, hinic_mbox_check_func_id_8B}, 95 {HINIC_PORT_CMD_CLEAN_VPORT_STAT, hinic_mbox_check_func_id_8B}, 96 97 {HINIC_PORT_CMD_GET_RSS_TEMPLATE_INDIR_TBL, 98 hinic_mbox_check_func_id_8B}, 99 {HINIC_PORT_CMD_SET_RSS_TEMPLATE_INDIR_TBL, 100 hinic_mbox_check_func_id_8B}, 101 {HINIC_PORT_CMD_SET_RSS_TEMPLATE_TBL, hinic_mbox_check_func_id_8B}, 102 {HINIC_PORT_CMD_GET_RSS_TEMPLATE_TBL, hinic_mbox_check_func_id_8B}, 103 {HINIC_PORT_CMD_SET_RSS_HASH_ENGINE, hinic_mbox_check_func_id_8B}, 104 {HINIC_PORT_CMD_GET_RSS_HASH_ENGINE, hinic_mbox_check_func_id_8B}, 105 {HINIC_PORT_CMD_GET_RSS_CTX_TBL, hinic_mbox_check_func_id_8B}, 106 {HINIC_PORT_CMD_SET_RSS_CTX_TBL, hinic_mbox_check_func_id_8B}, 107 {HINIC_PORT_CMD_RSS_TEMP_MGR, hinic_mbox_check_func_id_8B}, 108 {HINIC_PORT_CMD_RSS_CFG, hinic_mbox_check_func_id_8B}, 109 110 {HINIC_PORT_CMD_INIT_FUNC, check_func_table}, 111 {HINIC_PORT_CMD_SET_LLI_PRI, hinic_mbox_check_func_id_8B}, 112 113 {HINIC_PORT_CMD_GET_MGMT_VERSION, NULL}, 114 {HINIC_PORT_CMD_GET_BOOT_VERSION, NULL}, 115 {HINIC_PORT_CMD_GET_MICROCODE_VERSION, NULL}, 116 117 {HINIC_PORT_CMD_GET_VPORT_ENABLE, hinic_mbox_check_func_id_8B}, 118 {HINIC_PORT_CMD_SET_VPORT_ENABLE, hinic_mbox_check_func_id_8B}, 119 120 {HINIC_PORT_CMD_GET_LRO, hinic_mbox_check_func_id_8B}, 121 {HINIC_PORT_CMD_GET_GLOBAL_QPN, hinic_mbox_check_func_id_8B}, 122 123 {HINIC_PORT_CMD_SET_TSO, hinic_mbox_check_func_id_8B}, 124 {HINIC_PORT_CMD_SET_RQ_IQ_MAP, hinic_mbox_check_func_id_8B}, 125 {HINIC_PORT_CMD_LINK_STATUS_REPORT, hinic_mbox_check_func_id_8B}, 126 {HINIC_PORT_CMD_UPDATE_MAC, hinic_mbox_check_func_id_8B}, 127 128 {HINIC_PORT_CMD_GET_PORT_INFO, hinic_mbox_check_func_id_8B}, 129 130 {HINIC_PORT_CMD_SET_IPSU_MAC, hinic_mbox_check_func_id_10B}, 131 {HINIC_PORT_CMD_GET_IPSU_MAC, hinic_mbox_check_func_id_10B}, 132 133 {HINIC_PORT_CMD_GET_LINK_MODE, hinic_mbox_check_func_id_8B}, 134 135 {HINIC_PORT_CMD_CLEAR_SQ_RES, hinic_mbox_check_func_id_8B}, 136 {HINIC_PORT_CMD_SET_SUPER_CQE, hinic_mbox_check_func_id_8B}, 137 138 {HINIC_PORT_CMD_GET_VF_COS, NULL}, 139 {HINIC_PORT_CMD_SET_VHD_CFG, hinic_mbox_check_func_id_8B}, 140 141 {HINIC_PORT_CMD_SET_VLAN_FILTER, hinic_mbox_check_func_id_8B}, 142 }; 143 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] some readahead improvement
by Tong Tiangen 12 Mar '25

12 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() Yafang Shao (1): mm/readahead: fix large folio support in async readahead mm/readahead.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) -- 2.25.1

2 5

[PATCH V2 OLK-5.10] soc: hisilicon: Add checks against NULL pointer reference
by Junhao He 12 Mar '25

12 Mar '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBS9WQ CVE: NA ---------------------------------------------------------------------- The function of ACPI_COMPANION returns a NULL pointer when the device without an fwnode, so add checks for this to fix NULL pointer reference at ACPI_COMPANION. Fixes: efb5bc7b199e ("soc: hisilicon: Support memory repair driver on Kunpeng SoC") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- drivers/soc/hisilicon/hisi_mem_ras.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/soc/hisilicon/hisi_mem_ras.c b/drivers/soc/hisilicon/hisi_mem_ras.c index 991b76e3075d..556a6be8afda 100644 --- a/drivers/soc/hisilicon/hisi_mem_ras.c +++ b/drivers/soc/hisilicon/hisi_mem_ras.c @@ -43,16 +43,20 @@ static int hisi_mem_get_pcc_chan_id(struct hisi_mem_dev *hdev) struct platform_device *pdev = hdev->pdev; struct acpi_device *adev = ACPI_COMPANION(&pdev->dev); struct hisi_mem_register_ctx ctx = {0}; - acpi_handle handle = adev->handle; acpi_status status; - if (!acpi_has_method(handle, METHOD_NAME__CRS)) { + if (!adev) { + dev_err(&pdev->dev, "ACPI companion missing\n"); + return -ENODEV; + } + + if (!acpi_has_method(adev->handle, METHOD_NAME__CRS)) { dev_err(&pdev->dev, "No _CRS method.\n"); return -ENODEV; } ctx.dev = &pdev->dev; - status = acpi_walk_resources(handle, METHOD_NAME__CRS, + status = acpi_walk_resources(adev->handle, METHOD_NAME__CRS, hisi_mem_get_chan_id_cb, &ctx); if (ACPI_FAILURE(status)) return ctx.err; -- 2.33.0

2 1

[openeuler:OLK-5.10] BUILD REGRESSION 5d94761f19ef0d640491ea29b1e87db3c5093756
by kernel test robot 12 Mar '25

12 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 5d94761f19ef0d640491ea29b1e87db3c5093756 !15447 Some bug fix patches for RDMA/hns to olk-5.10 Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-allnoconfig | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-001-20250311 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-002-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-003-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- arm64-randconfig-004-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-allnoconfig | |-- Warning:arch-x86-kernel-cpu-resctrl-monitor.c-references-a-file-that-doesn-t-exist:Documentation-x86-resctrl.rst | |-- drivers-iommu-sw64-sunway_iommu_v2.c:linux-pci.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_base.c:ps3_scsi_cmd_err.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_cli.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_driver_log.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-linux-ps3_dump.c:linux-uaccess.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_htp_def.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:ps3_instance_manager.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:scsi-scsi_tcq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_device_update.c:ps3_device_update.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_cmd_channel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_inner_data.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_instance_manager.h:ps3_irq.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:ps3_scsih.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_irq.c:linux-kernel.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_channel.c:ps3_cmd_complete.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_mgr_cmd.c:linux-mutex.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:ps3_driver_log.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_ioc_state.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:ps3_recovery.h-is-included-more-than-once. | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.h:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:linux-version.h-not-needed. | |-- drivers-scsi-linkdata-ps3stor-ps3_scsih.c:ps3_module_para.h-is-included-more-than-once. | |-- mm-page_alloc.c:linux-vmalloc.h-is-included-more-than-once. | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-allyesconfig | |-- arch-x86-kernel-cpu-resctrl-rdtgroup.c:warning:variable-h-set-but-not-used | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-get_fpu_registers_pos | |-- arch-x86-kernel-fpu-core.c:warning:no-previous-prototype-for-function-save_fpregs_to_fpkernelstate | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_base.c:error:no-previous-prototype-for-function-ps3_pci_init_complete_exit-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_cli_debug.c:error:no-previous-prototype-for-function-ps3_dump_context_show-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_close-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_open-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_file_write-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_filename_build-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-.-linux-ps3_dump.c:error:no-previous-prototype-for-function-ps3_dump_local_time-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_resp_status_convert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_complete.c:error:no-previous-prototype-for-function-ps3_trigger_irq_poll-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_cmd_stat_content_clear-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_cmd_statistics.c:error:no-previous-prototype-for-function-ps3_io_recv_ok_stat_inc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_debug.c:error:no-previous-prototype-for-function-ps3_dump_dir_length-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_pd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager.c:error:no-previous-prototype-for-function-ps3_scsi_private_init_vd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_device_manager_sas.c:error:no-previous-prototype-for-function-ps3_sas_expander_phys_refresh-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_hba-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_raid-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_adp.c:error:no-previous-prototype-for-function-ps3_ioc_resource_prepare_switch-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioc_manager.c:error:no-previous-prototype-for-function-ps3_hard_reset_to_ready-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_ioctl.c:error:no-previous-prototype-for-function-ps3_clean_mgr_cmd-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_module_para.c:error:no-previous-prototype-for-function-ps3_cli_ver_query-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_cmd_waitq_abort-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_init-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_vd_reset-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_hba_qos_waitq_notify-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clean-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_pd_quota_waitq_clear_all-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_all_pd_rc_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_cmd_waitq_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_exclusive_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_pd_waitq_ratio_update-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_tg_decision-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_qos.c:error:no-previous-prototype-for-function-ps3_qos_vd_cmdword_get-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_conflict_queue_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_check-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_bit_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_lock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_r1x_hash_range_unlock-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_r1x_write_lock.c:error:no-previous-prototype-for-function-ps3_range_check_and_insert-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_rb_tree.c:error:no-previous-prototype-for-function-rbtDelNodeDo-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_hard_recovery_state_finish-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_alloc-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_delete-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_context_free-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_irq_queue_destroy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_recovery.c:error:no-previous-prototype-for-function-ps3_recovery_state_transfer-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_sas_transport.c:error:no-previous-prototype-for-function-ps3_sas_update_phy_info-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_set_task_manager_busy-Werror-Wmissing-prototypes | |-- drivers-scsi-linkdata-ps3stor-ps3_scsi_cmd_err.c:error:no-previous-prototype-for-function-ps3_wait_for_outstanding_complete-Werror-Wmissing-prototypes | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-001-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-002-20250311 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-003-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-004-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-function-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-005-20250311 | |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset | |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch |-- x86_64-buildonly-randconfig-006-20250311 | |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages | `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch `-- x86_64-defconfig |-- block-bio.c:warning:Excess-function-parameter-nr_iovecs-description-in-bio_alloc_bioset |-- block-bio.c:warning:Function-parameter-or-member-nr_iovecs_int-not-described-in-bio_alloc_bioset |-- mm-page_alloc.c:warning:no-previous-prototype-for-__drain_all_pages `-- mm-page_alloc.c:warning:no-previous-prototype-for-__zone_set_pageset_high_and_batch elapsed time: 762m configs tested: 16 configs skipped: 109 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250311 gcc-14.2.0 arm64 randconfig-002-20250311 gcc-14.2.0 arm64 randconfig-003-20250311 gcc-14.2.0 arm64 randconfig-004-20250311 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250311 gcc-12 x86_64 buildonly-randconfig-002-20250311 gcc-12 x86_64 buildonly-randconfig-003-20250311 clang-19 x86_64 buildonly-randconfig-004-20250311 clang-19 x86_64 buildonly-randconfig-005-20250311 gcc-12 x86_64 buildonly-randconfig-006-20250311 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf: Configure BRBE correctly on VHE host
by Yushan Wang 12 Mar '25

12 Mar '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSI0M CVE: NA ---------------------------------------------------------------------- The BRBE support backported of v18 didn't configure the BRBCR_EL1 correctly which will miss some key functions like FZP during sampling. In VHE mode with MDCR_EL2.HPMN set to PMCR_EL0.N, the counters are controlled by BRBCR_EL1 rather than BRBCR_EL2 (which writes to BRBCR_EL1 are redirected to). Use the same value for both register except keep EL1 and EL0 recording disabled in guests. The fix is backported from the v19 version [1]. [1] https://lore.kernel.org/linux-arm-kernel/ 20250202-arm-brbe-v19-v19-0-1c1300802385(a)kernel.org/ T/#m887b1dcf7f6784b7293626952052f27b68784beb Fixes: 6c6848e7e00c ("drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE") Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- drivers/perf/arm_brbe.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/perf/arm_brbe.c b/drivers/perf/arm_brbe.c index d795e8fd646f..22e4828feec8 100644 --- a/drivers/perf/arm_brbe.c +++ b/drivers/perf/arm_brbe.c @@ -874,6 +874,16 @@ void armv8pmu_branch_enable(struct arm_pmu *arm_pmu) brbcr &= ~BRBCR_ELx_CONFIG_MASK; brbcr |= branch_type_to_brbcr(cpuc->branch_sample_type); write_sysreg_s(brbcr, SYS_BRBCR_EL1); + + /* + * In VHE mode with MDCR_EL2.HPMN set to PMCR_EL0.N, the counters are + * controlled by BRBCR_EL1 rather than BRBCR_EL2 (which writes to + * BRBCR_EL1 are redirected to). Use the same value for both register + * except keep EL1 and EL0 recording disabled in guests. + */ + if (is_kernel_in_hyp_mode()) + write_sysreg_s(brbcr & ~(BRBCR_ELx_ExBRE | BRBCR_ELx_E0BRE), SYS_BRBCR_EL12); + isb(); } @@ -886,6 +896,11 @@ void armv8pmu_branch_disable(void) brbcr &= ~(BRBCR_ELx_E0BRE | BRBCR_ELx_ExBRE); brbfcr |= BRBFCR_EL1_PAUSED; write_sysreg_s(brbcr, SYS_BRBCR_EL1); + + /* See the comment in armv8pmu_branch_enable() */ + if (is_kernel_in_hyp_mode()) + write_sysreg_s(brbcr, SYS_BRBCR_EL12); + write_sysreg_s(brbfcr, SYS_BRBFCR_EL1); isb(); } -- 2.33.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 12 Mar '25

12 Mar '25

您好！ Kernel 邀请您参加 2025-03-14 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/965671868 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-03-14 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 1. 进展update 2. 议题征集中（新增议题可回复此邮件申报，也可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/965671868 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] sfc: fix kernel panic when creating VF
by Zeng Heng 12 Mar '25

12 Mar '25

From: Íñigo Huguet <ihuguet(a)redhat.com> stable inclusion from stable-v4.19.253 commit 82bcb730f856086f033e6c04082eb4503d4c2fa4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP5WM CVE: CVE-2022-49625 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ada74c5539eba06cf8b47d068f92e0b3963a9a6e ] When creating VFs a kernel panic can happen when calling to efx_ef10_try_update_nic_stats_vf. When releasing a DMA coherent buffer, sometimes, I don't know in what specific circumstances, it has to unmap memory with vunmap. It is disallowed to do that in IRQ context or with BH disabled. Otherwise, we hit this line in vunmap, causing the crash: BUG_ON(in_interrupt()); This patch reenables BH to release the buffer. Log messages when the bug is hit: kernel BUG at mm/vmalloc.c:2727! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 6 PID: 1462 Comm: NetworkManager Kdump: loaded Tainted: G I --------- --- 5.14.0-119.el9.x86_64 #1 Hardware name: Dell Inc. PowerEdge R740/06WXJT, BIOS 2.8.2 08/27/2020 RIP: 0010:vunmap+0x2e/0x30 ...skip... Call Trace: __iommu_dma_free+0x96/0x100 efx_nic_free_buffer+0x2b/0x40 [sfc] efx_ef10_try_update_nic_stats_vf+0x14a/0x1c0 [sfc] efx_ef10_update_stats_vf+0x18/0x40 [sfc] efx_start_all+0x15e/0x1d0 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xe7/0x1a0 __dev_change_flags+0x1d7/0x240 dev_change_flags+0x21/0x60 ...skip... Fixes: d778819609a2 ("sfc: DMA the VF stats only when requested") Reported-by: Ma Yuying <yuma(a)redhat.com> Signed-off-by: Íñigo Huguet <ihuguet(a)redhat.com> Acked-by: Edward Cree <ecree.xilinx(a)gmail.com> Link: https://lore.kernel.org/r/20220713092116.21238-1-ihuguet@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/net/ethernet/sfc/ef10.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c index 1f971d31ec30..51e22b13146c 100644 --- a/drivers/net/ethernet/sfc/ef10.c +++ b/drivers/net/ethernet/sfc/ef10.c @@ -2059,7 +2059,10 @@ static int efx_ef10_try_update_nic_stats_vf(struct efx_nic *efx) efx_update_sw_stats(efx, stats); out: + /* releasing a DMA coherent buffer with BH disabled can panic */ + spin_unlock_bh(&efx->stats_lock); efx_nic_free_buffer(efx, &stats_buf); + spin_lock_bh(&efx->stats_lock); return rc; } -- 2.25.1

2 1

[PATCH OLK-6.6 v2 00/55] fuse: support large folios
by Baokun Li 12 Mar '25

12 Mar '25

Changes since v1: * Add patch 55 to fix read-write inconsistency issue. Port the fuse large folios support patches to OLK6.6. This code hasn't been system tested and is just for exploration and verification, not for merging into the release. Amir Goldstein (1): fuse: allocate ff->release_args only if release is needed Baokun Li (1): fuse: avoid writing more pages than max_pages Bernd Schubert (1): fuse: Set *nbytesp=0 in fuse_get_user_pages on allocation failure David Howells (1): iov_iter: Provide copy_folio_from_iter() Joanne Koong (32): fuse: convert fuse_writepages_fill() to use a folio for its tmp page fuse: drop unused fuse_mount arg in fuse_writepage_finish() fuse: refactor finished writeback stats updates into helper function fuse: support folios in struct fuse_args_pages and fuse_copy_pages() fuse: add support in virtio for requests using folios fuse: convert cuse to use folios fuse: convert readlink to use folios fuse: convert readdir to use folios fuse: convert reads to use folios fuse: convert writes (non-writeback) to use folios fuse: convert ioctls to use folios fuse: convert retrieves to use folios fuse: revert back to __readahead_folio() for readahead mm/writeback: add folio_mark_dirty_lock() fuse: move initialization of fuse_file to fuse_writepages() instead of in callback fuse: move fuse file initialization to wpa allocation time fuse: refactor out shared logic in fuse_writepages_fill() and fuse_writepage_locked() fuse: convert writebacks to use folios fuse: convert direct io to use folios fuse: remove pages for requests and exclusively use folios fuse: fix direct io folio offset and length calculation fuse: support copying large folios fuse: support large folios for retrieves fuse: refactor fuse_fill_write_pages() fuse: support large folios for writethrough writes fuse: support large folios for folio reads fuse: support large folios for symlinks fuse: support large folios for stores fuse: support large folios for queued writes fuse: support large folios for readahead fuse: optimize direct io large folios processing fuse: enable dynamic configuration of fuse max pages limit (FUSE_MAX_MAX_PAGES) Josef Bacik (10): fuse: use fuse_range_is_writeback() instead of iterating pages fuse: convert readahead to use folios fuse: convert fuse_send_write_pages to use folios fuse: convert fuse_fill_write_pages to use folios fuse: convert fuse_page_mkwrite to use folios fuse: convert fuse_do_readpage to use folios fuse: convert fuse_writepage_need_send to take a folio fuse: convert fuse_retrieve to use folios fuse: convert fuse_notify_store to use folios fuse: use the folio based vmstat helpers Lei Huang (1): fuse: Fix missing FOLL_PIN for direct-io Matthew Wilcox (Oracle) (6): fuse: Remove fuse_writepage fuse: Convert fuse_writepage_locked to take a folio mm: add folio_end_read() fuse: Convert fuse_readpages_end() to use folio_end_read() fuse: Convert fuse_write_end() to use a folio fuse: Convert fuse_write_begin() to use a folio Miklos Szeredi (1): fuse: clear PG_uptodate when using a stolen page Vivek Kasireddy (1): mm/gup: introduce unpin_folio/unpin_folios helpers Documentation/admin-guide/sysctl/fs.rst | 10 + fs/fuse/Makefile | 1 + fs/fuse/cuse.c | 29 +- fs/fuse/dev.c | 163 ++--- fs/fuse/dir.c | 28 +- fs/fuse/file.c | 774 +++++++++++++----------- fs/fuse/fuse_i.h | 51 +- fs/fuse/inode.c | 11 +- fs/fuse/ioctl.c | 33 +- fs/fuse/readdir.c | 18 +- fs/fuse/sysctl.c | 40 ++ fs/fuse/virtio_fs.c | 52 +- include/linux/mm.h | 3 + include/linux/pagemap.h | 1 + include/linux/uio.h | 6 + mm/filemap.c | 22 + mm/folio-compat.c | 6 + mm/gup.c | 47 ++ mm/page-writeback.c | 22 +- mm/util.c | 1 + 20 files changed, 789 insertions(+), 529 deletions(-) create mode 100644 fs/fuse/sysctl.c -- 2.46.1

2 56

[PATCH OLK-5.10] soc: hisilicon: Fix one printing issue and simplify some printing
by Junhao He 12 Mar '25

12 Mar '25

From: Xiaofei Tan <tanxiaofei(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBS9WQ CVE: NA ---------------------------------------------------------------------- It's the opposite of what acls_repair_store printing really means. Fix it and add some printing simplification. Fixes: efb5bc7b199e ("soc: hisilicon: Support memory repair driver on Kunpeng SoC") Signed-off-by: Xiaofei Tan <tanxiaofei(a)huawei.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- drivers/soc/hisilicon/hisi_mem_ras.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/soc/hisilicon/hisi_mem_ras.c b/drivers/soc/hisilicon/hisi_mem_ras.c index 765132cf1c04..991b76e3075d 100644 --- a/drivers/soc/hisilicon/hisi_mem_ras.c +++ b/drivers/soc/hisilicon/hisi_mem_ras.c @@ -229,7 +229,7 @@ static struct page *trans_and_check_paddr(struct device *dev, const char *buf, u page = pfn_to_online_page(__phys_to_pfn(paddr_tmp)); if (!page) { - dev_info(dev, "The page of paddr 0x%llx is not online page.\n", paddr_tmp); + dev_info(dev, "The page of paddr 0x%llx not online.\n", paddr_tmp); return NULL; } @@ -283,7 +283,7 @@ static ssize_t acls_repair_store(struct device *dev, struct device_attribute *at return -EINVAL; if (hdev->mem_type == MEMORY_TYPE_HBM && !PageHWPoison(page)) { - dev_info(dev, "The page of paddr 0x%llx is not unpoisoned.\n", paddr); + dev_info(dev, "The page of paddr 0x%llx not poisoned.\n", paddr); return -EIO; } @@ -350,7 +350,7 @@ static ssize_t sppr_repair_store(struct device *dev, struct device_attribute *at return -EINVAL; if (hdev->mem_type == MEMORY_TYPE_HBM && !PageHWPoison(page)) { - dev_info(dev, "The page of paddr 0x%llx is not poisoned.\n", paddr); + dev_info(dev, "The page of paddr 0x%llx not poisoned.\n", paddr); return -EIO; } -- 2.33.0

2 3

[PATCH OLK-5.10] RDMA/hns: Fix mbox timing out by adding retry mechanism
by Junxian Huang 12 Mar '25

12 Mar '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSLDS CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?h=wip… ---------------------------------------------------------------------- If a QP is modified to error state and a flush CQE process is triggered, the subsequent QP destruction mbox can still be successfully posted but will be blocked in HW until the flush CQE process finishes. This causes further mbox posting timeouts in driver. The blocking time is related to QP depth. Considering an extreme case where SQ depth and RQ depth are both 32K, the blocking time can reach about 135ms. This patch adds a retry mechanism for mbox posting. For each try, FW waits 15ms for HW to complete the previous mbox, otherwise return a timeout error code to driver. Counting other time consumption in FW, set 8 tries for mbox posting and a 5ms time gap before each retry to increase to a sufficient timeout limit. Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20250208105930.522796-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 64 ++++++++++++++++------ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 + 2 files changed, 50 insertions(+), 16 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 88a10930447b..3813b318f1c3 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -1395,10 +1395,8 @@ static u32 hns_roce_cmdq_tx_timeout(u16 opcode, u32 tx_timeout) return tx_timeout; } -static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) +static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u32 tx_timeout) { - struct hns_roce_v2_priv *priv = hr_dev->priv; - u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); u32 timeout = 0; do { @@ -1408,8 +1406,9 @@ static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) } while (++timeout < tx_timeout); } -static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, - struct hns_roce_cmq_desc *desc, int num) +static int __hns_roce_cmq_send_one(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, + int num, u32 tx_timeout) { struct hns_roce_v2_priv *priv = hr_dev->priv; struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; @@ -1418,8 +1417,6 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, int ret; int i; - spin_lock_bh(&csq->lock); - tail = csq->head; for (i = 0; i < num; i++) { @@ -1433,22 +1430,17 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_CNT]); - hns_roce_wait_csq_done(hr_dev, le16_to_cpu(desc->opcode)); + hns_roce_wait_csq_done(hr_dev, tx_timeout); if (hns_roce_cmq_csq_done(hr_dev)) { ret = 0; for (i = 0; i < num; i++) { /* check the result of hardware write back */ - desc[i] = csq->desc[tail++]; + desc_ret = le16_to_cpu(csq->desc[tail++].retval); if (tail == csq->desc_num) tail = 0; - - desc_ret = le16_to_cpu(desc[i].retval); if (likely(desc_ret == CMD_EXEC_SUCCESS)) continue; - dev_err_ratelimited(hr_dev->dev, - "Cmdq IO error, opcode = 0x%x, return = 0x%x.\n", - desc->opcode, desc_ret); ret = hns_roce_cmd_err_convert_errno(desc_ret); } } else { @@ -1463,14 +1455,54 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, ret = -EAGAIN; } - spin_unlock_bh(&csq->lock); - if (ret) atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_ERR_CNT]); return ret; } +static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, int num) +{ + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; + u16 opcode = le16_to_cpu(desc->opcode); + u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); + u8 try_cnt = HNS_ROCE_OPC_POST_MB_TRY_CNT; + u32 rsv_tail; + int ret; + int i; + + while (try_cnt) { + try_cnt--; + + spin_lock_bh(&csq->lock); + rsv_tail = csq->head; + ret = __hns_roce_cmq_send_one(hr_dev, desc, num, tx_timeout); + if (opcode == HNS_ROCE_OPC_POST_MB && ret == -ETIME && + try_cnt) { + spin_unlock_bh(&csq->lock); + mdelay(HNS_ROCE_OPC_POST_MB_RETRY_GAP_MSEC); + continue; + } + + for (i = 0; i < num; i++) { + desc[i] = csq->desc[rsv_tail++]; + if (rsv_tail == csq->desc_num) + rsv_tail = 0; + } + spin_unlock_bh(&csq->lock); + break; + } + + if (ret) + dev_err_ratelimited(hr_dev->dev, + "Cmdq IO error, opcode = 0x%x, return = %d.\n", + opcode, ret); + + return ret; +} + static int hns_roce_cmq_send(struct hns_roce_dev *hr_dev, struct hns_roce_cmq_desc *desc, int num) { diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index c59e40649454..dbc405885ea7 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -243,6 +243,8 @@ enum hns_roce_opcode_type { }; #define HNS_ROCE_OPC_POST_MB_TIMEOUT 35000 +#define HNS_ROCE_OPC_POST_MB_TRY_CNT 8 +#define HNS_ROCE_OPC_POST_MB_RETRY_GAP_MSEC 5 struct hns_roce_cmdq_tx_timeout_map { u16 opcode; u32 tx_timeout; -- 2.33.0

2 1

[PATCH OLK-6.6] perf: Configure BRBE correctly on VHE host
by Yushan Wang 12 Mar '25

12 Mar '25

From: Yicong Yang <yangyicong(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSI0M CVE: NA ---------------------------------------------------------------------- The BRBE support backported of v18 didn't configure the BRBCR_EL1 correctly which will miss some key functions like FZP during sampling. In VHE mode with MDCR_EL2.HPMN set to PMCR_EL0.N, the counters are controlled by BRBCR_EL1 rather than BRBCR_EL2 (which writes to BRBCR_EL1 are redirected to). Use the same value for both register except keep EL1 and EL0 recording disabled in guests. The fix is backported from the v19 version [1]. [1] https://lore.kernel.org/linux-arm-kernel/ 20250202-arm-brbe-v19-v19-0-1c1300802385(a)kernel.org/ T/#m887b1dcf7f6784b7293626952052f27b68784beb fixes: 6c6848e7e00c ("drivers: perf: arm_pmuv3: Enable branch stack sampling via FEAT_BRBE") Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Signed-off-by: Qizhi Zhang <zhangqizhi3(a)h-partners.com> --- drivers/perf/arm_brbe.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/perf/arm_brbe.c b/drivers/perf/arm_brbe.c index d795e8fd646f..22e4828feec8 100644 --- a/drivers/perf/arm_brbe.c +++ b/drivers/perf/arm_brbe.c @@ -874,6 +874,16 @@ void armv8pmu_branch_enable(struct arm_pmu *arm_pmu) brbcr &= ~BRBCR_ELx_CONFIG_MASK; brbcr |= branch_type_to_brbcr(cpuc->branch_sample_type); write_sysreg_s(brbcr, SYS_BRBCR_EL1); + + /* + * In VHE mode with MDCR_EL2.HPMN set to PMCR_EL0.N, the counters are + * controlled by BRBCR_EL1 rather than BRBCR_EL2 (which writes to + * BRBCR_EL1 are redirected to). Use the same value for both register + * except keep EL1 and EL0 recording disabled in guests. + */ + if (is_kernel_in_hyp_mode()) + write_sysreg_s(brbcr & ~(BRBCR_ELx_ExBRE | BRBCR_ELx_E0BRE), SYS_BRBCR_EL12); + isb(); } @@ -886,6 +896,11 @@ void armv8pmu_branch_disable(void) brbcr &= ~(BRBCR_ELx_E0BRE | BRBCR_ELx_ExBRE); brbfcr |= BRBFCR_EL1_PAUSED; write_sysreg_s(brbcr, SYS_BRBCR_EL1); + + /* See the comment in armv8pmu_branch_enable() */ + if (is_kernel_in_hyp_mode()) + write_sysreg_s(brbcr, SYS_BRBCR_EL12); + write_sysreg_s(brbfcr, SYS_BRBFCR_EL1); isb(); } -- 2.33.0

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 2f1a9354fdf9708fa38bd6916f84034bc1510c16
by kernel test robot 12 Mar '25

12 Mar '25

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 2f1a9354fdf9708fa38bd6916f84034bc1510c16 !15423 [openEuler-24.03-LTS][linux-6.6.y sync] Backport 6.6.69-6.6.70 LTS Additional Patches Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-alldefconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allmodconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-hisi_oom_recover | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | |-- mm-share_pool.c:warning:Function-parameter-or-member-node_id-not-described-in-sp_area_alloc | |-- mm-share_pool.c:warning:Function-parameter-or-member-spg_id-not-described-in-mg_sp_unshare | |-- mm-share_pool.c:warning:duplicate-section-name-Return | |-- mm-share_pool.c:warning:expecting-prototype-for-mp_sp_group_id_by_pid().-Prototype-was-for-mg_sp_group_id_by_pid()-instead | |-- mm-share_pool.c:warning:variable-is_hugepage-set-but-not-used | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-001-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-002-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-003-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-004-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- arm64-randconfig-051-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-052-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-053-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-054-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- arm64-randconfig-055-20250312 | |-- Documentation-devicetree-bindings-dma-snps-dw-axi-dmac.yaml:snps-priority:multiple-incompatible-types:uint32-array | `-- Documentation-devicetree-bindings-net-snps-dwmac.yaml:snps-priority:multiple-incompatible-types:uint32 |-- loongarch-allmodconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-allyesconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-001-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- loongarch-randconfig-002-20250311 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- x86_64-allnoconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-allyesconfig | |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_limit_mbytes_sysctl_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_enable_handler | |-- mm-page_cache_limit.c:warning:no-previous-prototype-for-function-cache_reclaim_sysctl_handler | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-001-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-002-20250311 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-003-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-004-20250311 | |-- ld.lld:error:undefined-symbol:arch_kexec_protect_crashkres | |-- ld.lld:error:undefined-symbol:machine_crash_shutdown | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-005-20250311 | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-buildonly-randconfig-006-20250311 | |-- drivers-cpufreq-acpi-cpufreq.c:warning:sched_set_itmt-defined-but-not-used | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial |-- x86_64-defconfig | |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used | |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task | |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead | `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial `-- x86_64-randconfig-161-20250312 |-- include-linux-fortify-string.h:warning:call-to-__write_overflow_field-declared-with-warning-attribute:detected-write-beyond-size-of-field-(1st-parameter)-maybe-use-struct_group() |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-proc_handler-cannot-be-NULL.-Expression:vm_compaction-proc_handler |-- mm-compaction.c-(null)()-warn:(struct-ctl_table)-procname-cannot-be-NULL.-Expression:vm_compaction-procname |-- mm-memory.c:warning:variable-nr_pages-set-but-not-used |-- mm-oom_kill.c:warning:Function-parameter-or-member-oc-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-points-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:Function-parameter-or-member-task-not-described-in-oom_next_task |-- mm-oom_kill.c:warning:expecting-prototype-for-We-choose-the-task-in-low().-Prototype-was-for-oom_next_task()-instead `-- mm-vmalloc.c:warning:Function-parameter-or-member-pgoff-not-described-in-remap_vmalloc_hugepage_range_partial elapsed time: 823m configs tested: 20 configs skipped: 123 tested configs: arm64 alldefconfig gcc-14.2.0 arm64 allmodconfig clang-18 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20250311 gcc-14.2.0 arm64 randconfig-002-20250311 gcc-14.2.0 arm64 randconfig-003-20250311 gcc-14.2.0 arm64 randconfig-004-20250311 gcc-14.2.0 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20250311 gcc-14.2.0 loongarch randconfig-002-20250311 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20250311 gcc-12 x86_64 buildonly-randconfig-002-20250311 gcc-12 x86_64 buildonly-randconfig-003-20250311 clang-19 x86_64 buildonly-randconfig-004-20250311 clang-19 x86_64 buildonly-randconfig-005-20250311 gcc-12 x86_64 buildonly-randconfig-006-20250311 gcc-12 x86_64 defconfig gcc-11 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] some readahead improvement
by Tong Tiangen 11 Mar '25

11 Mar '25

Jan Kara (3): readahead: make sure sync readahead reads needed page readahead: don't shorten readahead window in read_pages() readahead: properly shorten readahead when falling back to do_page_cache_ra() Yafang Shao (1): mm/readahead: fix large folio support in async readahead mm/readahead.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS] hrtimers: Handle CPU state correctly on hotplug
by Zeng Heng 11 Mar '25

11 Mar '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v6.6.74 commit a5cbbea145b400e40540c34816d16d36e0374fbc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLWTN CVE: CVE-2024-57951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f8dea1692eef2b7ba6a256246ed82c365fdc686 upstream. Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ] Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241220134421.3809834-1-koichiro.den@canonical… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/hrtimer.h kernel/cpu.c kernel/time/hrtimer.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 542b4fa2cda9..27f504fc36d2 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -507,6 +507,7 @@ extern void __init hrtimers_init(void); extern void sysrq_timer_list_show(void); int hrtimers_prepare_cpu(unsigned int cpu); +int hrtimers_cpu_starting(unsigned int cpu); #ifdef CONFIG_HOTPLUG_CPU int hrtimers_dead_cpu(unsigned int cpu); #else diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index ce8fe5adafb0..c7817f3e814e 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -1882,6 +1882,14 @@ int hrtimers_prepare_cpu(unsigned int cpu) } cpu_base->cpu = cpu; + return 0; +} + +int hrtimers_cpu_starting(unsigned int cpu) +{ + struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); + + /* Clear out any left over state from a CPU down operation */ cpu_base->active_bases = 0; cpu_base->hres_active = 0; cpu_base->hang_detected = 0; @@ -1974,6 +1982,7 @@ int hrtimers_dead_cpu(unsigned int scpu) void __init hrtimers_init(void) { hrtimers_prepare_cpu(smp_processor_id()); + hrtimers_cpu_starting(smp_processor_id()); open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] hrtimers: Handle CPU state correctly on hotplug
by Zeng Heng 11 Mar '25

11 Mar '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v6.6.74 commit a5cbbea145b400e40540c34816d16d36e0374fbc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLWTN CVE: CVE-2024-57951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f8dea1692eef2b7ba6a256246ed82c365fdc686 upstream. Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ] Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241220134421.3809834-1-koichiro.den@canonical… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: include/linux/hrtimer.h kernel/cpu.c kernel/time/hrtimer.c [Fix context conflict.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/time/hrtimer.c | 10 ++++++++++ 2 files changed, 11 insertions(+) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 542b4fa2cda9..27f504fc36d2 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -507,6 +507,7 @@ extern void __init hrtimers_init(void); extern void sysrq_timer_list_show(void); int hrtimers_prepare_cpu(unsigned int cpu); +int hrtimers_cpu_starting(unsigned int cpu); #ifdef CONFIG_HOTPLUG_CPU int hrtimers_dead_cpu(unsigned int cpu); #else diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index ce8fe5adafb0..300eb4039f26 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -1882,6 +1882,15 @@ int hrtimers_prepare_cpu(unsigned int cpu) } cpu_base->cpu = cpu; + hrtimer_cpu_base_init_expiry_lock(cpu_base); + return 0; +} + +int hrtimers_cpu_starting(unsigned int cpu) +{ + struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); + + /* Clear out any left over state from a CPU down operation */ cpu_base->active_bases = 0; cpu_base->hres_active = 0; cpu_base->hang_detected = 0; @@ -1974,6 +1983,7 @@ int hrtimers_dead_cpu(unsigned int scpu) void __init hrtimers_init(void) { hrtimers_prepare_cpu(smp_processor_id()); + hrtimers_cpu_starting(smp_processor_id()); open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); } -- 2.25.1

2 1

[PATCH] RDMA/hns: Fix mbox timing out by adding retry mechanism
by Junxian Huang 11 Mar '25

11 Mar '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBSLDS CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?h=wip… ---------------------------------------------------------------------- If a QP is modified to error state and a flush CQE process is triggered, the subsequent QP destruction mbox can still be successfully posted but will be blocked in HW until the flush CQE process finishes. This causes further mbox posting timeouts in driver. The blocking time is related to QP depth. Considering an extreme case where SQ depth and RQ depth are both 32K, the blocking time can reach about 135ms. This patch adds a retry mechanism for mbox posting. For each try, FW waits 15ms for HW to complete the previous mbox, otherwise return a timeout error code to driver. Counting other time consumption in FW, set 8 tries for mbox posting and a 5ms time gap before each retry to increase to a sufficient timeout limit. Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space") Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> Link: https://patch.msgid.link/20250208105930.522796-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 64 ++++++++++++++++------ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 + 2 files changed, 50 insertions(+), 16 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index 88a10930447b..3813b318f1c3 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -1395,10 +1395,8 @@ static u32 hns_roce_cmdq_tx_timeout(u16 opcode, u32 tx_timeout) return tx_timeout; } -static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) +static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u32 tx_timeout) { - struct hns_roce_v2_priv *priv = hr_dev->priv; - u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); u32 timeout = 0; do { @@ -1408,8 +1406,9 @@ static void hns_roce_wait_csq_done(struct hns_roce_dev *hr_dev, u16 opcode) } while (++timeout < tx_timeout); } -static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, - struct hns_roce_cmq_desc *desc, int num) +static int __hns_roce_cmq_send_one(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, + int num, u32 tx_timeout) { struct hns_roce_v2_priv *priv = hr_dev->priv; struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; @@ -1418,8 +1417,6 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, int ret; int i; - spin_lock_bh(&csq->lock); - tail = csq->head; for (i = 0; i < num; i++) { @@ -1433,22 +1430,17 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_CNT]); - hns_roce_wait_csq_done(hr_dev, le16_to_cpu(desc->opcode)); + hns_roce_wait_csq_done(hr_dev, tx_timeout); if (hns_roce_cmq_csq_done(hr_dev)) { ret = 0; for (i = 0; i < num; i++) { /* check the result of hardware write back */ - desc[i] = csq->desc[tail++]; + desc_ret = le16_to_cpu(csq->desc[tail++].retval); if (tail == csq->desc_num) tail = 0; - - desc_ret = le16_to_cpu(desc[i].retval); if (likely(desc_ret == CMD_EXEC_SUCCESS)) continue; - dev_err_ratelimited(hr_dev->dev, - "Cmdq IO error, opcode = 0x%x, return = 0x%x.\n", - desc->opcode, desc_ret); ret = hns_roce_cmd_err_convert_errno(desc_ret); } } else { @@ -1463,14 +1455,54 @@ static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, ret = -EAGAIN; } - spin_unlock_bh(&csq->lock); - if (ret) atomic64_inc(&hr_dev->dfx_cnt[HNS_ROCE_DFX_CMDS_ERR_CNT]); return ret; } +static int __hns_roce_cmq_send(struct hns_roce_dev *hr_dev, + struct hns_roce_cmq_desc *desc, int num) +{ + struct hns_roce_v2_priv *priv = hr_dev->priv; + struct hns_roce_v2_cmq_ring *csq = &priv->cmq.csq; + u16 opcode = le16_to_cpu(desc->opcode); + u32 tx_timeout = hns_roce_cmdq_tx_timeout(opcode, priv->cmq.tx_timeout); + u8 try_cnt = HNS_ROCE_OPC_POST_MB_TRY_CNT; + u32 rsv_tail; + int ret; + int i; + + while (try_cnt) { + try_cnt--; + + spin_lock_bh(&csq->lock); + rsv_tail = csq->head; + ret = __hns_roce_cmq_send_one(hr_dev, desc, num, tx_timeout); + if (opcode == HNS_ROCE_OPC_POST_MB && ret == -ETIME && + try_cnt) { + spin_unlock_bh(&csq->lock); + mdelay(HNS_ROCE_OPC_POST_MB_RETRY_GAP_MSEC); + continue; + } + + for (i = 0; i < num; i++) { + desc[i] = csq->desc[rsv_tail++]; + if (rsv_tail == csq->desc_num) + rsv_tail = 0; + } + spin_unlock_bh(&csq->lock); + break; + } + + if (ret) + dev_err_ratelimited(hr_dev->dev, + "Cmdq IO error, opcode = 0x%x, return = %d.\n", + opcode, ret); + + return ret; +} + static int hns_roce_cmq_send(struct hns_roce_dev *hr_dev, struct hns_roce_cmq_desc *desc, int num) { diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index c59e40649454..dbc405885ea7 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -243,6 +243,8 @@ enum hns_roce_opcode_type { }; #define HNS_ROCE_OPC_POST_MB_TIMEOUT 35000 +#define HNS_ROCE_OPC_POST_MB_TRY_CNT 8 +#define HNS_ROCE_OPC_POST_MB_RETRY_GAP_MSEC 5 struct hns_roce_cmdq_tx_timeout_map { u16 opcode; u32 tx_timeout; -- 2.33.0

1 0

[PATCH OLK-6.6] vrf: use RCU protection in l3mdev_l3_out()
by Liu Jian 11 Mar '25

11 Mar '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.79 commit c40cb5c03e37552d6eff963187109e2c3f78ef6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA6 CVE: CVE-2025-21791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773 ] l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_out() Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF. Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-7-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/l3mdev.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h index ba8dc2523c59..eb5ef1b2e059 100644 --- a/include/net/l3mdev.h +++ b/include/net/l3mdev.h @@ -204,10 +204,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto) if (netif_is_l3_slave(dev)) { struct net_device *master; + rcu_read_lock(); master = netdev_master_upper_dev_get_rcu(dev); if (master && master->l3mdev_ops->l3mdev_l3_out) skb = master->l3mdev_ops->l3mdev_l3_out(master, sk, skb, proto); + rcu_read_unlock(); } return skb; -- 2.34.1

2 1

[PATCH OLK-5.10] vrf: use RCU protection in l3mdev_l3_out()
by Liu Jian 11 Mar '25

11 Mar '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA6 CVE: CVE-2025-21791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_out() Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF. Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-7-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/l3mdev.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h index ba8dc2523c59..eb5ef1b2e059 100644 --- a/include/net/l3mdev.h +++ b/include/net/l3mdev.h @@ -204,10 +204,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto) if (netif_is_l3_slave(dev)) { struct net_device *master; + rcu_read_lock(); master = netdev_master_upper_dev_get_rcu(dev); if (master && master->l3mdev_ops->l3mdev_l3_out) skb = master->l3mdev_ops->l3mdev_l3_out(master, sk, skb, proto); + rcu_read_unlock(); } return skb; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] vrf: use RCU protection in l3mdev_l3_out()
by Liu Jian 11 Mar '25

11 Mar '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPCA6 CVE: CVE-2025-21791 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip_out() Add rcu_read_lock() / rcu_read_unlock() pair to avoid a potential UAF. Fixes: a8e3e1a9f020 ("net: l3mdev: Add hook to output path") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-7-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- include/net/l3mdev.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/net/l3mdev.h b/include/net/l3mdev.h index a421e2fa06e3..3300f1440158 100644 --- a/include/net/l3mdev.h +++ b/include/net/l3mdev.h @@ -181,10 +181,12 @@ struct sk_buff *l3mdev_l3_out(struct sock *sk, struct sk_buff *skb, u16 proto) if (netif_is_l3_slave(dev)) { struct net_device *master; + rcu_read_lock(); master = netdev_master_upper_dev_get_rcu(dev); if (master && master->l3mdev_ops->l3mdev_l3_out) skb = master->l3mdev_ops->l3mdev_l3_out(master, sk, skb, proto); + rcu_read_unlock(); } return skb; -- 2.34.1

2 1