- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 1/2] Revert "sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED"
by Yipeng Zou 24 May '24

24 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9R3F8 CVE: NA -------------------------------- It's typo error, should be FAIR_GROUP_SCHED but not FAIR_CGROUP_SCHED. This reverts commit 0232640040dc906424ef969ba1a0aaee97cf2846. Fixes: 0232640040dc ("sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- init/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index dc49f231294a..4b16ac2efda8 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1128,7 +1128,6 @@ endif #CGROUP_SCHED config QOS_SCHED_DYNAMIC_AFFINITY bool "qos dynamic affinity" depends on CPUSETS - depends on FAIR_CGROUP_SCHED default n help This feature lets you allocate preferred cpus to taskgroup. If enabled, -- 2.34.1

2 3

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 24 May '24

24 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 24 May '24

24 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH OLK-5.10] ACPI: LPIT: Avoid u32 multiplication overflow
by Xiongfeng Wang 24 May '24

24 May '24

From: Nikita Kiryushin <kiryushin(a)ancud.ru> stable inclusion from stable-v5.10.209 commit f39c3d578c7d09a18ceaf56750fc7f20b02ada63 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9HZ CVE: CVE-2023-52683 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ] In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). Change multiplication to mul_u32_u32(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: eeb2d80d502a ("ACPI / LPIT: Add Low Power Idle Table (LPIT) support") Signed-off-by: Nikita Kiryushin <kiryushin(a)ancud.ru> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/acpi/acpi_lpit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c index 48e5059d67ca..7de59730030c 100644 --- a/drivers/acpi/acpi_lpit.c +++ b/drivers/acpi/acpi_lpit.c @@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info, struct acpi_lpit_native *lpit_native) { info->frequency = lpit_native->counter_frequency ? - lpit_native->counter_frequency : tsc_khz * 1000; + lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U); if (!info->frequency) info->frequency = 1; -- 2.20.1

2 1

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 24 May '24

24 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH openEuler-1.0-LTS] hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
by Zheng Yejian 24 May '24

24 May '24

From: Vadim Pasternak <vadimp(a)nvidia.com> stable inclusion from stable-v4.19.209 commit 5c6e0bce647d9cb32a17d58ffa669b3421fcc6ca category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4O0 CVE: CVE-2021-47393 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e6fab7af6ba1bc77c78713a83876f60ca7a4a064 ] Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature. Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum. Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because in this case statistics update violates thermal statistics table range. The issues is observed in case kernel is configured with option CONFIG_THERMAL_STATISTICS. Here is the trace from KASAN: [ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444 [ 159.545625] Call Trace: [ 159.548366] dump_stack+0x92/0xc1 [ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.635869] thermal_zone_device_update+0x345/0x780 [ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0 [ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core] [ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core] [ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core] [ 160.070233] RIP: 0033:0x7fd995909970 [ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff .. [ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970 [ 160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001 [ 160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700 [ 160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013 [ 160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013 [ 160.143671] [ 160.145338] Allocated by task 2924: [ 160.149242] kasan_save_stack+0x19/0x40 [ 160.153541] __kasan_kmalloc+0x7f/0xa0 [ 160.157743] __kmalloc+0x1a2/0x2b0 [ 160.161552] thermal_cooling_device_setup_sysfs+0xf9/0x1a0 [ 160.167687] __thermal_cooling_device_register+0x1b5/0x500 [ 160.173833] devm_thermal_of_cooling_device_register+0x60/0xa0 [ 160.180356] mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan] [ 160.248140] [ 160.249807] The buggy address belongs to the object at ffff888116163400 [ 160.249807] which belongs to the cache kmalloc-1k of size 1024 [ 160.263814] The buggy address is located 64 bytes to the right of [ 160.263814] 1024-byte region [ffff888116163400, ffff888116163800) [ 160.277536] The buggy address belongs to the page: [ 160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160 [ 160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0 [ 160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0 [ 160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000 [ 160.327033] page dumped because: kasan: bad access detected [ 160.333270] [ 160.334937] Memory state around the buggy address: [ 160.356469] >ffff888116163800: fc .. Fixes: 65afb4c8e7e4 ("hwmon: (mlxreg-fan) Add support for Mellanox FAN driver") Signed-off-by: Vadim Pasternak <vadimp(a)nvidia.com> Link: https://lore.kernel.org/r/20210916183151.869427-1-vadimp@nvidia.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/hwmon/mlxreg-fan.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/hwmon/mlxreg-fan.c b/drivers/hwmon/mlxreg-fan.c index d8fa4bea4bc8..e57b0c5119ce 100644 --- a/drivers/hwmon/mlxreg-fan.c +++ b/drivers/hwmon/mlxreg-fan.c @@ -307,8 +307,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, { struct mlxreg_fan *fan = cdev->devdata; unsigned long cur_state; + int i, config = 0; u32 regval; - int i; int err; /* @@ -321,6 +321,12 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, * overwritten. */ if (state >= MLXREG_FAN_SPEED_MIN && state <= MLXREG_FAN_SPEED_MAX) { + /* + * This is configuration change, which is only supported through sysfs. + * For configuration non-zero value is to be returned to avoid thermal + * statistics update. + */ + config = 1; state -= MLXREG_FAN_MAX_STATE; for (i = 0; i < state; i++) fan->cooling_levels[i] = state; @@ -335,7 +341,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, cur_state = MLXREG_FAN_PWM_DUTY2STATE(regval); if (state < cur_state) - return 0; + return config; state = cur_state; } @@ -351,7 +357,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, dev_err(fan->dev, "Failed to write PWM duty\n"); return err; } - return 0; + return config; } static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = { -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Scheduler load balance fixes
by Zhang Qiao 24 May '24

24 May '24

Zhang Qiao (2): sched/numa: Fix numa imbalance in load_balance() config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 arch/arm64/configs/openeuler_defconfig | 2 +- kernel/sched/fair.c | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) -- 2.18.0.huawei.25

1 2

[PATCH openEuler-1.0-LTS] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
by Zhao Mengmeng 24 May '24

24 May '24

From: Jiri Benc <jbenc(a)redhat.com> stable inclusion from stable-v4.19.313 commit b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRPL CVE: CVE-2024-35969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7633c4da919ad51164acbf1aa322cc1a3ead6129 ] Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007ffcf54012a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 41.528593] RAX: ffffffffffffffda RBX: 00007ffcf5401368 RCX: 00007fbc4cfcea9a [ 41.529173] RDX: 000000000000002c RSI: 00007fbc4b9d9bd0 RDI: 0000000000000005 [ 41.529786] RBP: 00007fbc4bafb040 R08: 00007ffcf54013e0 R09: 000000000000000c [ 41.530375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.530977] R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007fbc4ca85d1b [ 41.531573] </TASK> Fixes: 5c578aedcb21d ("IPv6: convert addrconf hash list to RCU") Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Jiri Benc <jbenc(a)redhat.com> Link: https://lore.kernel.org/r/8ab821e36073a4a406c50ec83c9e8dc586c539e4.17125858… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- include/net/addrconf.h | 4 ++++ net/ipv6/addrconf.c | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 9583d3bbab03..10d270f004f0 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -443,6 +443,10 @@ static inline void in6_ifa_hold(struct inet6_ifaddr *ifp) refcount_inc(&ifp->refcnt); } +static inline bool in6_ifa_hold_safe(struct inet6_ifaddr *ifp) +{ + return refcount_inc_not_zero(&ifp->refcnt); +} /* * compute link-local solicited-node multicast address diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index d08d6822fb65..6c76c0c5b971 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -1954,9 +1954,10 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add if (ipv6_addr_equal(&ifp->addr, addr)) { if (!dev || ifp->idev->dev == dev || !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) { - result = ifp; - in6_ifa_hold(ifp); - break; + if (in6_ifa_hold_safe(ifp)) { + result = ifp; + break; + } } } } -- 2.33.0

2 1

[PATCH OLK-6.6 v2 0/7] Patch series "mm: memcg: subtree stats flushing and thresholds" and bugfix
by Lu Jialin 24 May '24

24 May '24

v2->v1: add bugifx for "mm: memcg: restore subtree stats flushing" Lu Jialin (1): memcg/kabi: reserve space for memcg_vmstats_percpu related structures Yosry Ahmed (6): mm: memcg: change flush_next_time to flush_last_time mm: memcg: move vmstats structs definition above flushing code mm: memcg: make stats flushing threshold per-memcg mm: workingset: move the stats flush into workingset_test_recent() mm: memcg: restore subtree stats flushing mm: memcg: optimize parent iteration in memcg_rstat_updated() include/linux/memcontrol.h | 8 +- mm/memcontrol.c | 289 +++++++++++++++++++++---------------- mm/vmscan.c | 2 +- mm/workingset.c | 42 ++++-- 4 files changed, 201 insertions(+), 140 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6] openeuler_defconfig: Modify openeuler-defconfig
by Peng Zhang 24 May '24

24 May '24

From: yanze <lyz25354840(a)gmail.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9RNUT ------------------------------------------------------- The minimum set of kconfig configuartion items is different from that defined by the openEuler community. For details about the modification and reason, see the issue. arm64: CONFIG_PVPANIC=y CONFIG_PVPANIC_MMIO=m x86: CONFIG_RESET_CONTROLLER=y CONFIG_PVPANIC_MMIO=m CONFIG_SATA_ZHAOXIN=y Signed-off-by: yanze <lyz25354840(a)gmail.com> --- arch/arm64/configs/openeuler_defconfig | 4 +++- arch/x86/configs/openeuler_defconfig | 8 +++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 3b8d78f944a0..4b258aa204d5 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2483,7 +2483,9 @@ CONFIG_ALTERA_STAPL=m CONFIG_MISC_RTSX_PCI=m CONFIG_MISC_RTSX_USB=m CONFIG_UACCE=m -# CONFIG_PVPANIC is not set +CONFIG_PVPANIC=y +CONFIG_PVPANIC_MMIO=m +# CONFIG_PVPANIC_PCI is not set # CONFIG_GP_PCI1XXXX is not set # end of Misc devices diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 80a66a8692dc..ec2284ca3b58 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2463,7 +2463,7 @@ CONFIG_MISC_RTSX_PCI=m CONFIG_MISC_RTSX_USB=m CONFIG_UACCE=m CONFIG_PVPANIC=y -# CONFIG_PVPANIC_MMIO is not set +CONFIG_PVPANIC_MMIO=m # CONFIG_PVPANIC_PCI is not set # CONFIG_GP_PCI1XXXX is not set # end of Misc devices @@ -2630,7 +2630,7 @@ CONFIG_ATA_PIIX=m # CONFIG_SATA_ULI is not set # CONFIG_SATA_VIA is not set # CONFIG_SATA_VITESSE is not set -CONFIG_SATA_ZHAOXIN=m +CONFIG_SATA_ZHAOXIN=y # # PATA SFF controllers with BMDMA @@ -7978,7 +7978,9 @@ CONFIG_PWM_LPSS_PLATFORM=m # end of IRQ chip support # CONFIG_IPACK_BUS is not set -# CONFIG_RESET_CONTROLLER is not set +CONFIG_RESET_CONTROLLER=y +# CONFIG_RESET_TI_SYSCON is not set +# CONFIG_RESET_TI_TPS380X is not set # # PHY Subsystem -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] scsi: megaraid_sas: Fix resource leak in case of probe failure
by Luo Gengkun 24 May '24

24 May '24

From: Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> mainline inclusion from mainline-v5.14-rc1 commit b5438f48fdd8e1c3f130d32637511efd32038152 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RQ71 CVE: CVE-2021-47329 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver doesn't clean up all the allocated resources properly when scsi_add_host(), megasas_start_aen() function fails during the PCI device probe. Clean up all those resources. Link: https://lore.kernel.org/r/20210528131307.25683-3-chandrakanth.patil@broadco… Signed-off-by: Chandrakanth Patil <chandrakanth.patil(a)broadcom.com> Signed-off-by: Sumit Saxena <sumit.saxena(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Luo Gengkun <luogengkun(a)huaweicloud.com> --- drivers/scsi/megaraid/megaraid_sas_base.c | 13 +++++++++++++ drivers/scsi/megaraid/megaraid_sas_fusion.c | 1 + 2 files changed, 14 insertions(+) diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c index 3f0752dc8ab5..95e0e39e7f82 100644 --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -6620,11 +6620,16 @@ static int megasas_probe_one(struct pci_dev *pdev, return 0; fail_start_aen: + instance->unload = 1; + scsi_remove_host(instance->host); fail_io_attach: megasas_mgmt_info.count--; megasas_mgmt_info.max_index--; megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL; + if (instance->requestorId && !instance->skip_heartbeat_timer_del) + del_timer_sync(&instance->sriov_heartbeat_timer); + instance->instancet->disable_intr(instance); megasas_destroy_irqs(instance); @@ -6632,8 +6637,16 @@ static int megasas_probe_one(struct pci_dev *pdev, megasas_release_fusion(instance); else megasas_release_mfi(instance); + if (instance->msix_vectors) pci_free_irq_vectors(instance->pdev); + instance->msix_vectors = 0; + + if (instance->fw_crash_state != UNAVAILABLE) + megasas_free_host_crash_buffer(instance); + + if (instance->adapter_type != MFI_SERIES) + megasas_fusion_stop_watchdog(instance); fail_init_mfi: scsi_host_put(host); fail_alloc_instance: diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c index f45c54f02bfa..9d4941cb961b 100644 --- a/drivers/scsi/megaraid/megaraid_sas_fusion.c +++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c @@ -4857,6 +4857,7 @@ megasas_alloc_fusion_context(struct megasas_instance *instance) if (!fusion->log_to_span) { dev_err(&instance->pdev->dev, "Failed from %s %d\n", __func__, __LINE__); + kfree(instance->ctrl_context); return -ENOMEM; } } -- 2.34.1

2 1

[openeuler:OLK-6.6 9687/9759] drivers/crypto/ccp/hygon/csv-dev.c:32:6: warning: no previous prototype for function 'csv_update_api_version'
by kernel test robot 24 May '24

24 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c564f68dbcd17a532bedbcd78ee4a0b3a2853a84 commit: c73088c4bfaa46261a59e5879143688fb540d53b [9687/9759] crypto: ccp: Print Hygon CSV API version when CSV support is detected config: x86_64-randconfig-003-20240524 (https://download.01.org/0day-ci/archive/20240524/202405240829.xBq9c5jO-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240524/202405240829.xBq9c5jO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405240829.xBq9c5jO-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/csv-dev.c:32:6: warning: no previous prototype for function 'csv_update_api_version' [-Wmissing-prototypes] 32 | void csv_update_api_version(struct sev_user_data_status *status) | ^ drivers/crypto/ccp/hygon/csv-dev.c:32:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 32 | void csv_update_api_version(struct sev_user_data_status *status) | ^ | static drivers/crypto/ccp/hygon/csv-dev.c:40:5: warning: no previous prototype for function 'csv_cmd_buffer_len' [-Wmissing-prototypes] 40 | int csv_cmd_buffer_len(int cmd) | ^ drivers/crypto/ccp/hygon/csv-dev.c:40:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 40 | int csv_cmd_buffer_len(int cmd) | ^ | static 2 warnings generated. vim +/csv_update_api_version +32 drivers/crypto/ccp/hygon/csv-dev.c 26 27 /* 28 * csv_update_api_version used to update the api version of HYGON CSV 29 * firmwareat driver side. 30 * Currently, we only need to update @hygon_csv_build. 31 */ > 32 void csv_update_api_version(struct sev_user_data_status *status) 33 { 34 if (status) { 35 hygon_csv_build = (status->flags >> 9) | 36 ((u32)status->build << 23); 37 } 38 } 39 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS 0d9d0b0a2098815d3c3d6dd0b357f79f90673f76
by kernel test robot 24 May '24

24 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 0d9d0b0a2098815d3c3d6dd0b357f79f90673f76 !7733 backport some bugfix of HiSilicon PCIe PMU driver Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allnoconfig |-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst |-- drivers-ub-urma-ubcore-ubcore_cdev_file.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_device.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_genl_admin.c:linux-version.h-not-needed. |-- drivers-ub-urma-ubcore-ubcore_uvs_cmd.c:ubcore_device.h-is-included-more-than-once. `-- drivers-ub-urma-uburma-uburma_mmap.c:linux-version.h-not-needed. elapsed time: 742m configs tested: 35 configs skipped: 131 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240524 clang arm64 randconfig-002-20240524 clang arm64 randconfig-003-20240524 gcc arm64 randconfig-004-20240524 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240524 gcc x86_64 buildonly-randconfig-002-20240524 gcc x86_64 buildonly-randconfig-003-20240524 clang x86_64 buildonly-randconfig-004-20240524 gcc x86_64 buildonly-randconfig-005-20240524 gcc x86_64 buildonly-randconfig-006-20240524 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240524 gcc x86_64 randconfig-002-20240524 clang x86_64 randconfig-003-20240524 clang x86_64 randconfig-004-20240524 clang x86_64 randconfig-005-20240524 clang x86_64 randconfig-006-20240524 gcc x86_64 randconfig-011-20240524 gcc x86_64 randconfig-012-20240524 clang x86_64 randconfig-013-20240524 clang x86_64 randconfig-014-20240524 gcc x86_64 randconfig-015-20240524 gcc x86_64 randconfig-016-20240524 clang x86_64 randconfig-071-20240524 gcc x86_64 randconfig-072-20240524 clang x86_64 randconfig-073-20240524 gcc x86_64 randconfig-074-20240524 gcc x86_64 randconfig-075-20240524 clang x86_64 randconfig-076-20240524 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS WITH WARNING bcfa0f0eaaa58a3d5bc06386ca698a1eabce086a
by kernel test robot 24 May '24

24 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: bcfa0f0eaaa58a3d5bc06386ca698a1eabce086a !7854 net/mlx5e: fix a double-free in arfs_create_groups Warning: (recently discovered and may have been fixed) drivers/spi/spi-phytium-plat.c:186:34: warning: unused variable 'phytium_spi_of_match' [-Wunused-const-variable] mm/debug.c:143:21: warning: more '%' conversions than data arguments [-Wformat-insufficient-args] mm/debug.c:174:3: warning: format specifies type 'void *' but the argument has type 'int' [-Wformat] mm/debug.c:175:18: warning: format specifies type 'unsigned long' but the argument has type 'const unsigned long *' [-Wformat] mm/debug.c:175:3: warning: format specifies type 'int' but the argument has type 'unsigned long' [-Wformat] Unverified Warning (likely false positive, please contact us if interested): drivers/block/loop.c:1338 loop_set_status() warn: inconsistent returns '&loop_ctl_mutex'. Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code `-- x86_64-buildonly-randconfig-002-20240524 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-003-20240524 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-randconfig-005-20240420 | |-- drivers-spi-spi-phytium-plat.c:warning:unused-variable-phytium_spi_of_match | |-- mm-debug.c:warning:format-specifies-type-int-but-the-argument-has-type-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-unsigned-long-but-the-argument-has-type-const-unsigned-long | |-- mm-debug.c:warning:format-specifies-type-void-but-the-argument-has-type-int | `-- mm-debug.c:warning:more-conversions-than-data-arguments `-- x86_64-randconfig-161-20240430 `-- drivers-block-loop.c-loop_set_status()-warn:inconsistent-returns-loop_ctl_mutex-. elapsed time: 740m configs tested: 20 configs skipped: 103 tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240524 gcc x86_64 buildonly-randconfig-002-20240524 gcc x86_64 buildonly-randconfig-003-20240524 clang x86_64 buildonly-randconfig-004-20240524 gcc x86_64 buildonly-randconfig-005-20240524 gcc x86_64 buildonly-randconfig-006-20240524 gcc x86_64 defconfig gcc x86_64 randconfig-001-20240524 gcc x86_64 randconfig-002-20240524 clang x86_64 randconfig-003-20240524 clang x86_64 randconfig-004-20240524 clang x86_64 randconfig-005-20240524 clang x86_64 randconfig-006-20240524 gcc x86_64 randconfig-011-20240524 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7548/9759] drivers/usb/host/xhci.h:2306:17: warning: null destination pointer
by kernel test robot 24 May '24

24 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c564f68dbcd17a532bedbcd78ee4a0b3a2853a84 commit: 1119ec49ac4ac643e6d7c9a5a834040aef87612e [7548/9759] mm, fs: Add BPF_READAHEAD build option for bpf readhead config: arm64-randconfig-003-20240524 (https://download.01.org/0day-ci/archive/20240524/202405240401.vDimp7ud-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240524/202405240401.vDimp7ud-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405240401.vDimp7ud-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/usb/host/xhci-trace.h:25, from drivers/usb/host/xhci-trace.c:12: In function 'xhci_decode_trb', inlined from 'trace_raw_output_xhci_log_trb' at drivers/usb/host/./xhci-trace.h:110:1: >> drivers/usb/host/xhci.h:2306:17: warning: null destination pointer [-Wformat-truncation=] 2306 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2307 | "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2308 | field1, field0, | ~~~~~~~~~~~~~~~ 2309 | xhci_trb_comp_code_string(GET_COMP_CODE(field2)), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2310 | EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2311 | /* Macro decrements 1, maybe it shouldn't?!? */ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2312 | TRB_TO_EP_INDEX(field3) + 1, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2313 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2314 | field3 & EVENT_DATA ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2315 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2486:17: warning: null destination pointer [-Wformat-truncation=] 2486 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2487 | "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2488 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2489 | field2, field1, field0 & 0xffffffe0, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2490 | TRB_TO_PACKET_TYPE(field0), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2491 | TRB_TO_ROOTHUB_PORT(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2492 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2477:17: warning: null destination pointer [-Wformat-truncation=] 2477 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2478 | "%s: ctx %08x%08x slot %d speed %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2479 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2480 | field1, field0, | ~~~~~~~~~~~~~~~ 2481 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ 2482 | TRB_TO_DEV_SPEED(field3), | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2483 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2470:17: warning: null destination pointer [-Wformat-truncation=] 2470 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2471 | "%s: belt %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~ 2472 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2473 | TRB_TO_BELT(field3), | ~~~~~~~~~~~~~~~~~~~~ 2474 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2461:17: warning: null destination pointer [-Wformat-truncation=] 2461 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2462 | "%s: event %08x%08x vf intr %d vf id %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2463 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2464 | field1, field0, | ~~~~~~~~~~~~~~~ 2465 | TRB_TO_VF_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2466 | TRB_TO_VF_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~ 2467 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2454:17: warning: null destination pointer [-Wformat-truncation=] 2454 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2455 | "%s: slot %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~ 2456 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2457 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ 2458 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2443:17: warning: null destination pointer [-Wformat-truncation=] 2443 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2444 | "%s: deq %08x%08x stream %d slot %d ep %d flags %c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2445 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2446 | field1, field0, | ~~~~~~~~~~~~~~~ 2447 | TRB_TO_STREAM_ID(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2448 | TRB_TO_SLOT_ID(field3), | ~~~~~~~~~~~~~~~~~~~~~~~ -- | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2359 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2337:17: warning: null destination pointer [-Wformat-truncation=] 2337 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2338 | "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2339 | field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2340 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2341 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2342 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2343 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2344 | field3 & TRB_CHAIN ? 'C' : 'c', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2345 | field3 & TRB_NO_SNOOP ? 'S' : 's', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2346 | field3 & TRB_ISP ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2347 | field3 & TRB_ENT ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2348 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2319:17: warning: null destination pointer [-Wformat-truncation=] 2319 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2320 | "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2321 | field0 & 0xff, | ~~~~~~~~~~~~~~ 2322 | (field0 & 0xff00) >> 8, | ~~~~~~~~~~~~~~~~~~~~~~~ 2323 | (field0 & 0xff000000) >> 24, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2324 | (field0 & 0xff0000) >> 16, | ~~~~~~~~~~~~~~~~~~~~~~~~~~ 2325 | (field1 & 0xff00) >> 8, | ~~~~~~~~~~~~~~~~~~~~~~~ 2326 | field1 & 0xff, | ~~~~~~~~~~~~~~ 2327 | (field1 & 0xff000000) >> 16 | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2328 | (field1 & 0xff0000) >> 16, | ~~~~~~~~~~~~~~~~~~~~~~~~~~ 2329 | TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2330 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2331 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2332 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2333 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2334 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2365:17: warning: null destination pointer [-Wformat-truncation=] 2365 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2366 | "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2367 | field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2368 | GET_INTR_TARGET(field2), | ~~~~~~~~~~~~~~~~~~~~~~~~ 2369 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2370 | field3 & TRB_BEI ? 'B' : 'b', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2371 | field3 & TRB_IDT ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2372 | field3 & TRB_IOC ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2373 | field3 & TRB_CHAIN ? 'C' : 'c', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2374 | field3 & TRB_NO_SNOOP ? 'S' : 's', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2375 | field3 & TRB_ISP ? 'I' : 'i', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2376 | field3 & TRB_ENT ? 'E' : 'e', | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2377 | field3 & TRB_CYCLE ? 'C' : 'c'); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/xhci.h:2495:17: warning: null destination pointer [-Wformat-truncation=] 2495 | snprintf(str, size, | ^~~~~~~~~~~~~~~~~~~ 2496 | "type '%s' -> raw %08x %08x %08x %08x", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2497 | xhci_trb_type_string(type), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2498 | field0, field1, field2, field3); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/trace/define_trace.h:102, from drivers/usb/host/xhci-trace.h:622: drivers/usb/host/./xhci-trace.h: In function 'trace_raw_output_xhci_log_trb': >> drivers/usb/host/./xhci-trace.h:127:19: warning: '%s' directive argument is null [-Wformat-overflow=] 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~~~~~~~ include/trace/trace_events.h:203:34: note: in definition of macro 'DECLARE_EVENT_CLASS' 203 | trace_event_printf(iter, print); \ | ^~~~~ drivers/usb/host/./xhci-trace.h:127:9: note: in expansion of macro 'TP_printk' 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~~~~~~~~ In file included from include/trace/trace_events.h:237: drivers/usb/host/./xhci-trace.h:127:24: note: format string is defined here 127 | TP_printk("%s: %s", xhci_ring_type_string(__entry->type), | ^~ In function 'xhci_decode_ep_context', inlined from 'trace_raw_output_xhci_log_ep_ctx' at drivers/usb/host/./xhci-trace.h:312:1: >> drivers/usb/host/xhci.h:2801:15: warning: argument 1 null where non-null expected [-Wnonnull] 2801 | ret = sprintf(str, "State %s mult %d max P. Streams %d %s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2802 | xhci_ep_state_string(ep_state), mult, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2803 | max_pstr, lsa ? "LSA " : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/kernel.h:32, from include/linux/cpumask.h:10, from include/linux/smp.h:13, from include/linux/tracepoint.h:15, from drivers/usb/host/xhci-trace.h:24: include/linux/sprintf.h: In function 'trace_raw_output_xhci_log_ep_ctx': include/linux/sprintf.h:10:20: note: in a call to function 'sprintf' declared 'nonnull' 10 | __printf(2, 3) int sprintf(char *buf, const char * fmt, ...); | ^~~~~~~ In function 'xhci_decode_ep_context', inlined from 'trace_raw_output_xhci_log_ep_ctx' at drivers/usb/host/./xhci-trace.h:312:1: drivers/usb/host/xhci.h:2801:15: warning: null destination pointer [-Wformat-overflow=] 2801 | ret = sprintf(str, "State %s mult %d max P. Streams %d %s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2802 | xhci_ep_state_string(ep_state), mult, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2803 | max_pstr, lsa ? "LSA " : ""); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/host/./xhci-trace.h: In function 'trace_raw_output_xhci_log_ep_ctx': drivers/usb/host/./xhci-trace.h:327:19: warning: '%s' directive argument is null [-Wformat-overflow=] 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~~~ include/trace/trace_events.h:203:34: note: in definition of macro 'DECLARE_EVENT_CLASS' 203 | trace_event_printf(iter, print); \ | ^~~~~ drivers/usb/host/./xhci-trace.h:327:9: note: in expansion of macro 'TP_printk' 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~~~~~~~~ drivers/usb/host/./xhci-trace.h:327:20: note: format string is defined here 327 | TP_printk("%s", xhci_decode_ep_context(__get_buf(XHCI_MSG_MAX), | ^~ In function 'xhci_decode_slot_context', inlined from 'trace_raw_output_xhci_log_slot_ctx' at drivers/usb/host/./xhci-trace.h:357:1: drivers/usb/host/xhci.h:2546:15: warning: argument 1 null where non-null expected [-Wnonnull] 2546 | ret = sprintf(str, "RS %05x %s%s%s Ctx Entries %d MEL %d us Port# %d/%d", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2547 | info & ROUTE_STRING_MASK, | ~~~~~~~~~~~~~~~~~~~~~~~~~ 2548 | ({ char *s; | ~~~~~~~~~~~ 2549 | switch (speed) { | ~~~~~~~~~~~~~~~~ 2550 | case SLOT_SPEED_FS: | ~~~~~~~~~~~~~~~~~~~ 2551 | s = "full-speed"; | ~~~~~~~~~~~~~~~~~ 2552 | break; | ~~~~~~ 2553 | case SLOT_SPEED_LS: | ~~~~~~~~~~~~~~~~~~~ 2554 | s = "low-speed"; | ~~~~~~~~~~~~~~~~ 2555 | break; | ~~~~~~ 2556 | case SLOT_SPEED_HS: | ~~~~~~~~~~~~~~~~~~~ 2557 | s = "high-speed"; | ~~~~~~~~~~~~~~~~~ 2558 | break; | ~~~~~~ 2559 | case SLOT_SPEED_SS: | ~~~~~~~~~~~~~~~~~~~ 2560 | s = "super-speed"; | ~~~~~~~~~~~~~~~~~~ 2561 | break; | ~~~~~~ 2562 | case SLOT_SPEED_SSP: | ~~~~~~~~~~~~~~~~~~~~ 2563 | s = "super-speed plus"; | ~~~~~~~~~~~~~~~~~~~~~~~ 2564 | break; | ~~~~~~ 2565 | default: | ~~~~~~~~ 2566 | s = "UNKNOWN speed"; | ~~~~~~~~~~~~~~~~~~~~ 2567 | } s; }), | ~~~~~~~~ 2568 | mtt ? " multi-TT" : "", | ~~~~~~~~~~~~~~~~~~~~~~~ 2569 | hub ? " Hub" : "", | ~~~~~~~~~~~~~~~~~~ 2570 | (info & LAST_CTX_MASK) >> 27, | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2571 | info2 & MAX_EXIT, | ~~~~~~~~~~~~~~~~~ 2572 | DEVINFO_TO_ROOT_HUB_PORT(info2), | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2573 | DEVINFO_TO_MAX_PORTS(info2)); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/sprintf.h: In function 'trace_raw_output_xhci_log_slot_ctx': include/linux/sprintf.h:10:20: note: in a call to function 'sprintf' declared 'nonnull' 10 | __printf(2, 3) int sprintf(char *buf, const char * fmt, ...); | ^~~~~~~ vim +2306 drivers/usb/host/xhci.h 52407729fbeabb Felipe Balbi 2017-04-07 2281 cbf286e8ef8337 Mathias Nyman 2021-08-20 2282 static inline const char *xhci_decode_trb(char *str, size_t size, cbf286e8ef8337 Mathias Nyman 2021-08-20 2283 u32 field0, u32 field1, u32 field2, u32 field3) a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2284 { a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2285 int type = TRB_FIELD_TO_TYPE(field3); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2286 a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2287 switch (type) { a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2288 case TRB_LINK: cbf286e8ef8337 Mathias Nyman 2021-08-20 2289 snprintf(str, size, 96d9a6eb97d77d Lu Baolu 2017-04-07 2290 "LINK %08x%08x intr %d type '%s' flags %c:%c:%c:%c", 96d9a6eb97d77d Lu Baolu 2017-04-07 2291 field1, field0, GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2292 xhci_trb_type_string(type), 96d9a6eb97d77d Lu Baolu 2017-04-07 2293 field3 & TRB_IOC ? 'I' : 'i', 96d9a6eb97d77d Lu Baolu 2017-04-07 2294 field3 & TRB_CHAIN ? 'C' : 'c', 96d9a6eb97d77d Lu Baolu 2017-04-07 2295 field3 & TRB_TC ? 'T' : 't', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2296 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2297 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2298 case TRB_TRANSFER: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2299 case TRB_COMPLETION: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2300 case TRB_PORT_STATUS: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2301 case TRB_BANDWIDTH_EVENT: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2302 case TRB_DOORBELL: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2303 case TRB_HC_EVENT: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2304 case TRB_DEV_NOTE: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2305 case TRB_MFINDEX_WRAP: cbf286e8ef8337 Mathias Nyman 2021-08-20 @2306 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2307 "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c", a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2308 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2309 xhci_trb_comp_code_string(GET_COMP_CODE(field2)), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2310 EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2311 /* Macro decrements 1, maybe it shouldn't?!? */ a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2312 TRB_TO_EP_INDEX(field3) + 1, d2561626b9d126 Lu Baolu 2017-04-07 2313 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2314 field3 & EVENT_DATA ? 'E' : 'e', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2315 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2316 a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2317 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2318 case TRB_SETUP: cbf286e8ef8337 Mathias Nyman 2021-08-20 2319 snprintf(str, size, cbf286e8ef8337 Mathias Nyman 2021-08-20 2320 "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2321 field0 & 0xff, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2322 (field0 & 0xff00) >> 8, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2323 (field0 & 0xff000000) >> 24, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2324 (field0 & 0xff0000) >> 16, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2325 (field1 & 0xff00) >> 8, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2326 field1 & 0xff, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2327 (field1 & 0xff000000) >> 16 | a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2328 (field1 & 0xff0000) >> 16, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2329 TRB_LEN(field2), GET_TD_SIZE(field2), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2330 GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2331 xhci_trb_type_string(type), 5d062aba0d399c Felipe Balbi 2017-04-07 2332 field3 & TRB_IDT ? 'I' : 'i', 5d062aba0d399c Felipe Balbi 2017-04-07 2333 field3 & TRB_IOC ? 'I' : 'i', 5d062aba0d399c Felipe Balbi 2017-04-07 2334 field3 & TRB_CYCLE ? 'C' : 'c'); 5d062aba0d399c Felipe Balbi 2017-04-07 2335 break; 5d062aba0d399c Felipe Balbi 2017-04-07 2336 case TRB_DATA: cbf286e8ef8337 Mathias Nyman 2021-08-20 2337 snprintf(str, size, cbf286e8ef8337 Mathias Nyman 2021-08-20 2338 "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", 5d062aba0d399c Felipe Balbi 2017-04-07 2339 field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), 5d062aba0d399c Felipe Balbi 2017-04-07 2340 GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2341 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2342 field3 & TRB_IDT ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2343 field3 & TRB_IOC ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2344 field3 & TRB_CHAIN ? 'C' : 'c', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2345 field3 & TRB_NO_SNOOP ? 'S' : 's', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2346 field3 & TRB_ISP ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2347 field3 & TRB_ENT ? 'E' : 'e', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2348 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2349 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2350 case TRB_STATUS: cbf286e8ef8337 Mathias Nyman 2021-08-20 2351 snprintf(str, size, cbf286e8ef8337 Mathias Nyman 2021-08-20 2352 "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c", 5d062aba0d399c Felipe Balbi 2017-04-07 2353 field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), 5d062aba0d399c Felipe Balbi 2017-04-07 2354 GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2355 xhci_trb_type_string(type), 5d062aba0d399c Felipe Balbi 2017-04-07 2356 field3 & TRB_IOC ? 'I' : 'i', 5d062aba0d399c Felipe Balbi 2017-04-07 2357 field3 & TRB_CHAIN ? 'C' : 'c', 5d062aba0d399c Felipe Balbi 2017-04-07 2358 field3 & TRB_ENT ? 'E' : 'e', 5d062aba0d399c Felipe Balbi 2017-04-07 2359 field3 & TRB_CYCLE ? 'C' : 'c'); 5d062aba0d399c Felipe Balbi 2017-04-07 2360 break; 5d062aba0d399c Felipe Balbi 2017-04-07 2361 case TRB_NORMAL: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2362 case TRB_ISOC: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2363 case TRB_EVENT_DATA: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2364 case TRB_TR_NOOP: cbf286e8ef8337 Mathias Nyman 2021-08-20 2365 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2366 "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c", a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2367 field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2368 GET_INTR_TARGET(field2), d2561626b9d126 Lu Baolu 2017-04-07 2369 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2370 field3 & TRB_BEI ? 'B' : 'b', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2371 field3 & TRB_IDT ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2372 field3 & TRB_IOC ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2373 field3 & TRB_CHAIN ? 'C' : 'c', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2374 field3 & TRB_NO_SNOOP ? 'S' : 's', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2375 field3 & TRB_ISP ? 'I' : 'i', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2376 field3 & TRB_ENT ? 'E' : 'e', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2377 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2378 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2379 a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2380 case TRB_CMD_NOOP: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2381 case TRB_ENABLE_SLOT: cbf286e8ef8337 Mathias Nyman 2021-08-20 2382 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2383 "%s: flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2384 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2385 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2386 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2387 case TRB_DISABLE_SLOT: a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2388 case TRB_NEG_BANDWIDTH: cbf286e8ef8337 Mathias Nyman 2021-08-20 2389 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2390 "%s: slot %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2391 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2392 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2393 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2394 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2395 case TRB_ADDR_DEV: cbf286e8ef8337 Mathias Nyman 2021-08-20 2396 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2397 "%s: ctx %08x%08x slot %d flags %c:%c", d2561626b9d126 Lu Baolu 2017-04-07 2398 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2399 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2400 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2401 field3 & TRB_BSR ? 'B' : 'b', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2402 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2403 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2404 case TRB_CONFIG_EP: cbf286e8ef8337 Mathias Nyman 2021-08-20 2405 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2406 "%s: ctx %08x%08x slot %d flags %c:%c", d2561626b9d126 Lu Baolu 2017-04-07 2407 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2408 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2409 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2410 field3 & TRB_DC ? 'D' : 'd', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2411 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2412 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2413 case TRB_EVAL_CONTEXT: cbf286e8ef8337 Mathias Nyman 2021-08-20 2414 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2415 "%s: ctx %08x%08x slot %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2416 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2417 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2418 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2419 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2420 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2421 case TRB_RESET_EP: cbf286e8ef8337 Mathias Nyman 2021-08-20 2422 snprintf(str, size, 8a62dff2c0734a Mathias Nyman 2019-08-30 2423 "%s: ctx %08x%08x slot %d ep %d flags %c:%c", d2561626b9d126 Lu Baolu 2017-04-07 2424 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2425 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2426 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2427 /* Macro decrements 1, maybe it shouldn't?!? */ a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2428 TRB_TO_EP_INDEX(field3) + 1, 8a62dff2c0734a Mathias Nyman 2019-08-30 2429 field3 & TRB_TSP ? 'T' : 't', a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2430 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2431 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2432 case TRB_STOP_RING: 1ce69c35b86038 Sergey Shtylyov 2022-06-30 2433 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2434 "%s: slot %d sp %d ep %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2435 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2436 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2437 TRB_TO_SUSPEND_PORT(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2438 /* Macro decrements 1, maybe it shouldn't?!? */ a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2439 TRB_TO_EP_INDEX(field3) + 1, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2440 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2441 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2442 case TRB_SET_DEQ: cbf286e8ef8337 Mathias Nyman 2021-08-20 2443 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2444 "%s: deq %08x%08x stream %d slot %d ep %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2445 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2446 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2447 TRB_TO_STREAM_ID(field2), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2448 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2449 /* Macro decrements 1, maybe it shouldn't?!? */ a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2450 TRB_TO_EP_INDEX(field3) + 1, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2451 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2452 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2453 case TRB_RESET_DEV: cbf286e8ef8337 Mathias Nyman 2021-08-20 2454 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2455 "%s: slot %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2456 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2457 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2458 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2459 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2460 case TRB_FORCE_EVENT: cbf286e8ef8337 Mathias Nyman 2021-08-20 2461 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2462 "%s: event %08x%08x vf intr %d vf id %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2463 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2464 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2465 TRB_TO_VF_INTR_TARGET(field2), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2466 TRB_TO_VF_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2467 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2468 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2469 case TRB_SET_LT: cbf286e8ef8337 Mathias Nyman 2021-08-20 2470 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2471 "%s: belt %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2472 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2473 TRB_TO_BELT(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2474 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2475 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2476 case TRB_GET_BW: cbf286e8ef8337 Mathias Nyman 2021-08-20 2477 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2478 "%s: ctx %08x%08x slot %d speed %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2479 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2480 field1, field0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2481 TRB_TO_SLOT_ID(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2482 TRB_TO_DEV_SPEED(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2483 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2484 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2485 case TRB_FORCE_HEADER: cbf286e8ef8337 Mathias Nyman 2021-08-20 2486 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2487 "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c", d2561626b9d126 Lu Baolu 2017-04-07 2488 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2489 field2, field1, field0 & 0xffffffe0, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2490 TRB_TO_PACKET_TYPE(field0), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2491 TRB_TO_ROOTHUB_PORT(field3), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2492 field3 & TRB_CYCLE ? 'C' : 'c'); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2493 break; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2494 default: cbf286e8ef8337 Mathias Nyman 2021-08-20 2495 snprintf(str, size, a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2496 "type '%s' -> raw %08x %08x %08x %08x", d2561626b9d126 Lu Baolu 2017-04-07 2497 xhci_trb_type_string(type), a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2498 field0, field1, field2, field3); a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2499 } a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2500 a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2501 return str; a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2502 } a37c3f76e6a6b5 Felipe Balbi 2017-01-23 2503 :::::: The code at line 2306 was first introduced by commit :::::: cbf286e8ef8337308c259ff5b9ce2e74d403be5a xhci: fix unsafe memory usage in xhci tracing :::::: TO: Mathias Nyman <mathias.nyman(a)linux.intel.com> :::::: CC: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION c564f68dbcd17a532bedbcd78ee4a0b3a2853a84
by kernel test robot 24 May '24

24 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: c564f68dbcd17a532bedbcd78ee4a0b3a2853a84 !7730 v2 sched: QOS_SCHED_DYNAMIC_AFFINITY depend on FAIR_CGROUP_SCHED Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-defconfig | |-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-004-20240524 | `-- arch-arm64-kernel-cpufeature.c:warning:enable_pseudo_nmi-defined-but-not-used |-- loongarch-allnoconfig | `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) `-- loongarch-randconfig-001-20240524 `-- drivers-irqchip-irq-loongson-eiointc.c:error:NODES_PER_FLATMODE_NODE-undeclared-(first-use-in-this-function) clang_recent_errors `-- arm64-allmodconfig |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box `-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create elapsed time: 722m configs tested: 16 configs skipped: 126 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240524 clang arm64 randconfig-002-20240524 clang arm64 randconfig-003-20240524 gcc arm64 randconfig-004-20240524 gcc loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240524 gcc loongarch randconfig-002-20240524 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 defconfig gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/1] virtio_ring : keep used_wrap_counter in
by Zheng Zengkai 23 May '24

23 May '24

Backport 5.19-rc5 patch to fix kernel panic caused by netperf/iperf3 test. huangjie.albert (1): virtio_ring : keep used_wrap_counter in vq->last_used_idx drivers/virtio/virtio_ring.c | 76 +++++++++++++++++++++++------------- 1 file changed, 48 insertions(+), 28 deletions(-) -- 2.20.1

2 2

[PATCH v3 OLK-6.6] Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'"
by liwei 23 May '24

23 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8XMTL CVE: NA ------------------------------------------------------------------ This reverts commit 2eb3daf61b18d620b0624e31ad44ac1c76d94075. To keep CONFIG unchanged, modify ACPI_HOTPLUG_PRESENT_CPU to ACPI_HOTPLUG_CPU. Conflicts: arch/x86/Kconfig drivers/acpi/acpi_processor.c include/linux/acpi.h Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/loongarch/Kconfig | 2 +- arch/loongarch/kernel/acpi.c | 4 ++-- arch/x86/Kconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- arch/x86/kernel/acpi/boot.c | 4 ++-- drivers/acpi/Kconfig | 6 +++--- drivers/acpi/acpi_processor.c | 4 ++-- drivers/acpi/bus.c | 2 +- include/linux/acpi.h | 2 +- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index edbbf03d29d9..58da6e03ecb5 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -5,7 +5,7 @@ config LOONGARCH select ACPI select ACPI_GENERIC_GSI if ACPI select ACPI_MCFG if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_PPTT if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI select ARCH_BINFMT_ELF_STATE diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c index f453271e6add..58819b017ba8 100644 --- a/arch/loongarch/kernel/acpi.c +++ b/arch/loongarch/kernel/acpi.c @@ -291,7 +291,7 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size) memblock_reserve(addr, size); } -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> @@ -343,4 +343,4 @@ int acpi_unmap_cpu(int cpu) } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 6cfa82a633a6..0ac76a2637f8 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -60,7 +60,7 @@ config X86 # select ACPI_LEGACY_TABLES_LOOKUP if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_HOTPLUG_IGNORE_OSC if ACPI && HOTPLUG_CPU select ARCH_32BIT_OFF_T if X86_32 select ARCH_CLOCKSOURCE_INIT diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 80a66a8692dc..1c1fb626ae9e 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -609,7 +609,7 @@ CONFIG_ACPI_PROCESSOR_IDLE=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=m -CONFIG_ACPI_HOTPLUG_PRESENT_CPU=y +CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_HOTPLUG_IGNORE_OSC=y CONFIG_ACPI_PROCESSOR_AGGREGATOR=m CONFIG_ACPI_THERMAL=y diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 8202bd2d957d..c55c0ef47a18 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -817,7 +817,7 @@ static void __init acpi_set_irq_model_ioapic(void) /* * ACPI based hotplug support for CPU */ -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> static int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid) @@ -866,7 +866,7 @@ int acpi_unmap_cpu(int cpu) return (0); } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base) { diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig index c49978b4b11f..c4746869d67b 100644 --- a/drivers/acpi/Kconfig +++ b/drivers/acpi/Kconfig @@ -305,14 +305,14 @@ config ACPI_IPMI To compile this driver as a module, choose M here: the module will be called as acpi_ipmi. -config ACPI_HOTPLUG_PRESENT_CPU +config ACPI_HOTPLUG_CPU bool depends on ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_CONTAINER config ACPI_HOTPLUG_IGNORE_OSC bool - depends on ACPI_HOTPLUG_PRESENT_CPU + depends on ACPI_HOTPLUG_CPU help Ignore whether firmware acknowledged support for toggling the CPU present bit in _STA. Some architectures predate the _OSC bits, so @@ -408,7 +408,7 @@ config ACPI_PCI_SLOT config ACPI_CONTAINER bool "Container and Module Devices" - default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_PRESENT_CPU) + default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_CPU) help This driver supports ACPI Container and Module devices (IDs ACPI0004, PNP0A05, and PNP0A06). diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c index 5bb207a7a1dd..0ff69af46a50 100644 --- a/drivers/acpi/acpi_processor.c +++ b/drivers/acpi/acpi_processor.c @@ -184,7 +184,7 @@ static void __init acpi_pcc_cpufreq_init(void) {} static bool acpi_processor_hotplug_present_supported(void) { - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) return false; /* x86 systems pre-date the _OSC bit */ @@ -502,7 +502,7 @@ static void acpi_processor_make_not_present(struct acpi_device *device) { struct acpi_processor *pr; - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) { + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) { pr_err_once("Changing CPU present bit is not supported"); return; } diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index b42f17bfbb09..0d2e1de143ef 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -355,7 +355,7 @@ static void acpi_bus_osc_negotiate_platform_control(void) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_APEI_SUPPORT; capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_ENABLED_SUPPORT; - if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_PRESENT_SUPPORT; if (ACPI_FAILURE(acpi_get_handle(NULL, "\\_SB", &handle))) diff --git a/include/linux/acpi.h b/include/linux/acpi.h index a0e96f6e2de2..cc84f370620f 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -651,7 +651,7 @@ static inline u32 acpi_osc_ctx_get_cxl_control(struct acpi_osc_context *context) #define ACPI_GSB_ACCESS_ATTRIB_RAW_PROCESS 0x0000000F /* Enable _OST when all relevant hotplug operations are enabled */ -#if defined(CONFIG_ACPI_HOTPLUG_PRESENT_CPU) && \ +#if defined(CONFIG_ACPI_HOTPLUG_CPU) && \ defined(CONFIG_ACPI_HOTPLUG_MEMORY) && \ defined(CONFIG_ACPI_CONTAINER) #define ACPI_HOTPLUG_OST -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances
by Ye Bin 23 May '24

23 May '24

From: Chao Yu <yuchao0(a)huawei.com> mainline inclusion from mainline-v5.14-rc1 commit cad83c968c2ebe97905f900326988ed37146c347 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RLZ0 CVE: CVE-2021-47335 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- As syzbot reported, there is an use-after-free issue during f2fs recovery: Use-after-free write at 0xffff88823bc16040 (in kfence-#10): kmem_cache_destroy+0x1f/0x120 mm/slab_common.c:486 f2fs_recover_fsync_data+0x75b0/0x8380 fs/f2fs/recovery.c:869 f2fs_fill_super+0x9393/0xa420 fs/f2fs/super.c:3945 mount_bdev+0x26c/0x3a0 fs/super.c:1367 legacy_get_tree+0xea/0x180 fs/fs_context.c:592 vfs_get_tree+0x86/0x270 fs/super.c:1497 do_new_mount fs/namespace.c:2905 [inline] path_mount+0x196f/0x2be0 fs/namespace.c:3235 do_mount fs/namespace.c:3248 [inline] __do_sys_mount fs/namespace.c:3456 [inline] __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3433 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is multi f2fs filesystem instances can race on accessing global fsync_entry_slab pointer, result in use-after-free issue of slab cache, fixes to init/destroy this slab cache only once during module init/destroy procedure to avoid this issue. Reported-by: syzbot+9d90dad32dd9727ed084(a)syzkaller.appspotmail.com Signed-off-by: Chao Yu <yuchao0(a)huawei.com> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Conflicts: fs/f2fs/recovery.c fs/f2fs/super.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- fs/f2fs/f2fs.h | 2 ++ fs/f2fs/recovery.c | 23 ++++++++++++++--------- fs/f2fs/super.c | 8 +++++++- 3 files changed, 23 insertions(+), 10 deletions(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index 8cbc9da523dc..5627e02493c7 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -3095,6 +3095,8 @@ void f2fs_build_gc_manager(struct f2fs_sb_info *sbi); */ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only); bool f2fs_space_for_roll_forward(struct f2fs_sb_info *sbi); +int __init f2fs_create_recovery_cache(void); +void f2fs_destroy_recovery_cache(void); /* * debug.c diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c index 733f005b85d6..40afb6a213d8 100644 --- a/fs/f2fs/recovery.c +++ b/fs/f2fs/recovery.c @@ -683,13 +683,6 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only) quota_enabled = f2fs_enable_quota_files(sbi, s_flags & SB_RDONLY); #endif - fsync_entry_slab = f2fs_kmem_cache_create("f2fs_fsync_inode_entry", - sizeof(struct fsync_inode_entry)); - if (!fsync_entry_slab) { - err = -ENOMEM; - goto out; - } - INIT_LIST_HEAD(&inode_list); INIT_LIST_HEAD(&tmp_inode_list); INIT_LIST_HEAD(&dir_list); @@ -747,8 +740,6 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only) } } - kmem_cache_destroy(fsync_entry_slab); -out: #ifdef CONFIG_QUOTA /* Turn quotas off */ if (quota_enabled) @@ -758,3 +749,17 @@ int f2fs_recover_fsync_data(struct f2fs_sb_info *sbi, bool check_only) return ret ? ret: err; } + +int __init f2fs_create_recovery_cache(void) +{ + fsync_entry_slab = f2fs_kmem_cache_create("f2fs_fsync_inode_entry", + sizeof(struct fsync_inode_entry)); + if (!fsync_entry_slab) + return -ENOMEM; + return 0; +} + +void f2fs_destroy_recovery_cache(void) +{ + kmem_cache_destroy(fsync_entry_slab); +} diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 7a9cc64f5ca3..cb2579e987aa 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -3305,9 +3305,12 @@ static int __init init_f2fs_fs(void) err = f2fs_create_checkpoint_caches(); if (err) goto free_segment_manager_caches; - err = f2fs_create_extent_cache(); + err = f2fs_create_recovery_cache(); if (err) goto free_checkpoint_caches; + err = f2fs_create_extent_cache(); + if (err) + goto free_recovery_cache; err = f2fs_init_sysfs(); if (err) goto free_extent_cache; @@ -3335,6 +3338,8 @@ static int __init init_f2fs_fs(void) f2fs_exit_sysfs(); free_extent_cache: f2fs_destroy_extent_cache(); +free_recovery_cache: + f2fs_destroy_recovery_cache(); free_checkpoint_caches: f2fs_destroy_checkpoint_caches(); free_segment_manager_caches: @@ -3355,6 +3360,7 @@ static void __exit exit_f2fs_fs(void) unregister_shrinker(&f2fs_shrinker_info); f2fs_exit_sysfs(); f2fs_destroy_extent_cache(); + f2fs_destroy_recovery_cache(); f2fs_destroy_checkpoint_caches(); f2fs_destroy_segment_manager_caches(); f2fs_destroy_node_manager_caches(); -- 2.31.1

2 1

[PATCH v2 OLK-6.6] Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'"
by liwei 23 May '24

23 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8XMTL CVE: NA ------------------------------------------------------------------ This reverts commit 2eb3daf61b18d620b0624e31ad44ac1c76d94075. To keep CONFIG unchanged, modify ACPI_HOTPLUG_PRESENT_CPU to ACPI_HOTPLUG_CPU. Signed-off-by: liwei <liwei728(a)huawei.com> Conflicts: arch/x86/Kconfig drivers/acpi/acpi_processor.c include/linux/acpi.h --- arch/loongarch/Kconfig | 2 +- arch/loongarch/kernel/acpi.c | 4 ++-- arch/x86/Kconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- arch/x86/kernel/acpi/boot.c | 4 ++-- drivers/acpi/Kconfig | 6 +++--- drivers/acpi/acpi_processor.c | 4 ++-- drivers/acpi/bus.c | 2 +- include/linux/acpi.h | 2 +- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index edbbf03d29d9..58da6e03ecb5 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -5,7 +5,7 @@ config LOONGARCH select ACPI select ACPI_GENERIC_GSI if ACPI select ACPI_MCFG if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_PPTT if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI select ARCH_BINFMT_ELF_STATE diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c index f453271e6add..58819b017ba8 100644 --- a/arch/loongarch/kernel/acpi.c +++ b/arch/loongarch/kernel/acpi.c @@ -291,7 +291,7 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size) memblock_reserve(addr, size); } -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> @@ -343,4 +343,4 @@ int acpi_unmap_cpu(int cpu) } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 6cfa82a633a6..0ac76a2637f8 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -60,7 +60,7 @@ config X86 # select ACPI_LEGACY_TABLES_LOOKUP if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_HOTPLUG_IGNORE_OSC if ACPI && HOTPLUG_CPU select ARCH_32BIT_OFF_T if X86_32 select ARCH_CLOCKSOURCE_INIT diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 80a66a8692dc..1c1fb626ae9e 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -609,7 +609,7 @@ CONFIG_ACPI_PROCESSOR_IDLE=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=m -CONFIG_ACPI_HOTPLUG_PRESENT_CPU=y +CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_HOTPLUG_IGNORE_OSC=y CONFIG_ACPI_PROCESSOR_AGGREGATOR=m CONFIG_ACPI_THERMAL=y diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 8202bd2d957d..c55c0ef47a18 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -817,7 +817,7 @@ static void __init acpi_set_irq_model_ioapic(void) /* * ACPI based hotplug support for CPU */ -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> static int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid) @@ -866,7 +866,7 @@ int acpi_unmap_cpu(int cpu) return (0); } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base) { diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig index c49978b4b11f..c4746869d67b 100644 --- a/drivers/acpi/Kconfig +++ b/drivers/acpi/Kconfig @@ -305,14 +305,14 @@ config ACPI_IPMI To compile this driver as a module, choose M here: the module will be called as acpi_ipmi. -config ACPI_HOTPLUG_PRESENT_CPU +config ACPI_HOTPLUG_CPU bool depends on ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_CONTAINER config ACPI_HOTPLUG_IGNORE_OSC bool - depends on ACPI_HOTPLUG_PRESENT_CPU + depends on ACPI_HOTPLUG_CPU help Ignore whether firmware acknowledged support for toggling the CPU present bit in _STA. Some architectures predate the _OSC bits, so @@ -408,7 +408,7 @@ config ACPI_PCI_SLOT config ACPI_CONTAINER bool "Container and Module Devices" - default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_PRESENT_CPU) + default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_CPU) help This driver supports ACPI Container and Module devices (IDs ACPI0004, PNP0A05, and PNP0A06). diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c index 5bb207a7a1dd..0ff69af46a50 100644 --- a/drivers/acpi/acpi_processor.c +++ b/drivers/acpi/acpi_processor.c @@ -184,7 +184,7 @@ static void __init acpi_pcc_cpufreq_init(void) {} static bool acpi_processor_hotplug_present_supported(void) { - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) return false; /* x86 systems pre-date the _OSC bit */ @@ -502,7 +502,7 @@ static void acpi_processor_make_not_present(struct acpi_device *device) { struct acpi_processor *pr; - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) { + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) { pr_err_once("Changing CPU present bit is not supported"); return; } diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index b42f17bfbb09..0d2e1de143ef 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -355,7 +355,7 @@ static void acpi_bus_osc_negotiate_platform_control(void) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_APEI_SUPPORT; capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_ENABLED_SUPPORT; - if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_PRESENT_SUPPORT; if (ACPI_FAILURE(acpi_get_handle(NULL, "\\_SB", &handle))) diff --git a/include/linux/acpi.h b/include/linux/acpi.h index a0e96f6e2de2..cc84f370620f 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -651,7 +651,7 @@ static inline u32 acpi_osc_ctx_get_cxl_control(struct acpi_osc_context *context) #define ACPI_GSB_ACCESS_ATTRIB_RAW_PROCESS 0x0000000F /* Enable _OST when all relevant hotplug operations are enabled */ -#if defined(CONFIG_ACPI_HOTPLUG_PRESENT_CPU) && \ +#if defined(CONFIG_ACPI_HOTPLUG_CPU) && \ defined(CONFIG_ACPI_HOTPLUG_MEMORY) && \ defined(CONFIG_ACPI_CONTAINER) #define ACPI_HOTPLUG_OST -- 2.25.1

2 1

[PATCH OLK-6.6 0/6] Patch series "mm: memcg: subtree stats flushing and thresholds"
by Lu Jialin 23 May '24

23 May '24

Lu Jialin (1): memcg/kabi: reserve space for memcg_vmstats_percpu related structures Yosry Ahmed (5): mm: memcg: change flush_next_time to flush_last_time mm: memcg: move vmstats structs definition above flushing code mm: memcg: make stats flushing threshold per-memcg mm: workingset: move the stats flush into workingset_test_recent() mm: memcg: restore subtree stats flushing include/linux/memcontrol.h | 8 +- mm/memcontrol.c | 266 +++++++++++++++++++++---------------- mm/vmscan.c | 2 +- mm/workingset.c | 42 ++++-- 4 files changed, 182 insertions(+), 136 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 00/11] Introduce NUMA isolation and consolidation
by Hui Tang 23 May '24

23 May '24

Introduce NUMA isolation and consolidation. Guan Jing (1): sched: Add can_migrate_task hook Hui Tang (10): sched: Introduce CONFIG_TASK_PLACEMENT_BY_CPU_RANGE sched: Some fixes for select_rq hook bpf:programmable: Add nodemask operation collection sched: Introduce task relationship by net and memory bpf:programmable: Add helper to get memory and net relationship sched: Add ioctl to get relationship sched: Update numa group preferred node periodically bpf:programmable: Add helper to set preferred node sched: Introduce CONFIG_QOS_SCHED_NUMA_ICON config: Enable NUMA isolation and consolidation by default arch/arm64/configs/openeuler_defconfig | 4 +- arch/x86/configs/openeuler_defconfig | 2 + fs/exec.c | 2 + include/linux/sched.h | 58 +++- include/linux/sched/relationship.h | 202 ++++++++++++ include/linux/sched_hook_defs.h | 4 + include/uapi/linux/bpf.h | 50 +++ include/uapi/linux/sched_ctrl.h | 57 ++++ init/Kconfig | 28 ++ init/init_task.c | 3 + kernel/fork.c | 13 + kernel/sched/Makefile | 2 + kernel/sched/bpf_sched.c | 149 +++++++++ kernel/sched/core.c | 7 + kernel/sched/debug.c | 2 + kernel/sched/fair.c | 302 +++++++++++++++-- kernel/sched/numa_icon.c | 144 ++++++++ kernel/sched/numa_icon.h | 43 +++ kernel/sched/relationship.c | 436 +++++++++++++++++++++++++ kernel/sched/relationship_ioctl.c | 142 ++++++++ kernel/sched/sched.h | 2 + scripts/bpf_helpers_doc.py | 12 + tools/include/uapi/linux/bpf.h | 50 +++ tools/lib/bpf/libbpf_sched.h | 160 ++++++++- 24 files changed, 1848 insertions(+), 26 deletions(-) create mode 100644 include/linux/sched/relationship.h create mode 100644 include/uapi/linux/sched_ctrl.h create mode 100644 kernel/sched/numa_icon.c create mode 100644 kernel/sched/numa_icon.h create mode 100644 kernel/sched/relationship.c create mode 100644 kernel/sched/relationship_ioctl.c -- 2.34.1

2 12

[PATCH openEuler-22.03-LTS-SP1] Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
by Liu Chuang 23 May '24

23 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.201 commit 6c71e065befb2fae8f1461559b940c04e1071bd5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFE5 CVE: CVE-2023-52840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mount… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c index 47d1b97ed6cf..a1b2c86ef611 100644 --- a/drivers/input/rmi4/rmi_bus.c +++ b/drivers/input/rmi4/rmi_bus.c @@ -276,11 +276,11 @@ void rmi_unregister_function(struct rmi_function *fn) device_del(&fn->dev); of_node_put(fn->dev.of_node); - put_device(&fn->dev); for (i = 0; i < fn->num_of_irqs; i++) irq_dispose_mapping(fn->irq[i]); + put_device(&fn->dev); } /** -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] backport upstream stmmac related patches.
by Hongchen Zhang 23 May '24

23 May '24

backport upstream stmmac related patches. Russell King (Oracle) (1): net: phylink: provide mac_get_caps() method Serge Semin (2): net: stmmac: Rename phylink_get_caps() callback to update_caps() net: stmmac: Move MAC caps init to phylink MAC caps getter Documentation/networking/sfp-phylink.rst | 7 ++++ .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 8 ++--- drivers/net/ethernet/stmicro/stmmac/hwif.h | 8 ++--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 36 +++++++++---------- drivers/net/phy/phylink.c | 14 ++++++-- include/linux/phylink.h | 15 ++++++++ 6 files changed, 58 insertions(+), 30 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6] Revert "ACPI: Rename ACPI_HOTPLUG_CPU to include 'present'"
by liwei 23 May '24

23 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8XMTL CVE: NA ------------------------------------------------------------------ This reverts commit 2eb3daf61b18d620b0624e31ad44ac1c76d94075. Signed-off-by: liwei <liwei728(a)huawei.com> Conflicts: arch/x86/Kconfig drivers/acpi/acpi_processor.c include/linux/acpi.h --- arch/loongarch/Kconfig | 2 +- arch/loongarch/kernel/acpi.c | 4 ++-- arch/x86/Kconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- arch/x86/kernel/acpi/boot.c | 4 ++-- drivers/acpi/Kconfig | 6 +++--- drivers/acpi/acpi_processor.c | 4 ++-- drivers/acpi/bus.c | 2 +- include/linux/acpi.h | 2 +- 9 files changed, 14 insertions(+), 14 deletions(-) diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig index edbbf03d29d9..58da6e03ecb5 100644 --- a/arch/loongarch/Kconfig +++ b/arch/loongarch/Kconfig @@ -5,7 +5,7 @@ config LOONGARCH select ACPI select ACPI_GENERIC_GSI if ACPI select ACPI_MCFG if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_PPTT if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI select ARCH_BINFMT_ELF_STATE diff --git a/arch/loongarch/kernel/acpi.c b/arch/loongarch/kernel/acpi.c index f453271e6add..58819b017ba8 100644 --- a/arch/loongarch/kernel/acpi.c +++ b/arch/loongarch/kernel/acpi.c @@ -291,7 +291,7 @@ void __init arch_reserve_mem_area(acpi_physical_address addr, size_t size) memblock_reserve(addr, size); } -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> @@ -343,4 +343,4 @@ int acpi_unmap_cpu(int cpu) } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 6cfa82a633a6..0ac76a2637f8 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -60,7 +60,7 @@ config X86 # select ACPI_LEGACY_TABLES_LOOKUP if ACPI select ACPI_SYSTEM_POWER_STATES_SUPPORT if ACPI - select ACPI_HOTPLUG_PRESENT_CPU if ACPI_PROCESSOR && HOTPLUG_CPU + select ACPI_HOTPLUG_CPU if ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_HOTPLUG_IGNORE_OSC if ACPI && HOTPLUG_CPU select ARCH_32BIT_OFF_T if X86_32 select ARCH_CLOCKSOURCE_INIT diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 80a66a8692dc..1c1fb626ae9e 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -609,7 +609,7 @@ CONFIG_ACPI_PROCESSOR_IDLE=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_IPMI=m -CONFIG_ACPI_HOTPLUG_PRESENT_CPU=y +CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_HOTPLUG_IGNORE_OSC=y CONFIG_ACPI_PROCESSOR_AGGREGATOR=m CONFIG_ACPI_THERMAL=y diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c index 8202bd2d957d..c55c0ef47a18 100644 --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -817,7 +817,7 @@ static void __init acpi_set_irq_model_ioapic(void) /* * ACPI based hotplug support for CPU */ -#ifdef CONFIG_ACPI_HOTPLUG_PRESENT_CPU +#ifdef CONFIG_ACPI_HOTPLUG_CPU #include <acpi/processor.h> static int acpi_map_cpu2node(acpi_handle handle, int cpu, int physid) @@ -866,7 +866,7 @@ int acpi_unmap_cpu(int cpu) return (0); } EXPORT_SYMBOL(acpi_unmap_cpu); -#endif /* CONFIG_ACPI_HOTPLUG_PRESENT_CPU */ +#endif /* CONFIG_ACPI_HOTPLUG_CPU */ int acpi_register_ioapic(acpi_handle handle, u64 phys_addr, u32 gsi_base) { diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig index c49978b4b11f..c4746869d67b 100644 --- a/drivers/acpi/Kconfig +++ b/drivers/acpi/Kconfig @@ -305,14 +305,14 @@ config ACPI_IPMI To compile this driver as a module, choose M here: the module will be called as acpi_ipmi. -config ACPI_HOTPLUG_PRESENT_CPU +config ACPI_HOTPLUG_CPU bool depends on ACPI_PROCESSOR && HOTPLUG_CPU select ACPI_CONTAINER config ACPI_HOTPLUG_IGNORE_OSC bool - depends on ACPI_HOTPLUG_PRESENT_CPU + depends on ACPI_HOTPLUG_CPU help Ignore whether firmware acknowledged support for toggling the CPU present bit in _STA. Some architectures predate the _OSC bits, so @@ -408,7 +408,7 @@ config ACPI_PCI_SLOT config ACPI_CONTAINER bool "Container and Module Devices" - default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_PRESENT_CPU) + default (ACPI_HOTPLUG_MEMORY || ACPI_HOTPLUG_CPU) help This driver supports ACPI Container and Module devices (IDs ACPI0004, PNP0A05, and PNP0A06). diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c index 5bb207a7a1dd..0ff69af46a50 100644 --- a/drivers/acpi/acpi_processor.c +++ b/drivers/acpi/acpi_processor.c @@ -184,7 +184,7 @@ static void __init acpi_pcc_cpufreq_init(void) {} static bool acpi_processor_hotplug_present_supported(void) { - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) return false; /* x86 systems pre-date the _OSC bit */ @@ -502,7 +502,7 @@ static void acpi_processor_make_not_present(struct acpi_device *device) { struct acpi_processor *pr; - if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) { + if (!IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) { pr_err_once("Changing CPU present bit is not supported"); return; } diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c index b42f17bfbb09..0d2e1de143ef 100644 --- a/drivers/acpi/bus.c +++ b/drivers/acpi/bus.c @@ -355,7 +355,7 @@ static void acpi_bus_osc_negotiate_platform_control(void) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_APEI_SUPPORT; capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_ENABLED_SUPPORT; - if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_PRESENT_CPU)) + if (IS_ENABLED(CONFIG_ACPI_HOTPLUG_CPU)) capbuf[OSC_SUPPORT_DWORD] |= OSC_SB_HOTPLUG_PRESENT_SUPPORT; if (ACPI_FAILURE(acpi_get_handle(NULL, "\\_SB", &handle))) diff --git a/include/linux/acpi.h b/include/linux/acpi.h index a0e96f6e2de2..cc84f370620f 100644 --- a/include/linux/acpi.h +++ b/include/linux/acpi.h @@ -651,7 +651,7 @@ static inline u32 acpi_osc_ctx_get_cxl_control(struct acpi_osc_context *context) #define ACPI_GSB_ACCESS_ATTRIB_RAW_PROCESS 0x0000000F /* Enable _OST when all relevant hotplug operations are enabled */ -#if defined(CONFIG_ACPI_HOTPLUG_PRESENT_CPU) && \ +#if defined(CONFIG_ACPI_HOTPLUG_CPU) && \ defined(CONFIG_ACPI_HOTPLUG_MEMORY) && \ defined(CONFIG_ACPI_CONTAINER) #define ACPI_HOTPLUG_OST -- 2.25.1

2 1

[PATCH OLK-6.6 00/15] LoongArch: add GMAC & GNET support
by Hongchen Zhang 23 May '24

23 May '24

Yanteng Si (15): net: stmmac: Move the atds flag to the stmmac_dma_cfg structure net: stmmac: Add multi-channel support net: stmmac: Export dwmac1000_dma_ops net: stmmac: dwmac-loongson: Drop useless platform data net: stmmac: dwmac-loongson: Use PCI_DEVICE_DATA() macro for device identification net: stmmac: dwmac-loongson: Split up the platform data initialization net: stmmac: dwmac-loongson: Add ref and ptp clocks for Loongson net: stmmac: dwmac-loongson: Add phy mask for Loongson GMAC net: stmmac: dwmac-loongson: Add phy_interface for Loongson GMAC net: stmmac: dwmac-loongson: Add full PCI support net: stmmac: dwmac-loongson: Add loongson_dwmac_config_legacy net: stmmac: dwmac-loongson: Fixed failure to set network speed to 1000. net: stmmac: dwmac-loongson: Add Loongson GNET support net: stmmac: dwmac-loongson: Move disable_force flag to _gnet_date net: stmmac: dwmac-loongson: Add loongson module author drivers/net/ethernet/stmicro/stmmac/common.h | 1 + .../ethernet/stmicro/stmmac/dwmac-loongson.c | 519 ++++++++++++++++-- .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 4 +- .../ethernet/stmicro/stmmac/dwmac1000_dma.c | 35 +- .../ethernet/stmicro/stmmac/dwmac100_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac4_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac_dma.h | 20 +- .../net/ethernet/stmicro/stmmac/dwmac_lib.c | 30 +- .../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 2 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 5 +- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 6 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 11 +- include/linux/stmmac.h | 2 + 13 files changed, 536 insertions(+), 103 deletions(-) -- 2.33.0

2 16

[PATCH OLK-6.6 0/3] backport upstream stmmac related patches.
by Hongchen Zhang 23 May '24

23 May '24

backport upstream stmmac related patches. b487717141e8 2024-05-23 net: stmmac: Move MAC caps init to phylink MAC caps getter e345daff0645 2024-05-23 net: stmmac: Rename phylink_get_caps() callback to update_caps() 563ca13a7bf6 2024-05-23 net: phylink: provide mac_get_caps() method Russell King (Oracle) (1): net: phylink: provide mac_get_caps() method Serge Semin (2): net: stmmac: Rename phylink_get_caps() callback to update_caps() net: stmmac: Move MAC caps init to phylink MAC caps getter Documentation/networking/sfp-phylink.rst | 7 ++++ .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 8 ++--- drivers/net/ethernet/stmicro/stmmac/hwif.h | 8 ++--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 36 +++++++++---------- drivers/net/phy/phylink.c | 14 ++++++-- include/linux/phylink.h | 15 ++++++++ 6 files changed, 58 insertions(+), 30 deletions(-) -- 2.33.0

2 4

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-52868
by Chen Ridong 23 May '24

23 May '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/18] LoongArch: add GMAC & GNET support
by Hongchen Zhang 23 May '24

23 May '24

Russell King (Oracle) (1): net: phylink: provide mac_get_caps() method Serge Semin (2): net: stmmac: Rename phylink_get_caps() callback to update_caps() net: stmmac: Move MAC caps init to phylink MAC caps getter Yanteng Si (15): net: stmmac: Move the atds flag to the stmmac_dma_cfg structure net: stmmac: Add multi-channel support net: stmmac: Export dwmac1000_dma_ops net: stmmac: dwmac-loongson: Drop useless platform data net: stmmac: dwmac-loongson: Use PCI_DEVICE_DATA() macro for device identification net: stmmac: dwmac-loongson: Split up the platform data initialization net: stmmac: dwmac-loongson: Add ref and ptp clocks for Loongson net: stmmac: dwmac-loongson: Add phy mask for Loongson GMAC net: stmmac: dwmac-loongson: Add phy_interface for Loongson GMAC net: stmmac: dwmac-loongson: Add full PCI support net: stmmac: dwmac-loongson: Add loongson_dwmac_config_legacy net: stmmac: dwmac-loongson: Fixed failure to set network speed to 1000. net: stmmac: dwmac-loongson: Add Loongson GNET support net: stmmac: dwmac-loongson: Move disable_force flag to _gnet_date net: stmmac: dwmac-loongson: Add loongson module author Documentation/networking/sfp-phylink.rst | 7 + drivers/net/ethernet/stmicro/stmmac/common.h | 1 + .../ethernet/stmicro/stmmac/dwmac-loongson.c | 519 ++++++++++++++++-- .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 4 +- .../ethernet/stmicro/stmmac/dwmac1000_dma.c | 35 +- .../ethernet/stmicro/stmmac/dwmac100_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 8 +- .../net/ethernet/stmicro/stmmac/dwmac4_dma.c | 2 +- .../net/ethernet/stmicro/stmmac/dwmac_dma.h | 20 +- .../net/ethernet/stmicro/stmmac/dwmac_lib.c | 30 +- .../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 2 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 13 +- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 6 + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 47 +- drivers/net/phy/phylink.c | 14 +- include/linux/phylink.h | 15 + include/linux/stmmac.h | 2 + 17 files changed, 594 insertions(+), 133 deletions(-) -- 2.33.0

1 15

[PATCH OLK-5.10 0/2] CVE-2024-35999
by Yifan Qiao 23 May '24

23 May '24

Shyam Prasad N (1): cifs: protect session channel fields with chan_lock Steve French (1): smb3: missing lock when picking channel fs/cifs/cifsglob.h | 5 +++++ fs/cifs/cifs_debug.c | 2 ++ fs/cifs/connect.c | 25 +++++++++++++++++++--- fs/cifs/misc.c | 1 + fs/cifs/sess.c | 50 +++++++++++++++++++++++++++++++++----------- fs/cifs/transport.c | 10 +++++++-- 6 files changed, 76 insertions(+), 17 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] vt: fix unicode buffer corruption when deleting characters
by Xiang Yang 23 May '24

23 May '24

From: Nicolas Pitre <nico(a)fluxnic.net> stable inclusion from stable-v5.10.215 commit 1ce408f75ccf1e25b3fddef75cca878b55f2ac90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994 CVE: CVE-2024-35823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers. Signed-off-by: Nicolas Pitre <nico(a)fluxnic.net> Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 0252c0562dbc..33fb7b6555f4 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -398,7 +398,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) char32_t *ln = uniscr->lines[vc->state.y]; unsigned int x = vc->state.x, cols = vc->vc_cols; - memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); memset32(&ln[cols - nr], ' ', nr); } } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Load balance fixes
by Zhang Qiao 23 May '24

23 May '24

Zhang Qiao (2): sched/numa: Fix numa imbalance in load_balance() config: Disable COBFIG_ARCH_CUSTOM_NUMA_DISTANCE for arm64 arch/arm64/configs/openeuler_defconfig | 2 +- kernel/sched/fair.c | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) -- 2.18.0.huawei.25

1 2

[PATCH OLK-6.6 v3] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment anouymous mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- Documentation/admin-guide/mm/transhuge.rst | 15 +++++++++------ include/linux/huge_mm.h | 7 +++++++ mm/huge_memory.c | 13 +++++++++++-- mm/mmap.c | 2 +- 4 files changed, 28 insertions(+), 9 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..e66d1d7ee711 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: +The kernel could try to enable mappings for different sizes, eg, 64K on +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K anonymous mapping for arm64 +is dependent on BIT3 being turned on, the above feature are disabled by +default, and could enable the above feature by writing the corresponding +bit to 1:: echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..58ce4efb2019 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); @@ -443,6 +448,8 @@ static inline void folio_prep_large_rmappable(struct folio *folio) {} #define transparent_hugepage_flags 0UL +#define thp_anon_mapping_pmd_align() NULL + #define thp_get_unmapped_area NULL static inline bool diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..63438200f3da 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,9 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +535,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +550,16 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (!(val & ANON_MAPPING_PMD_ALIGN) && + (val & ANON_MAPPING_ALIGN))) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

2 1

[PATCH OLK-6.6 v3] mm: add thp anon pmd size mapping align control
by Ze Zuo 23 May '24

23 May '24

From: Kefeng Wang <wangkefeng.wang(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9R7N8 CVE: NA ------------------------------------------------- After committing df0ad0579ac9 ('mm: align larger anonymous mappings on THP boundaries'), we found a number of issues, eg, a significant increase in memory access latency on arm64, which was addressed by commit bb713c2a4a43 (arm64: mmap: disable align larger anonymous mappings on THP boundaries), but subsequently found on x86 that the patch also resulted in a significant degradation of the SPECCPU test. Commit 449846913eb6('mm: huge_memory: add thp mapping align control') has implemented the sysfs interface control of 64 KB aligned mapping in arm64, based on this for thp_align_mapping to add a new bit to control pmd size page alignment, where the 64K alignment anouymous mapping enable for arm64 will depend on the new bits being turned on. it is disabled by default, and could be enabled by /sys/kernel/mm/transparent_hugepage/thp_mapping_align. Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> Changes since v2: - Modify enable logic and related documentation. Changes since v1: - Fix build error without CONFIG_TRANSPARENT_HUGEPAGE. - delete some unsed define. --- Documentation/admin-guide/mm/transhuge.rst | 15 +++++++++------ include/linux/huge_mm.h | 7 +++++++ mm/huge_memory.c | 13 +++++++++++-- mm/mmap.c | 2 +- 4 files changed, 28 insertions(+), 9 deletions(-) diff --git a/Documentation/admin-guide/mm/transhuge.rst b/Documentation/admin-guide/mm/transhuge.rst index 54046f487f15..e66d1d7ee711 100644 --- a/Documentation/admin-guide/mm/transhuge.rst +++ b/Documentation/admin-guide/mm/transhuge.rst @@ -211,14 +211,17 @@ possible to enable/disable it by configurate the corresponding bit:: echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_exec_enabled -The kernel could try to enable other larger size mappings align other -than THP size, eg, 64K on arm64, BIT0 for file mapping, BIT1 for anon -mapping, it is disabled by default, and could enable this feature by -writing the corresponding bit to 1:: +The kernel could try to enable mappings for different sizes, eg, 64K on +arm64, BIT0 for file mapping, BIT1 for anonymous mapping, and THP size +page, BIT3 for anonymous mapping, where 64K anonymous mapping for arm64 +is dependent on BIT3 being turned on, the above feature are disabled by +default, and could enable the above feature by writing the corresponding +bit to 1:: echo 0x1 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x2 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align - echo 0x3 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x4 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + echo 0x6 >/sys/kernel/mm/transparent_hugepage/thp_mapping_align + The kernel could enable high-orders(greated than PAGE_ALLOC_COSTLY_ORDER, only support order 4 for now) be stored on PCP lists(except PMD order), which could diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h index 3e5f7064e2de..58ce4efb2019 100644 --- a/include/linux/huge_mm.h +++ b/include/linux/huge_mm.h @@ -54,6 +54,7 @@ enum transparent_hugepage_flag { TRANSPARENT_HUGEPAGE_FILE_EXEC_MTHP_FLAG, TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, + TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, }; struct kobject; @@ -288,6 +289,10 @@ static inline void count_mthp_stat(int order, enum mthp_stat_item item) (transparent_hugepage_flags & \ (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG)) +#define thp_anon_mapping_pmd_align() \ + (transparent_hugepage_flags & \ + (1<<TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG)) + unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags); @@ -443,6 +448,8 @@ static inline void folio_prep_large_rmappable(struct folio *folio) {} #define transparent_hugepage_flags 0UL +#define thp_anon_mapping_pmd_align() NULL + #define thp_get_unmapped_area NULL static inline bool diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 763bb25e4f99..63438200f3da 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -518,7 +518,9 @@ static struct kobj_attribute thp_exec_enabled_attr = #define FILE_MAPPING_ALIGN BIT(0) #define ANON_MAPPING_ALIGN BIT(1) -#define THP_MAPPING_ALIGN_ALL (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN) +#define ANON_MAPPING_PMD_ALIGN BIT(2) +#define THP_MAPPING_ALIGN_ALL \ + (FILE_MAPPING_ALIGN | ANON_MAPPING_ALIGN | ANON_MAPPING_PMD_ALIGN) static ssize_t thp_mapping_align_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) @@ -533,6 +535,10 @@ static ssize_t thp_mapping_align_show(struct kobject *kobj, &transparent_hugepage_flags)) val |= ANON_MAPPING_ALIGN; + if (test_bit(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + &transparent_hugepage_flags)) + val |= ANON_MAPPING_PMD_ALIGN; + return sysfs_emit(buf, "0x%lx\n", val); } static ssize_t thp_mapping_align_store(struct kobject *kobj, @@ -544,13 +550,16 @@ static ssize_t thp_mapping_align_store(struct kobject *kobj, ret = kstrtoul(buf, 16, &val); if (ret < 0) return ret; - if (val & ~THP_MAPPING_ALIGN_ALL) + if ((val & ~THP_MAPPING_ALIGN_ALL) || (!(val & ANON_MAPPING_PMD_ALIGN) && + (val & ANON_MAPPING_ALIGN))) return -EINVAL; thp_flag_set(TRANSPARENT_HUGEPAGE_FILE_MAPPING_ALIGN_FLAG, val & FILE_MAPPING_ALIGN); thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_ALIGN_FLAG, val & ANON_MAPPING_ALIGN); + thp_flag_set(TRANSPARENT_HUGEPAGE_ANON_MAPPING_PMD_ALIGN_FLAG, + val & ANON_MAPPING_PMD_ALIGN); return count; } diff --git a/mm/mmap.c b/mm/mmap.c index 1c256f38128e..1d8def3db125 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1857,7 +1857,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, */ get_area = shmem_get_unmapped_area; } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && - !IS_ENABLED(CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT)) { + thp_anon_mapping_pmd_align()) { /* Ensures that larger anonymous mappings are THP aligned. */ get_area = thp_get_unmapped_area; } -- 2.33.0

2 1

[PATCH OLK-5.10] [Backport] drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag
by Wang Hai 23 May '24

23 May '24

From: Philip Yang <Philip.Yang(a)amd.com> stable inclusion from stable-v5.15.154 commit 5d5f1a7f3b1039925f79c7894f153c2a905201fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q94F CVE: CVE-2024-35817 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6c6064cbe58b43533e3451ad6a8ba9736c109ac3 ] Otherwise after the GTT bo is released, the GTT and gart space is freed but amdgpu_ttm_backend_unbind will not clear the gart page table entry and leave valid mapping entry pointing to the stale system page. Then if GPU access the gart address mistakely, it will read undefined value instead page fault, harder to debug and reproduce the real issue. Cc: stable(a)vger.kernel.org Signed-off-by: Philip Yang <Philip.Yang(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c [commit 942ab769c51d wasn't merged, which lead to context conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c index 0b162928a248..7d4a54025e18 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c @@ -1092,6 +1092,7 @@ static int amdgpu_ttm_gart_bind(struct amdgpu_device *adev, r = amdgpu_gart_bind(adev, gtt->offset, ttm->num_pages, ttm->pages, gtt->ttm.dma_address, flags); } + gtt->bound = true; gart_bind_fail: if (r) -- 2.17.1

2 1

[PATCH OLK-5.10] Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
by Liu Chuang 23 May '24

23 May '24

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.201 commit 6c71e065befb2fae8f1461559b940c04e1071bd5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9RFE5 CVE: CVE-2023-52840 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit eb988e46da2e4eae89f5337e047ce372fe33d5b1 ] The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Fixes: 24d28e4f1271 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mount… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/input/rmi4/rmi_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/input/rmi4/rmi_bus.c b/drivers/input/rmi4/rmi_bus.c index 47d1b97ed6cf..a1b2c86ef611 100644 --- a/drivers/input/rmi4/rmi_bus.c +++ b/drivers/input/rmi4/rmi_bus.c @@ -276,11 +276,11 @@ void rmi_unregister_function(struct rmi_function *fn) device_del(&fn->dev); of_node_put(fn->dev.of_node); - put_device(&fn->dev); for (i = 0; i < fn->num_of_irqs; i++) irq_dispose_mapping(fn->irq[i]); + put_device(&fn->dev); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] vt: fix unicode buffer corruption when deleting characters
by Xiang Yang 23 May '24

23 May '24

From: Nicolas Pitre <nico(a)fluxnic.net> stable inclusion from stable-v4.19.312 commit fc7dfe3d123f00e720be80b920da287810a1f37d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q994 CVE: CVE-2024-35823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… commit 1581dafaf0d34bc9c428a794a22110d7046d186d upstream. This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers. Signed-off-by: Nicolas Pitre <nico(a)fluxnic.net> Fixes: 81732c3b2fed ("tty vt: Fix line garbage in virtual console on command line edition") Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/sn184on2-3p0q-0qrq-0218-895349s4753o@syhkavp.arg Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 163186cbfe79..12ddd82f0dad 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -405,7 +405,7 @@ static void vc_uniscr_delete(struct vc_data *vc, unsigned int nr) char32_t *ln = uniscr->lines[vc->vc_y]; unsigned int x = vc->vc_x, cols = vc->vc_cols; - memcpy(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); + memmove(&ln[x], &ln[x + nr], (cols - x - nr) * sizeof(*ln)); memset32(&ln[cols - nr], ' ', nr); } } -- 2.34.1

2 1

[PATCH OLK-5.10 v3 0/4] arm64: Allow CPU0 to be nohz_full
by Xiongfeng Wang 23 May '24

23 May '24

Changelog: v1->v2: change __setup() to early_param() v2->v3: fix kabi because #include <linux/sched/isolation.h> modify defconfig Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether all the housekeeping CPUs are online arm64: Kconfig: select ARCH_SUSPEND_NONZERO_CPU by default arm64: defconfig: Enable CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 ++ include/linux/cpu.h | 5 +++- include/linux/sched/isolation.h | 5 ++++ kernel/sched/isolation.c | 39 +++++++++++++++++++++++--- kernel/smp.c | 4 +++ kernel/time/tick-sched.c | 5 +++- 7 files changed, 57 insertions(+), 6 deletions(-) -- 2.30.0

2 5

[PATCH OLK-5.10 v4] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.10.217 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 v3] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.10.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2024-35999
by Yifan Qiao 23 May '24

23 May '24

Shyam Prasad N (1): cifs: protect session channel fields with chan_lock Steve French (1): smb3: missing lock when picking channel fs/cifs/cifsglob.h | 5 +++++ fs/cifs/cifs_debug.c | 2 ++ fs/cifs/connect.c | 25 +++++++++++++++++++--- fs/cifs/misc.c | 1 + fs/cifs/sess.c | 50 +++++++++++++++++++++++++++++++++----------- fs/cifs/transport.c | 10 +++++++-- 6 files changed, 76 insertions(+), 17 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
by Zhao Mengmeng 23 May '24

23 May '24

From: Jiri Benc <jbenc(a)redhat.com> stable inclusion from stable-v5.10.216 commit 3fb02ec57ead2891a2306af8c51a306bc5945e70 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QRPL CVE: CVE-2024-35969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7633c4da919ad51164acbf1aa322cc1a3ead6129 ] Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007ffcf54012a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 41.528593] RAX: ffffffffffffffda RBX: 00007ffcf5401368 RCX: 00007fbc4cfcea9a [ 41.529173] RDX: 000000000000002c RSI: 00007fbc4b9d9bd0 RDI: 0000000000000005 [ 41.529786] RBP: 00007fbc4bafb040 R08: 00007ffcf54013e0 R09: 000000000000000c [ 41.530375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 41.530977] R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007fbc4ca85d1b [ 41.531573] </TASK> Fixes: 5c578aedcb21d ("IPv6: convert addrconf hash list to RCU") Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Signed-off-by: Jiri Benc <jbenc(a)redhat.com> Link: https://lore.kernel.org/r/8ab821e36073a4a406c50ec83c9e8dc586c539e4.17125858… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- include/net/addrconf.h | 4 ++++ net/ipv6/addrconf.c | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index edba74a53683..a24c65e9a994 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -429,6 +429,10 @@ static inline void in6_ifa_hold(struct inet6_ifaddr *ifp) refcount_inc(&ifp->refcnt); } +static inline bool in6_ifa_hold_safe(struct inet6_ifaddr *ifp) +{ + return refcount_inc_not_zero(&ifp->refcnt); +} /* * compute link-local solicited-node multicast address diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 5e42149b954f..821aa81dec47 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2033,9 +2033,10 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add if (ipv6_addr_equal(&ifp->addr, addr)) { if (!dev || ifp->idev->dev == dev || !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) { - result = ifp; - in6_ifa_hold(ifp); - break; + if (in6_ifa_hold_safe(ifp)) { + result = ifp; + break; + } } } } -- 2.33.0

2 1

[PATCH OLK-6.6] Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> mainline inclusion from mainline-v6.9 commit 4d7b41c0e43995b0e992b9f8903109275744b658 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMPS CVE: CVE-2024-36013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect ┌ mutex_lock(&conn->chan_lock); │ chan = pchan->ops->new_connection(pchan); <- alloc chan │ __l2cap_chan_add(conn, chan); │ l2cap_chan_hold(chan); │ list_add(&chan->list, &conn->chan_l); ... (1) └ mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del ┌ mutex_lock(&conn->chan_lock); │ foreach chan in conn->chan_l: ... (2) │ l2cap_chan_put(chan); │ l2cap_chan_destroy │ kfree(chan) ... (3) <- chan freed └ mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311 Fixes: 73ffa904b782 ("Bluetooth: Move conf_{req,rsp} stuff to struct l2cap_chan") Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/l2cap_core.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 706d2478ddb3..edf83e886b82 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3902,13 +3902,12 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, return 0; } -static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, - struct l2cap_cmd_hdr *cmd, - u8 *data, u8 rsp_code, u8 amp_id) +static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, + u8 *data, u8 rsp_code, u8 amp_id) { struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; struct l2cap_conn_rsp rsp; - struct l2cap_chan *chan = NULL, *pchan; + struct l2cap_chan *chan = NULL, *pchan = NULL; int result, status = L2CAP_CS_NO_INFO; u16 dcid = 0, scid = __le16_to_cpu(req->scid); @@ -3921,7 +3920,7 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, &conn->hcon->dst, ACL_LINK); if (!pchan) { result = L2CAP_CR_BAD_PSM; - goto sendresp; + goto response; } mutex_lock(&conn->chan_lock); @@ -4008,17 +4007,15 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, } response: - l2cap_chan_unlock(pchan); - mutex_unlock(&conn->chan_lock); - l2cap_chan_put(pchan); - -sendresp: rsp.scid = cpu_to_le16(scid); rsp.dcid = cpu_to_le16(dcid); rsp.result = cpu_to_le16(result); rsp.status = cpu_to_le16(status); l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); + if (!pchan) + return; + if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { struct l2cap_info_req info; info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); @@ -4041,7 +4038,9 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, chan->num_conf_req++; } - return chan; + l2cap_chan_unlock(pchan); + mutex_unlock(&conn->chan_lock); + l2cap_chan_put(pchan); } static int l2cap_connect_req(struct l2cap_conn *conn, -- 2.33.0

2 1

[PATCH OLK-5.10 v2] eeprom: at24: fix memory corruption race condition
by Wenyu Huang 23 May '24

23 May '24

From: Daniel Okazaki <dtokazaki(a)google.com> stable inclusion from stable-v5.15.159 commit c850f71fca09ea41800ed55905980063d17e01da category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9F4 CVE: CVE-2024-35848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit f42c97027fb75776e2e9358d16bf4a99aeb04cf2 ] If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Signed-off-by: Daniel Okazaki <dtokazaki(a)google.com> Fixes: b20eb4c1f026 ("eeprom: at24: drop unnecessary label") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240422174337.2487142-1-dtokazaki@google.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/misc/eeprom/at24.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c index 305ffad131a2..c43072b2e9b6 100644 --- a/drivers/misc/eeprom/at24.c +++ b/drivers/misc/eeprom/at24.c @@ -757,14 +757,6 @@ static int at24_probe(struct i2c_client *client) pm_runtime_set_active(dev); pm_runtime_enable(dev); - at24->nvmem = devm_nvmem_register(dev, &nvmem_config); - if (IS_ERR(at24->nvmem)) { - pm_runtime_disable(dev); - if (!pm_runtime_status_suspended(dev)) - regulator_disable(at24->vcc_reg); - return PTR_ERR(at24->nvmem); - } - /* * Perform a one-byte test read to verify that the * chip is functional. @@ -777,6 +769,14 @@ static int at24_probe(struct i2c_client *client) return -ENODEV; } + at24->nvmem = devm_nvmem_register(dev, &nvmem_config); + if (IS_ERR(at24->nvmem)) { + pm_runtime_disable(dev); + if (!pm_runtime_status_suspended(dev)) + regulator_disable(at24->vcc_reg); + return PTR_ERR(at24->nvmem); + } + pm_runtime_idle(dev); if (writable) -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] CVE-2024-35995
by liwei 23 May '24

23 May '24

CVE-2024-35995 Jarred White (2): ACPI: CPPC: Use access_width over bit_width for system memory accesses ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro Rafael J. Wysocki (1): ACPI: CPPC: Fix up I/O port access in cpc_read() Steven Noonan (1): ACPI: CPPC: Implement support for SystemIO registers Vanshidhar Konda (1): ACPI: CPPC: Fix access width used for PCC registers drivers/acpi/cppc_acpi.c | 174 +++++++++++++++++++++++++++++---------- 1 file changed, 132 insertions(+), 42 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6] Bluetooth: HCI: Fix potential null-ptr-deref
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> stable inclusion from stable-v6.6.31 commit 1f7ebb69c1d65732bcac2fda9d15421f76f01e81 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMQS CVE: CVE-2024-36011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d2706004a1b8b526592e823d7e52551b518a7941 ] Fix potential null-ptr-deref in hci_le_big_sync_established_evt(). Fixes: f777d8827817 (Bluetooth: ISO: Notify user space about failed bis connections) Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/hci_event.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 1b4abf8e90f6..9274d3255049 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -7200,6 +7200,8 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, u16 handle = le16_to_cpu(ev->bis[i]); bis = hci_conn_hash_lookup_handle(hdev, handle); + if (!bis) + continue; set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags); hci_connect_cfm(bis, ev->status); -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/5] CVE-2024-35995
by liwei 23 May '24

23 May '24

CVE-2024-35995 Jarred White (2): ACPI: CPPC: Use access_width over bit_width for system memory accesses ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro Rafael J. Wysocki (1): ACPI: CPPC: Fix up I/O port access in cpc_read() Steven Noonan (1): ACPI: CPPC: Implement support for SystemIO registers Vanshidhar Konda (1): ACPI: CPPC: Fix access width used for PCC registers drivers/acpi/cppc_acpi.c | 174 +++++++++++++++++++++++++++++---------- 1 file changed, 132 insertions(+), 42 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-1.0-LTS] media: bttv: fix use after free error due to btv->timeout timer
by Ye Bin 23 May '24

23 May '24

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.7-rc1 commit bd5b50b329e850d467e7bcc07b2b6bde3752fbda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFON CVE: CVE-2023-52847 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug. This bug is found by static analysis, it may be false positive. Fix it by adding del_timer_sync invoking to the remove function. cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv Fixes: 162e6376ac58 ("media: pci: Convert timers to use timer_setup()") Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/media/pci/bt8xx/bttv-driver.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c index cf05e11da01b..00400f58d9c4 100644 --- a/drivers/media/pci/bt8xx/bttv-driver.c +++ b/drivers/media/pci/bt8xx/bttv-driver.c @@ -4293,6 +4293,7 @@ static void bttv_remove(struct pci_dev *pci_dev) /* free resources */ free_irq(btv->c.pci->irq,btv); + del_timer_sync(&btv->timeout); iounmap(btv->bt848_mmio); release_mem_region(pci_resource_start(btv->c.pci,0), pci_resource_len(btv->c.pci,0)); -- 2.31.1

2 1

[PATCH OLK-6.6] Bluetooth: msft: fix slab-use-after-free in msft_do_close()
by Zhao Mengmeng 23 May '24

23 May '24

From: Sungwoo Kim <iam(a)sung-woo.kim> stable inclusion from stable-v6.6.31 commit a85a60e62355e3bf4802dead7938966824b23940 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RMR9 CVE: CVE-2024-36012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 10f9f426ac6e752c8d87bf4346930ba347aaabac ] Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed. [free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309 Fixes: bf6a4e30ffbd ("Bluetooth: disable advertisement filters during suspend") Signed-off-by: Sungwoo Kim <iam(a)sung-woo.kim> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Mengmeng <zhaomengmeng(a)kylinos.cn> --- net/bluetooth/hci_core.c | 3 +-- net/bluetooth/msft.c | 2 +- net/bluetooth/msft.h | 4 ++-- 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 0592369579ab..befe645d3f9b 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -2736,8 +2736,6 @@ void hci_unregister_dev(struct hci_dev *hdev) hci_unregister_suspend_notifier(hdev); - msft_unregister(hdev); - hci_dev_do_close(hdev); if (!test_bit(HCI_INIT, &hdev->flags) && @@ -2791,6 +2789,7 @@ void hci_release_dev(struct hci_dev *hdev) hci_discovery_filter_clear(hdev); hci_blocked_keys_clear(hdev); hci_codec_list_clear(&hdev->local_codecs); + msft_release(hdev); hci_dev_unlock(hdev); ida_destroy(&hdev->unset_handle_ida); diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c index 9612c5d1b13f..d039683d3bdd 100644 --- a/net/bluetooth/msft.c +++ b/net/bluetooth/msft.c @@ -769,7 +769,7 @@ void msft_register(struct hci_dev *hdev) mutex_init(&msft->filter_lock); } -void msft_unregister(struct hci_dev *hdev) +void msft_release(struct hci_dev *hdev) { struct msft_data *msft = hdev->msft_data; diff --git a/net/bluetooth/msft.h b/net/bluetooth/msft.h index 2a63205b377b..fe538e9c91c0 100644 --- a/net/bluetooth/msft.h +++ b/net/bluetooth/msft.h @@ -14,7 +14,7 @@ bool msft_monitor_supported(struct hci_dev *hdev); void msft_register(struct hci_dev *hdev); -void msft_unregister(struct hci_dev *hdev); +void msft_release(struct hci_dev *hdev); void msft_do_open(struct hci_dev *hdev); void msft_do_close(struct hci_dev *hdev); void msft_vendor_evt(struct hci_dev *hdev, void *data, struct sk_buff *skb); @@ -35,7 +35,7 @@ static inline bool msft_monitor_supported(struct hci_dev *hdev) } static inline void msft_register(struct hci_dev *hdev) {} -static inline void msft_unregister(struct hci_dev *hdev) {} +static inline void msft_release(struct hci_dev *hdev) {} static inline void msft_do_open(struct hci_dev *hdev) {} static inline void msft_do_close(struct hci_dev *hdev) {} static inline void msft_vendor_evt(struct hci_dev *hdev, void *data, -- 2.33.0

2 1

[PATCH OLK-5.10] drm/i915/gt: Reset queue_priority_hint on parking
by Wenyu Huang 23 May '24

23 May '24

From: Chris Wilson <chris(a)chris-wilson.co.uk> stable inclusion from stable-v5.10.216 commit fe34587acc995e7b1d7a5d3444a0736721ec32b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5FX CVE: CVE-2024-26937 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4a3859ea5240365d21f6053ee219bb240d520895 upstream. Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of an active request that may complete before the preemption is processed by HW. If that happens, the request is retired from the queue, but the queue_priority_hint remains set, preventing direct submission until after the next CS interrupt is processed. This preempt-to-busy race can be triggered by the heartbeat, which will also act as the power-management barrier and upon completion allow us to idle the HW. We may process the completion of the heartbeat, and begin parking the engine before the CS event that restores the queue_priority_hint, causing us to fail the assertion that it is MIN. <3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 166.210781] Dumping ftrace buffer: <0>[ 166.210795] --------------------------------- ... <0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 } <0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646 <0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0 <0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659 <0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40 <0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 } <0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2 <0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin <0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2 <0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin <0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660 <0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns } <0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked <0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040 <0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns } <0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns } <0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 167.303811] --------------------------------- <4>[ 167.304722] ------------[ cut here ]------------ <2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283! <4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1 <4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 <4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915] <4>[ 167.304839] RIP: 0010:__engine_park+0x3fd/0x680 [i915] <4>[ 167.304937] Code: 00 48 c7 c2 b0 e5 86 a0 48 8d 3d 00 00 00 00 e8 79 48 d4 e0 bf 01 00 00 00 e8 ef 0a d4 e0 31 f6 bf 09 00 00 00 e8 03 49 c0 e0 <0f> 0b 0f 0b be 01 00 00 00 e8 f5 61 fd ff 31 c0 e9 34 fd ff ff 48 <4>[ 167.304940] RSP: 0018:ffffc9000059fce0 EFLAGS: 00010246 <4>[ 167.304942] RAX: 0000000000000200 RBX: 0000000000000000 RCX: 0000000000000006 <4>[ 167.304944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009 <4>[ 167.304946] RBP: ffff8881330ca1b0 R08: 0000000000000001 R09: 0000000000000001 <4>[ 167.304947] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881330ca000 <4>[ 167.304948] R13: ffff888110f02aa0 R14: ffff88812d1d0205 R15: ffff88811277d4f0 <4>[ 167.304950] FS: 0000000000000000(0000) GS:ffff88844f780000(0000) knlGS:0000000000000000 <4>[ 167.304952] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 167.304953] CR2: 00007fc362200c40 CR3: 000000013306e003 CR4: 0000000000770ef0 <4>[ 167.304955] PKRU: 55555554 <4>[ 167.304957] Call Trace: <4>[ 167.304958] <TASK> <4>[ 167.305573] ____intel_wakeref_put_last+0x1d/0x80 [i915] <4>[ 167.305685] i915_request_retire.part.0+0x34f/0x600 [i915] <4>[ 167.305800] retire_requests+0x51/0x80 [i915] <4>[ 167.305892] intel_gt_retire_requests_timeout+0x27f/0x700 [i915] <4>[ 167.305985] process_scheduled_works+0x2db/0x530 <4>[ 167.305990] worker_thread+0x18c/0x350 <4>[ 167.305993] kthread+0xfe/0x130 <4>[ 167.305997] ret_from_fork+0x2c/0x50 <4>[ 167.306001] ret_from_fork_asm+0x1b/0x30 <4>[ 167.306004] </TASK> It is necessary for the queue_priority_hint to be lower than the next request submission upon waking up, as we rely on the hint to decide when to kick the tasklet to submit that first request. Fixes: 22b7a426bbe1 ("drm/i915/execlists: Preempt-to-busy") Closes: https://gitlab.freedesktop.org/drm/intel/issues/10154 Signed-off-by: Chris Wilson <chris(a)chris-wilson.co.uk> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Cc: Mika Kuoppala <mika.kuoppala(a)linux.intel.com> Cc: <stable(a)vger.kernel.org> # v5.4+ Reviewed-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)linux.intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240318135906.716055-2-janus… (cherry picked from commit 98850e96cf811dc2d0a7d0af491caff9f5d49c1e) Signed-off-by: Rodrigo Vivi <rodrigo.vivi(a)intel.com> Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/gpu/drm/i915/gt/intel_engine_pm.c | 3 --- drivers/gpu/drm/i915/gt/intel_lrc.c | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/intel_engine_pm.c b/drivers/gpu/drm/i915/gt/intel_engine_pm.c index f7b2e07e2229..f9fdbd79c0f3 100644 --- a/drivers/gpu/drm/i915/gt/intel_engine_pm.c +++ b/drivers/gpu/drm/i915/gt/intel_engine_pm.c @@ -250,9 +250,6 @@ static int __engine_park(struct intel_wakeref *wf) intel_engine_park_heartbeat(engine); intel_breadcrumbs_park(engine->breadcrumbs); - /* Must be reset upon idling, or we may miss the busy wakeup. */ - GEM_BUG_ON(engine->execlists.queue_priority_hint != INT_MIN); - if (engine->park) engine->park(engine); diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c index ee9b33c3aff8..5a414d989dca 100644 --- a/drivers/gpu/drm/i915/gt/intel_lrc.c +++ b/drivers/gpu/drm/i915/gt/intel_lrc.c @@ -5032,6 +5032,9 @@ static void execlists_park(struct intel_engine_cs *engine) { cancel_timer(&engine->execlists.timer); cancel_timer(&engine->execlists.preempt); + + /* Reset upon idling, or we may delay the busy wakeup. */ + WRITE_ONCE(engine->execlists.queue_priority_hint, INT_MIN); } void intel_execlists_set_default_submission(struct intel_engine_cs *engine) -- 2.34.1

2 1

2024

2023

2022

2021

2020

2019