- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/6] Script execution control
by Gu Bowen 13 Nov '24

13 Nov '24

Ensure that direct file execution (e.g. ./script.sh) and indirect file execution (e.g. sh script.sh) lead to the same result to support script protection. Gu Bowen (2): IMA support script execution check fix kabi breakage due to exec is_check Kees Cook (1): exec: Check __FMODE_EXEC instead of in_execve for LSMs Linus Torvalds (2): execve: open the executable file before doing anything else uselib: remove use of __FMODE_EXEC Mickaël Salaün (1): exec: Add a new AT_CHECK flag to execveat(2) V2: Add a new patch to fix kabi breakage. Align with the original variables to prevent others from inserting new variables before is_check in the future. V3: Add a mainline patch to fix commit 4759ff71f23e(exec: __FMODE_EXEC instead of in_execve for LSMs). V4: Since openEuler has a more standardised way of using KABI_FILL_HOLE to fix kabi breakage, replace it. fs/exec.c | 89 ++++++++++++++++++------------- include/linux/binfmts.h | 5 ++ include/linux/ima.h | 1 + include/uapi/linux/fcntl.h | 31 +++++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 1 + security/apparmor/lsm.c | 4 +- security/integrity/ima/ima_main.c | 11 ++++ security/security.c | 17 +++++- security/tomoyo/tomoyo.c | 3 +- 10 files changed, 123 insertions(+), 40 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-50115
by Liao Chen 13 Nov '24

13 Nov '24

fix CVE-2024-50115 Sean Christopherson (1): KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory arch/x86/kvm/svm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/2] CVE-2024-5012{4,5}
by GONG Ruiqi 13 Nov '24

13 Nov '24

Luiz Augusto von Dentz (2): Bluetooth: SCO: Fix UAF on sco_sock_timeout Bluetooth: ISO: Fix UAF on iso_sock_timeout include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 22 ++++++++++++++++++++++ net/bluetooth/iso.c | 18 ++++++++++++------ net/bluetooth/sco.c | 18 ++++++++++++------ 4 files changed, 47 insertions(+), 12 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] irqchip/i8259: Fix shutdown order by moving syscore_ops registration
by Zhang Kunbo 13 Nov '24

13 Nov '24

From: Aaro Koskinen <aaro.koskinen(a)iki.fi> mainline inclusion from mainline-v5.1-rc1 commit 518bfe84ec417318b2470652cdb27978ddfeaa59 category: bugfix bugzilla: 190379 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When using cpufreq on Loongson 2F MIPS platform, "poweroff" command gets frequently stuck in syscore_shutdown(). The reason is that i8259A_shutdown() gets called before cpufreq_suspend(), and if we have pending work then irq_work_sync() in cpufreq_dbs_governor_stop() gets stuck forever as we have all interrupts masked already. irq-i8259 is registering syscore_ops using device_initcall(), while cpufreq uses core_initcall(). Fix the shutdown order simply by registering the irq syscore_ops during the early IRQ init instead of using a separate initcall at later stage. Signed-off-by: Aaro Koskinen <aaro.koskinen(a)iki.fi> Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/irqchip/irq-i8259.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/irqchip/irq-i8259.c b/drivers/irqchip/irq-i8259.c index b0d4aab1a58c..d000870d9b6b 100644 --- a/drivers/irqchip/irq-i8259.c +++ b/drivers/irqchip/irq-i8259.c @@ -225,14 +225,6 @@ static struct syscore_ops i8259_syscore_ops = { .shutdown = i8259A_shutdown, }; -static int __init i8259A_init_sysfs(void) -{ - register_syscore_ops(&i8259_syscore_ops); - return 0; -} - -device_initcall(i8259A_init_sysfs); - static void init_8259A(int auto_eoi) { unsigned long flags; @@ -332,6 +324,7 @@ struct irq_domain * __init __init_i8259_irqs(struct device_node *node) panic("Failed to add i8259 IRQ domain"); setup_irq(I8259A_IRQ_BASE + PIC_CASCADE_IR, &irq2); + register_syscore_ops(&i8259_syscore_ops); return domain; } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1291/1291] kernel/sched/core.c:5976:2: error: implicit declaration of function 'init_auto_affinity'
by kernel test robot 13 Nov '24

13 Nov '24

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 commit: 713cfd2684fa5ea08b144d92b9858b932c0f1705 [1291/1291] sched: Introduce smart grid scheduling strategy for cfs config: x86_64-buildonly-randconfig-002-20241113 (https://download.01.org/0day-ci/archive/20241113/202411131145.yjptmRWX-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411131145.yjptmRWX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411131145.yjptmRWX-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/core.c:8: In file included from kernel/sched/sched.h:52: In file included from include/linux/migrate.h:6: In file included from include/linux/mempolicy.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/core.c:8: kernel/sched/sched.h:1249:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1249 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:1587:6: warning: no previous prototype for function 'sched_set_stop_task' [-Wmissing-prototypes] 1587 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ kernel/sched/core.c:1587:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1587 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ | static kernel/sched/core.c:2741:10: warning: cast from 'void (*)(struct callback_head *)' to 'void (*)(struct rq *)' converts to incompatible function type [-Wcast-function-type-strict] 2741 | func = (void (*)(struct rq *))head->func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:3632:35: warning: no previous prototype for function 'schedule_user' [-Wmissing-prototypes] 3632 | asmlinkage __visible void __sched schedule_user(void) | ^ kernel/sched/core.c:3632:22: note: declare 'static' if the function is not intended to be used outside of this translation unit 3632 | asmlinkage __visible void __sched schedule_user(void) | ^ | static kernel/sched/core.c:3771:35: warning: no previous prototype for function 'preempt_schedule_irq' [-Wmissing-prototypes] 3771 | asmlinkage __visible void __sched preempt_schedule_irq(void) | ^ kernel/sched/core.c:3771:22: note: declare 'static' if the function is not intended to be used outside of this translation unit 3771 | asmlinkage __visible void __sched preempt_schedule_irq(void) | ^ | static kernel/sched/core.c:5845:2: error: implicit declaration of function 'tg_update_affinity_domains' [-Werror,-Wimplicit-function-declaration] 5845 | tg_update_affinity_domains(cpu, 1); | ^ kernel/sched/core.c:5904:2: error: implicit declaration of function 'tg_update_affinity_domains' [-Werror,-Wimplicit-function-declaration] 5904 | tg_update_affinity_domains(cpu, 0); | ^ >> kernel/sched/core.c:5976:2: error: implicit declaration of function 'init_auto_affinity' [-Werror,-Wimplicit-function-declaration] 5976 | init_auto_affinity(&root_task_group); | ^ kernel/sched/core.c:5976:2: note: did you mean 'irq_set_affinity'? include/linux/interrupt.h:292:1: note: 'irq_set_affinity' declared here 292 | irq_set_affinity(unsigned int irq, const struct cpumask *cpumask) | ^ kernel/sched/core.c:5976:22: error: use of undeclared identifier 'root_task_group'; did you mean 'task_group'? 5976 | init_auto_affinity(&root_task_group); | ^~~~~~~~~~~~~~~ | task_group kernel/sched/sched.h:1444:34: note: 'task_group' declared here 1444 | static inline struct task_group *task_group(struct task_struct *p) | ^ kernel/sched/core.c:6029:32: warning: variable 'ptr' set but not used [-Wunused-but-set-variable] 6029 | unsigned long alloc_size = 0, ptr; | ^ 7 warnings and 4 errors generated. vim +/init_auto_affinity +5976 kernel/sched/core.c 5949 5950 void __init sched_init_smp(void) 5951 { 5952 sched_init_numa(); 5953 5954 /* 5955 * There's no userspace yet to cause hotplug operations; hence all the 5956 * CPU masks are stable and all blatant races in the below code cannot 5957 * happen. The hotplug lock is nevertheless taken to satisfy lockdep, 5958 * but there won't be any contention on it. 5959 */ 5960 cpus_read_lock(); 5961 mutex_lock(&sched_domains_mutex); 5962 sched_init_domains(cpu_active_mask); 5963 mutex_unlock(&sched_domains_mutex); 5964 cpus_read_unlock(); 5965 5966 /* Move init over to a non-isolated CPU */ 5967 if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0) 5968 BUG(); 5969 sched_init_granularity(); 5970 5971 init_sched_rt_class(); 5972 init_sched_dl_class(); 5973 5974 sched_smp_initialized = true; 5975 > 5976 init_auto_affinity(&root_task_group); 5977 } 5978 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] Script execution control
by Gu Bowen 13 Nov '24

13 Nov '24

Ensure that direct file execution (e.g. ./script.sh) and indirect file execution (e.g. sh script.sh) lead to the same result to support script protection. Gu Bowen (2): IMA support script execution check fix kabi breakage due to exec is_check Kees Cook (1): exec: Check __FMODE_EXEC instead of in_execve for LSMs Linus Torvalds (2): execve: open the executable file before doing anything else uselib: remove use of __FMODE_EXEC Mickaël Salaün (1): exec: Add a new AT_CHECK flag to execveat(2) V2: Add a new patch to fix kabi breakage. Align with the original variables to prevent others from inserting new variables before is_check in the future. V3: Add a mainline patch to fix commit 4759ff71f23e(exec: __FMODE_EXEC instead of in_execve for LSMs). V4: Since openEuler has a more standardised way of using KABI_FILL_HOLE to fix kabi breakage, replace it. fs/exec.c | 89 ++++++++++++++++++------------- include/linux/binfmts.h | 5 ++ include/linux/ima.h | 1 + include/uapi/linux/fcntl.h | 31 +++++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 1 + security/apparmor/lsm.c | 4 +- security/integrity/ima/ima_main.c | 11 ++++ security/security.c | 17 +++++- security/tomoyo/tomoyo.c | 3 +- 10 files changed, 123 insertions(+), 40 deletions(-) -- 2.25.1

2 7

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 58ec866c31299a4b0d63a01cb026877c5f85e4d9
by kernel test robot 13 Nov '24

13 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 !13165 security/keys: fix slab-out-of-bounds in key_task_permission Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411130037.24hgbc37-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411130527.FCTcx7wa-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411130708.2IT5fUX3-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411130719.5GGQe3oi-lkp@intel.com arch/arm64/mm/init.c:784:17: error: 'mem_sleep_current' undeclared (first use in this function) arch/arm64/mm/init.c:790:17: error: 'pmu_nmi_enable' undeclared (first use in this function); did you mean 'perf_pmu_enable'? drivers/iommu/arm-smmu-v3.c:2896:41: error: 'pci_bus_type' undeclared (first use in this function); did you mean 'pci_pcie_type'? include/linux/uaccess.h:112:17: warning: 'gup' may be used uninitialized [-Wmaybe-uninitialized] mm/mem_reliable.c:41:22: warning: 'zero' defined but not used [-Wunused-variable] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/tty/tty_buffer.c:170:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-001-20241112 | `-- drivers-iommu-arm-smmu-v3.c:error:pci_bus_type-undeclared-(first-use-in-this-function) |-- arm64-randconfig-001-20241113 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-002-20241113 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-003-20241112 | |-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) | `-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) |-- arm64-randconfig-003-20241113 | |-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- mm-mem_reliable.c:warning:zero-defined-but-not-used |-- arm64-randconfig-004-20241113 | |-- arch-arm64-include-asm-irqflags.h:warning:flags-may-be-used-uninitialized | |-- drivers-mailbox-phytium_mailbox.c:warning:phytium_mbox_acpi_match-defined-but-not-used | |-- drivers-mfd-cros_ec_dev.c:warning:cros_ec_id-defined-but-not-used | |-- include-linux-uaccess.h:warning:aen-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:args32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ciov-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ctl-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:dd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:f-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:gup-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ioctl_header-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ol_create-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ol_viewport_set-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:packet_size_peek-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:qd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:u_cmd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:user_desc-may-be-used-uninitialized | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-r063-20241113 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- x86_64-allyesconfig | |-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-001-20241113 | |-- crypto-.tmp_sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-char-ipmi-.tmp_ipmi_poweroff.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-gpu-drm-vkms-.tmp_vkms_drv.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-chemical-.tmp_bme680_i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-.tmp_ad5696-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_si1133.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_tsl2772.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-proximity-.tmp_isl29501.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pinctrl-cirrus-.tmp_pinctrl-madera-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-regulator-.tmp_sy8106a-regulator.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-fscache-.tmp_stats.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-jfs-.tmp_super.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- kernel-dma-.tmp_contiguous.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_decompress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_fse_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_decompress.o:warning:objtool:missing-symbol-for-section-.text | `-- net-can-j1939-.tmp_main.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241113 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-003-20241113 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-uid16.o:warning:objtool:__x64_sys_getuid16cold():unreachable-instruction |-- x86_64-randconfig-101-20241113 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-8.3-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 729m configs tested: 19 configs skipped: 139 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241113 gcc-14.2.0 arm64 randconfig-002-20241113 gcc-14.2.0 arm64 randconfig-003-20241113 gcc-14.2.0 arm64 randconfig-004-20241113 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241113 clang-19 x86_64 buildonly-randconfig-002-20241113 clang-19 x86_64 buildonly-randconfig-003-20241113 clang-19 x86_64 buildonly-randconfig-004-20241113 clang-19 x86_64 buildonly-randconfig-005-20241113 clang-19 x86_64 buildonly-randconfig-006-20241113 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241113 gcc-12 x86_64 randconfig-003-20241113 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] iio: light: veml6030: fix IIO device retrieval from embedded device
by Luo Gengkun 13 Nov '24

13 Nov '24

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v5.10.228 commit bf3ab8e1c28f10df0823d4ff312f83c952b06a15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWA CVE: CVE-2024-50198 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c7c44e57750c31de43906d97813273fdffcf7d02 upstream. The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device embedded in the IIO device, not in the i2c client. dev_to_iio_dev() must be used to accessthe right data. The current implementation leads to a segmentation fault on every attempt to read the attribute because indio_dev gets a NULL assignment. This bug has been present since the first appearance of the driver, apparently since the last version (V6) before getting applied. A constant attribute was used until then, and the last modifications might have not been tested again. Cc: stable(a)vger.kernel.org Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Link: https://patch.msgid.link/20240913-veml6035-v1-3-0b09c0c90418@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/iio/light/veml6030.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iio/light/veml6030.c b/drivers/iio/light/veml6030.c index de85c9b30be1..c13626548003 100644 --- a/drivers/iio/light/veml6030.c +++ b/drivers/iio/light/veml6030.c @@ -99,9 +99,8 @@ static const char * const period_values[] = { static ssize_t in_illuminance_period_available_show(struct device *dev, struct device_attribute *attr, char *buf) { + struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev)); int ret, reg, x; - struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev)); - struct veml6030_data *data = iio_priv(indio_dev); ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, &reg); if (ret) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] iio: light: veml6030: fix IIO device retrieval from embedded device
by Luo Gengkun 13 Nov '24

13 Nov '24

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v5.10.228 commit bf3ab8e1c28f10df0823d4ff312f83c952b06a15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWA CVE: CVE-2024-50198 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c7c44e57750c31de43906d97813273fdffcf7d02 upstream. The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device embedded in the IIO device, not in the i2c client. dev_to_iio_dev() must be used to accessthe right data. The current implementation leads to a segmentation fault on every attempt to read the attribute because indio_dev gets a NULL assignment. This bug has been present since the first appearance of the driver, apparently since the last version (V6) before getting applied. A constant attribute was used until then, and the last modifications might have not been tested again. Cc: stable(a)vger.kernel.org Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Link: https://patch.msgid.link/20240913-veml6035-v1-3-0b09c0c90418@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/iio/light/veml6030.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iio/light/veml6030.c b/drivers/iio/light/veml6030.c index de85c9b30be1..c13626548003 100644 --- a/drivers/iio/light/veml6030.c +++ b/drivers/iio/light/veml6030.c @@ -99,9 +99,8 @@ static const char * const period_values[] = { static ssize_t in_illuminance_period_available_show(struct device *dev, struct device_attribute *attr, char *buf) { + struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev)); int ret, reg, x; - struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev)); - struct veml6030_data *data = iio_priv(indio_dev); ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, &reg); if (ret) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] fs/ntfs3: Additional check in ntfs_file_release
by Yifan Qiao 13 Nov '24

13 Nov '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.12-rc3 commit 031d6f608290c847ba6378322d0986d08d1a645a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A2 CVE: CVE-2024-50242 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reported-by: syzbot+8c652f14a0fde76ff11d(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ntfs3/file.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index 28dc22e5e18a..fc45214b7ac4 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -1189,7 +1189,14 @@ static int ntfs_file_release(struct inode *inode, struct file *file) /* If we are last writer on the inode, drop the block reservation. */ if (sbi->options->prealloc && ((file->f_mode & FMODE_WRITE) && - atomic_read(&inode->i_writecount) == 1)) { + atomic_read(&inode->i_writecount) == 1) + /* + * The only file when inode->i_fop = &ntfs_file_operations and + * init_rwsem(&ni->file.run_lock) is not called explicitly is MFT. + * + * Add additional check here. + */ + && inode->i_ino != MFT_REC_MFT) { ni_lock(ni); down_write(&ni->file.run_lock); -- 2.39.2

2 1

[PATCH OLK-6.6] fs/ntfs3: Fix general protection fault in run_is_mapped_full
by Yifan Qiao 13 Nov '24

13 Nov '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> stable inclusion from stable-v6.6.60 commit 68b39c0765de7c97b34889c1f5e81c2a223fdacc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A6 CVE: CVE-2024-50243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a33fb016e49e37aafab18dc3c8314d6399cb4727 ] Fixed deleating of a non-resident attribute in ntfs_create_inode() rollback. Reported-by: syzbot+9af29acd8f27fbce94bc(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ntfs3/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index 1545262995da..4de077a9ffe5 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -1699,7 +1699,10 @@ struct inode *ntfs_create_inode(struct mnt_idmap *idmap, struct inode *dir, attr = ni_find_attr(ni, NULL, NULL, ATTR_EA, NULL, 0, NULL, NULL); if (attr && attr->non_res) { /* Delete ATTR_EA, if non-resident. */ - attr_set_size(ni, ATTR_EA, NULL, 0, NULL, 0, NULL, false, NULL); + struct runs_tree run; + run_init(&run); + attr_set_size(ni, ATTR_EA, NULL, 0, &run, 0, NULL, false, NULL); + run_close(&run); } if (rp_inserted) -- 2.39.2

2 1

[PATCH OLK-6.6] fs/ntfs3: Additional check in ntfs_file_release
by Yifan Qiao 13 Nov '24

13 Nov '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> stable inclusion from stable-v6.6.60 commit 550ef40fa6366d5d11b122e5f36b1f9aa20c087e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A2 CVE: CVE-2024-50242 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 031d6f608290c847ba6378322d0986d08d1a645a ] Reported-by: syzbot+8c652f14a0fde76ff11d(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ntfs3/file.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index f14d21b6c6d3..2ecd0303f942 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -1173,7 +1173,14 @@ static int ntfs_file_release(struct inode *inode, struct file *file) /* If we are last writer on the inode, drop the block reservation. */ if (sbi->options->prealloc && ((file->f_mode & FMODE_WRITE) && - atomic_read(&inode->i_writecount) == 1)) { + atomic_read(&inode->i_writecount) == 1) + /* + * The only file when inode->i_fop = &ntfs_file_operations and + * init_rwsem(&ni->file.run_lock) is not called explicitly is MFT. + * + * Add additional check here. + */ + && inode->i_ino != MFT_REC_MFT) { ni_lock(ni); down_write(&ni->file.run_lock); -- 2.39.2

2 1

[PATCH OLK-5.10] fs/ntfs3: Additional check in ntfs_file_release
by Yifan Qiao 13 Nov '24

13 Nov '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.12-rc3 commit 031d6f608290c847ba6378322d0986d08d1a645a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A2 CVE: CVE-2024-50242 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reported-by: syzbot+8c652f14a0fde76ff11d(a)syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ntfs3/file.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/file.c b/fs/ntfs3/file.c index 28dc22e5e18a..fc45214b7ac4 100644 --- a/fs/ntfs3/file.c +++ b/fs/ntfs3/file.c @@ -1189,7 +1189,14 @@ static int ntfs_file_release(struct inode *inode, struct file *file) /* If we are last writer on the inode, drop the block reservation. */ if (sbi->options->prealloc && ((file->f_mode & FMODE_WRITE) && - atomic_read(&inode->i_writecount) == 1)) { + atomic_read(&inode->i_writecount) == 1) + /* + * The only file when inode->i_fop = &ntfs_file_operations and + * init_rwsem(&ni->file.run_lock) is not called explicitly is MFT. + * + * Add additional check here. + */ + && inode->i_ino != MFT_REC_MFT) { ni_lock(ni); down_write(&ni->file.run_lock); -- 2.39.2

2 1

[openeuler:OLK-5.10 2417/2417] drivers/ub/urma/ubcore/ubcore_ctp.c:114:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL
by kernel test robot 13 Nov '24

13 Nov '24

Hi WenChen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 400fd9ccb52e01bf78acae2bbc1710923a15f033 commit: 6d14be01fcb032c478cd4669b32526fda0393195 [2417/2417] urma: upload kernel patch for 20240318_happy_birthday config: x86_64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130755.ZXqCXQU2-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130755.ZXqCXQU2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130755.ZXqCXQU2-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_ctp.c: In function 'ubcore_find_remove_ctp': >> drivers/ub/urma/ubcore/ubcore_ctp.c:114:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 114 | if (&dev->ht[UBCORE_HT_CTP].head == NULL) { | ^~ In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24, from drivers/ub/urma/ubcore/ubcore_ctp.c:23: include/urma/ubcore_types.h:162:28: note: 'head' declared here 162 | struct hlist_head *head; | ^~~~ -- drivers/ub/urma/ubcore/ubcore_tpg.c: In function 'ubcore_find_remove_tpg': >> drivers/ub/urma/ubcore/ubcore_tpg.c:113:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 113 | if (&dev->ht[UBCORE_HT_TPG].head == NULL) { | ^~ In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24, from drivers/ub/urma/ubcore/ubcore_tpg.c:23: include/urma/ubcore_types.h:162:28: note: 'head' declared here 162 | struct hlist_head *head; | ^~~~ drivers/ub/urma/ubcore/ubcore_tpg.c: In function 'ubcore_find_remove_tp_node': drivers/ub/urma/ubcore/ubcore_tpg.c:149:44: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 149 | if (&dev->ht[UBCORE_HT_UB_TP].head == NULL) { | ^~ include/urma/ubcore_types.h:162:28: note: 'head' declared here 162 | struct hlist_head *head; | ^~~~ -- drivers/ub/urma/ubcore/ubcore_utp.c: In function 'ubcore_find_remove_utp': >> drivers/ub/urma/ubcore/ubcore_utp.c:139:42: warning: the comparison will always evaluate as 'false' for the address of 'head' will never be NULL [-Waddress] 139 | if (&dev->ht[UBCORE_HT_UTP].head == NULL) { | ^~ In file included from drivers/ub/urma/ubcore/ubcore_hash_table.h:24, from drivers/ub/urma/ubcore/ubcore_utp.c:23: include/urma/ubcore_types.h:162:28: note: 'head' declared here 162 | struct hlist_head *head; | ^~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +114 drivers/ub/urma/ubcore/ubcore_ctp.c 108 109 struct ubcore_ctp *ubcore_find_remove_ctp(struct ubcore_device *dev, uint32_t idx) 110 { 111 struct ubcore_ctp *ctp; 112 113 spin_lock(&dev->ht[UBCORE_HT_CTP].lock); > 114 if (&dev->ht[UBCORE_HT_CTP].head == NULL) { -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1291/1291] mm/mem_reliable.c:41:22: warning: 'zero' defined but not used
by kernel test robot 13 Nov '24

13 Nov '24

Hi Chen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 commit: 6943b93b464351cbc35aa002e86bac48e08b1c3f [1291/1291] mm: add support for limiting the usage of reliable memory in pagecache config: arm64-randconfig-003-20241113 (https://download.01.org/0day-ci/archive/20241113/202411130708.2IT5fUX3-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130708.2IT5fUX3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130708.2IT5fUX3-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/mem_reliable.c:42:22: warning: 'reliable_pagecache_max_bytes' defined but not used [-Wunused-variable] 42 | static unsigned long reliable_pagecache_max_bytes = ULONG_MAX; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> mm/mem_reliable.c:41:22: warning: 'zero' defined but not used [-Wunused-variable] 41 | static unsigned long zero; | ^~~~ vim +/zero +41 mm/mem_reliable.c 40 > 41 static unsigned long zero; 42 static unsigned long reliable_pagecache_max_bytes = ULONG_MAX; 43 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1290/1290] drivers/iommu/arm-smmu-v3.c:2896:41: error: 'pci_bus_type' undeclared; did you mean 'pci_pcie_type'?
by kernel test robot 13 Nov '24

13 Nov '24

Hi luochunsheng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 commit: d70a672bcf377261c1b9f07009d22aef935e7b92 [1290/1290] iommu: smmu-v3 support Virtualization feature when 3408iMR/3416iMRraid card exist config: arm64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130719.5GGQe3oi-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130719.5GGQe3oi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130719.5GGQe3oi-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/iommu/arm-smmu-v3.c: In function 'arm_smmu_init_strtab_2lvl': >> drivers/iommu/arm-smmu-v3.c:2896:41: error: 'pci_bus_type' undeclared (first use in this function); did you mean 'pci_pcie_type'? 2896 | ret = bus_for_each_dev(&pci_bus_type, NULL, (void *)smmu, | ^~~~~~~~~~~~ | pci_pcie_type drivers/iommu/arm-smmu-v3.c:2896:41: note: each undeclared identifier is reported only once for each function it appears in drivers/iommu/arm-smmu-v3.c: In function 'arm_smmu_write_strtab_ent': drivers/iommu/arm-smmu-v3.c:1229:28: warning: this statement may fall through [-Wimplicit-fallthrough=] 1229 | if (disable_bypass) | ^ drivers/iommu/arm-smmu-v3.c:1231:17: note: here 1231 | default: | ^~~~~~~ vim +2896 drivers/iommu/arm-smmu-v3.c 2861 2862 /* Calculate the L1 size, capped to the SIDSIZE. */ 2863 size = STRTAB_L1_SZ_SHIFT - (ilog2(STRTAB_L1_DESC_DWORDS) + 3); 2864 size = min(size, smmu->sid_bits - STRTAB_SPLIT); 2865 cfg->num_l1_ents = 1 << size; 2866 2867 size += STRTAB_SPLIT; 2868 if (size < smmu->sid_bits) 2869 dev_warn(smmu->dev, 2870 "2-level strtab only covers %u/%u bits of SID\n", 2871 size, smmu->sid_bits); 2872 2873 l1size = cfg->num_l1_ents * (STRTAB_L1_DESC_DWORDS << 3); 2874 strtab = dmam_alloc_coherent(smmu->dev, l1size, &cfg->strtab_dma, 2875 GFP_KERNEL | __GFP_ZERO); 2876 if (!strtab) { 2877 dev_err(smmu->dev, 2878 "failed to allocate l1 stream table (%u bytes)\n", 2879 size); 2880 return -ENOMEM; 2881 } 2882 cfg->strtab = strtab; 2883 2884 /* Configure strtab_base_cfg for 2 levels */ 2885 reg = FIELD_PREP(STRTAB_BASE_CFG_FMT, STRTAB_BASE_CFG_FMT_2LVL); 2886 reg |= FIELD_PREP(STRTAB_BASE_CFG_LOG2SIZE, size); 2887 reg |= FIELD_PREP(STRTAB_BASE_CFG_SPLIT, STRTAB_SPLIT); 2888 cfg->strtab_base_cfg = reg; 2889 2890 #ifdef CONFIG_SMMU_BYPASS_DEV 2891 ret = arm_smmu_init_l1_strtab(smmu); 2892 if (ret) 2893 return ret; 2894 2895 if (smmu_bypass_devices_num) { > 2896 ret = bus_for_each_dev(&pci_bus_type, NULL, (void *)smmu, 2897 arm_smmu_prepare_init_l2_strtab); 2898 } 2899 return ret; 2900 #else 2901 return arm_smmu_init_l1_strtab(smmu); 2902 #endif 2903 } 2904 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 0ba9236d77144cd710089049024dd2c750dab24e
by kernel test robot 13 Nov '24

13 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 0ba9236d77144cd710089049024dd2c750dab24e !13181 drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() Unverified Error/Warning (likely false positive, kindly check if interested): include/linux/fortify-string.h:57:33: warning: writing 4 bytes into a region of size between 18446744073709551613 and 2 [-Wstringop-overflow=] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- drivers-infiniband-hw-xsc-main.c:warning:no-previous-prototype-for-function-xsc_ib_reboot_event_handler | |-- drivers-infiniband-hw-xsc-mr.c:warning:no-previous-prototype-for-function-xsc_get_mr_page_mode | |-- drivers-infiniband-hw-xsc-private_dev.c:warning:variable-char_dev-set-but-not-used | |-- drivers-infiniband-hw-xsc-qp.c:warning:variable-xsc_state-is-uninitialized-when-used-here | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_channel-nbl_channel.c:warning:no-previous-prototype-for-function-nbl_chan_clean_queue_subtask | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_common-nbl_common.c:warning:variable-node_num-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:no-previous-prototype-for-function-nbl_get_eeprom | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:no-previous-prototype-for-function-nbl_get_eeprom_length | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:no-previous-prototype-for-function-nbl_serv_adjust_interrpt_param | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_flush_rx_queues | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_get_vf_base_vsi_id | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_pldmfw_op_pci_match_record | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_setup_queues | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_setup_rings | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_stop_rings | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:adding-int-to-a-string-does-not-append-to-the-string | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_insert_pp_ht | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_mgt_start_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_mgt_stop_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_remove_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_set_mt_input | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_setup_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_mgt_init_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_remove_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_setup_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_init_qid_map_table | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_remove_qid_map_table_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_setup_qid_map_table_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_txrx.c:warning:no-previous-prototype-for-function-nbl_alloc_tx_rings | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-set_feature_vlan_offload | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_net_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_set_vf_link_state | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-anlt_fec_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-fpga_type_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-hps_ddr_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-ma_xbar_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-onchip_ft_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pct_exp_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pp_tbl_dma_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-rdma_icrc_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:no-previous-prototype-for-function-xsc_hw_kernel_call | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_pci_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_dereg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_reg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mpt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mtt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-vport.c:warning:variable-i-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_add_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_create | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_destroy | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_remove_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_reset | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_set | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_create_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_destroy_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_member_status | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 |-- arm64-randconfig-001-20241112 | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- mm-mem_reliable.c:error:implicit-declaration-of-function-mem_reliable_ctrl_bit_disable | `-- mm-mem_reliable.c:warning:mem_reliable_ctrl_bit_disabled-defined-but-not-used |-- arm64-randconfig-002-20241112 | |-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | `-- mm-page_alloc.c:error:call-to-undeclared-function-dynamic_pool_should_alloc-ISO-C99-and-later-do-not-support-implicit-function-declarations |-- arm64-randconfig-003-20241112 | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 |-- arm64-randconfig-004-20241112 | |-- drivers-char-ipmi-ipmi_bt_sm.c:error:call-to-undeclared-function-acpi_evaluate_integer-ISO-C99-and-later-do-not-support-implicit-function-declarations | `-- mm-page_alloc.c:error:call-to-undeclared-function-dynamic_pool_should_alloc-ISO-C99-and-later-do-not-support-implicit-function-declarations |-- arm64-randconfig-051-20241113 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | `-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) |-- arm64-randconfig-052-20241113 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | `-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) |-- arm64-randconfig-053-20241113 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | `-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) |-- arm64-randconfig-054-20241113 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | `-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) |-- loongarch-allmodconfig | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 |-- loongarch-randconfig-001-20241112 | |-- arch-loongarch-kvm-exit.c:error:struct-sched_info-has-no-member-named-run_delay | `-- arch-loongarch-kvm-vcpu.c:error:struct-sched_info-has-no-member-named-run_delay |-- loongarch-randconfig-002-20241112 | |-- drivers-net-ethernet-mucse-rnpm-rnpm_lib.c:error:struct-rnpm_tx_buffer-has-no-member-named-gso_need_padding | |-- drivers-net-ethernet-mucse-rnpm-rnpm_main.c:error:struct-rnpm_tx_buffer-has-no-member-named-gso_need_padding | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 |-- loongarch-randconfig-051-20241112 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | `-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) |-- loongarch-randconfig-052-20241112 | |-- Documentation-devicetree-bindings-arm-arm-mpam-msc.yaml:error-string-value-is-redundantly-quoted-with-any-quotes-(quoted-strings) | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:Example-is-not-one-of-id-schema-title-description-examples-required-allOf-anyOf-oneOf-definitions-defs-additionalProperties-dependencies-dependent | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:id:Cannot-determine-base-path-from-id-relative-path-filename-doesn-t-match-actual-path-or-filename | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:ignoring-error-in-schema:properties:clocks:items | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:items:anyOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:clocks:oneOf-conditional-failed-one-must-be-fixed: | |-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:properties:reg:oneOf-conditional-failed-one-must-be-fixed: | `-- Documentation-devicetree-bindings-gpu-phytium-dc.yaml:warning-wrong-indentation:expected-but-found-(indentation) |-- loongarch-randconfig-r051-20241112 | `-- include-linux-fortify-string.h:warning:writing-bytes-into-a-region-of-size-between-and |-- x86_64-allnoconfig | |-- Warning:drivers-net-ethernet-nebula-matrix-Kconfig-references-a-file-that-doesn-t-exist:file:Documentation-networking-device_drivers-ethernet-nebula-matrix-m18110.rst | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | `-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init |-- x86_64-allyesconfig | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- drivers-gpu-drm-amd-amdgpu-..-display-dc-dml-calcs-dcn_calc_auto.c:warning:stack-frame-size-()-exceeds-limit-()-in-mode_support_and_system_configuration | |-- drivers-infiniband-hw-xsc-main.c:warning:no-previous-prototype-for-function-xsc_ib_reboot_event_handler | |-- drivers-infiniband-hw-xsc-mr.c:warning:no-previous-prototype-for-function-xsc_get_mr_page_mode | |-- drivers-infiniband-hw-xsc-private_dev.c:warning:variable-char_dev-set-but-not-used | |-- drivers-infiniband-hw-xsc-qp.c:warning:variable-xsc_state-is-uninitialized-when-used-here | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_channel-nbl_channel.c:warning:no-previous-prototype-for-function-nbl_chan_clean_queue_subtask | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_common-nbl_common.c:warning:variable-node_num-set-but-not-used | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:no-previous-prototype-for-function-nbl_get_eeprom | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:no-previous-prototype-for-function-nbl_get_eeprom_length | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_ethtool.c:warning:no-previous-prototype-for-function-nbl_serv_adjust_interrpt_param | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_flush_rx_queues | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_get_vf_base_vsi_id | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_pldmfw_op_pci_match_record | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_setup_queues | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_setup_rings | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_core-nbl_service.c:warning:no-previous-prototype-for-function-nbl_serv_stop_rings | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:adding-int-to-a-string-does-not-append-to-the-string | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_insert_pp_ht | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_mgt_start_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_mgt_stop_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_remove_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_set_mt_input | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_flow_leonis.c:warning:no-previous-prototype-for-function-nbl_flow_setup_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_mgt_init_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_remove_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_queue_setup_ops_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_init_qid_map_table | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_remove_qid_map_table_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_hw_leonis-nbl_queue_leonis.c:warning:no-previous-prototype-for-function-nbl_res_queue_setup_qid_map_table_leonis | |-- drivers-net-ethernet-nebula-matrix-nbl-nbl_hw-nbl_txrx.c:warning:no-previous-prototype-for-function-nbl_alloc_tx_rings | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-set_feature_vlan_offload | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_net_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-net-main.c:warning:no-previous-prototype-for-function-xsc_set_vf_link_state | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-anlt_fec_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-fpga_type_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-hps_ddr_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-ma_xbar_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-onchip_ft_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pct_exp_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-pp_tbl_dma_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_eth_ethtool.c:warning:unused-variable-rdma_icrc_name | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:no-previous-prototype-for-function-xsc_hw_kernel_call | |-- drivers-net-ethernet-yunsilicon-xsc-net-xsc_hw_comm.c:warning:variable-err-set-but-not-used | |-- drivers-net-ethernet-yunsilicon-xsc-pci-main.c:warning:no-previous-prototype-for-function-xsc_pci_reboot_event_handler | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_dereg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_reg_mr_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mpt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-mr.c:warning:no-previous-prototype-for-function-xsc_set_mtt_via_cmdq | |-- drivers-net-ethernet-yunsilicon-xsc-pci-vport.c:warning:variable-i-is-uninitialized-when-used-here | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_add_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_create | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_destroy | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_remove_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-pack_lag_update_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_reset | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_board_lag_set | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_add_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_hash_type | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_cmd_update_lag_member_status | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_create_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_destroy_lag | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_remove_lag_member | |-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_hash_type | `-- drivers-net-ethernet-yunsilicon-xsc-pci-xsc_lag.c:warning:no-previous-prototype-for-function-xsc_update_lag_member_status |-- x86_64-buildonly-randconfig-001-20241113 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 |-- x86_64-buildonly-randconfig-002-20241113 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | `-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init |-- x86_64-buildonly-randconfig-003-20241113 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-kh40000_get_direct_dma_ops | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 |-- x86_64-buildonly-randconfig-004-20241113 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 |-- x86_64-buildonly-randconfig-005-20241113 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 |-- x86_64-buildonly-randconfig-006-20241113 | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-function-kh40000_get_direct_dma_ops | `-- drivers-crypto-ccp-hygon-hct.c:error:no-member-named-numa_node-in-struct-device |-- x86_64-kexec | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_cpu_init | |-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_mmio_init | `-- arch-x86-events-zhaoxin-uncore.c:warning:no-previous-prototype-for-function-kx7000_uncore_pci_init |-- x86_64-randconfig-001-20241113 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 | |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops | `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 `-- x86_64-randconfig-002-20241113 |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 |-- arch-x86-kernel-early-quirks.c:warning:no-previous-prototype-for-kh40000_get_direct_dma_ops `-- kernel-dma-contiguous.c:warning:no-previous-prototype-for-is_zhaoxin_kh40000 elapsed time: 725m configs tested: 23 configs skipped: 124 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241112 gcc-14.2.0 arm64 randconfig-002-20241112 clang-20 arm64 randconfig-003-20241112 clang-20 arm64 randconfig-004-20241112 clang-20 loongarch allmodconfig gcc-14.2.0 loongarch allnoconfig gcc-14.2.0 loongarch randconfig-001-20241112 gcc-14.2.0 loongarch randconfig-002-20241112 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241113 clang-19 x86_64 buildonly-randconfig-002-20241113 clang-19 x86_64 buildonly-randconfig-003-20241113 clang-19 x86_64 buildonly-randconfig-004-20241113 clang-19 x86_64 buildonly-randconfig-005-20241113 clang-19 x86_64 buildonly-randconfig-006-20241113 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241113 gcc-12 x86_64 randconfig-002-20241113 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1290/1290] arch/arm64/mm/init.c:790:17: error: 'pmu_nmi_enable' undeclared; did you mean 'perf_pmu_enable'?
by kernel test robot 13 Nov '24

13 Nov '24

Hi Xu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 commit: 0c40cea7cfc2d1d9762e6fbbb531a43e6dac95ca [1290/1290] NMI: Enable arm-pmu interrupt as NMI in Acensed. config: arm64-randconfig-003-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130527.FCTcx7wa-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130527.FCTcx7wa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130527.FCTcx7wa-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/mm/init.c:469:13: warning: no previous prototype for 'arm64_memblock_init' [-Wmissing-prototypes] 469 | void __init arm64_memblock_init(void) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c: In function 'ascend_enable_all_features': arch/arm64/mm/init.c:787:17: error: 'mem_sleep_current' undeclared (first use in this function) 787 | mem_sleep_current = PM_SUSPEND_ON; | ^~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c:787:17: note: each undeclared identifier is reported only once for each function it appears in >> arch/arm64/mm/init.c:790:17: error: 'pmu_nmi_enable' undeclared (first use in this function); did you mean 'perf_pmu_enable'? 790 | pmu_nmi_enable = true; | ^~~~~~~~~~~~~~ | perf_pmu_enable vim +790 arch/arm64/mm/init.c 774 775 void ascend_enable_all_features(void) 776 { 777 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 778 enable_mmap_dvpp = 1; 779 780 if (IS_ENABLED(CONFIG_ASCEND_IOPF_HIPRI)) 781 enable_iopf_hipri = 1; 782 783 if (IS_ENABLED(CONFIG_ASCEND_CHARGE_MIGRATE_HUGEPAGES)) 784 enable_charge_mighp = 1; 785 786 if (IS_ENABLED(CONFIG_SUSPEND)) 787 mem_sleep_current = PM_SUSPEND_ON; 788 789 if (IS_ENABLED(CONFIG_PMU_WATCHDOG)) > 790 pmu_nmi_enable = true; 791 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2417/2417] kernel/sched/psi.c:199:23: warning: no previous prototype for 'to_psi_group_ext'
by kernel test robot 13 Nov '24

13 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 400fd9ccb52e01bf78acae2bbc1710923a15f033 commit: 65479800e82741cf74021459e951eccc3c07c6d4 [2417/2417] psi: add struct psi_group_ext config: x86_64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130536.ah7Yo4Qa-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130536.ah7Yo4Qa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130536.ah7Yo4Qa-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/sched/psi.c:199:23: warning: no previous prototype for 'to_psi_group_ext' [-Wmissing-prototypes] 199 | struct psi_group_ext *to_psi_group_ext(struct psi_group *psi) | ^~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/to_psi_group_ext +199 kernel/sched/psi.c 198 > 199 struct psi_group_ext *to_psi_group_ext(struct psi_group *psi) 200 { 201 if (psi == &psi_system) 202 return &psi_stat_system; 203 else 204 return container_of(psi, struct psi_group_ext, psi); 205 } 206 #else 207 static inline struct psi_group_ext *to_psi_group_ext(struct psi_group *psi) 208 { 209 return NULL; 210 } 211 #endif 212 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2417/2417] kernel/sched/fair.c:4499:43: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'?
by kernel test robot 13 Nov '24

13 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 400fd9ccb52e01bf78acae2bbc1710923a15f033 commit: 433c0b72564239cf3086f563d5ca32a10e4ffd3f [2417/2417] sched/fair: Count the number of tasks marked as steal_task on cfs_rq config: x86_64-randconfig-015-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130044.gkUMo98D-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130044.gkUMo98D-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130044.gkUMo98D-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/fair.c:23: In file included from kernel/sched/sched.h:39: In file included from include/linux/blkdev.h:9: In file included from include/linux/genhd.h:20: In file included from include/linux/blk_types.h:11: In file included from include/linux/bvec.h:14: In file included from include/linux/mm.h:1587: include/linux/vmstat.h:417:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 417 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 418 | item]; | ~~~~ include/linux/vmstat.h:424:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 424 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 425 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:431:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 431 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:436:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 436 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 437 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:445:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 445 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 446 | NR_VM_NUMA_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/fair.c:23: kernel/sched/sched.h:1864:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1864 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/sched/fair.c:4499:43: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 4499 | (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:4525:36: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 4525 | if (group_steal_used() && rq->cfs.steal_h_nr_running < 1) | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:6670:12: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 6670 | cfs_rq->steal_h_nr_running++; | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:6694:12: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 6694 | cfs_rq->steal_h_nr_running++; | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:6795:12: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 6795 | cfs_rq->steal_h_nr_running--; | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:6831:12: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 6831 | cfs_rq->steal_h_nr_running--; | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:13229:29: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 13229 | if (tg_used && src_rq->cfs.steal_h_nr_running < 1) | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:13241:30: error: no member named 'steal_h_nr_running' in 'struct cfs_rq'; did you mean 'idle_h_nr_running'? 13241 | (tg_used && src_rq->cfs.steal_h_nr_running < 1)) | ^~~~~~~~~~~~~~~~~~ | idle_h_nr_running kernel/sched/sched.h:632:16: note: 'idle_h_nr_running' declared here 632 | unsigned int idle_h_nr_running; /* SCHED_IDLE */ | ^ kernel/sched/fair.c:13411:6: warning: no previous prototype for function 'task_vruntime_update' [-Wmissing-prototypes] 13411 | void task_vruntime_update(struct rq *rq, struct task_struct *p, bool in_fi) | ^ kernel/sched/fair.c:13411:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 13411 | void task_vruntime_update(struct rq *rq, struct task_struct *p, bool in_fi) | ^ | static 7 warnings and 8 errors generated. vim +4499 kernel/sched/fair.c 4485 4486 static void overload_clear(struct rq *rq) 4487 { 4488 struct sparsemask *overload_cpus; 4489 unsigned long time; 4490 bool need_clear = false; 4491 4492 if (!steal_enabled()) 4493 return; 4494 4495 if (!group_steal_used() && rq->cfs.h_nr_running >= 2) 4496 return; 4497 4498 if (group_steal_used() && > 4499 (rq->cfs.h_nr_running < 2 || rq->cfs.steal_h_nr_running == 0)) 4500 need_clear = true; 4501 4502 if (!need_clear) 4503 return; 4504 4505 time = schedstat_start_time(); 4506 rcu_read_lock(); 4507 overload_cpus = rcu_dereference(rq->cfs_overload_cpus); 4508 if (overload_cpus) 4509 sparsemask_clear_elem(overload_cpus, rq->cpu); 4510 rcu_read_unlock(); 4511 schedstat_end_time(rq, time); 4512 } 4513 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1290/1290] arch/arm64/mm/init.c:784:17: error: 'mem_sleep_current' undeclared
by kernel test robot 13 Nov '24

13 Nov '24

Hi Ding, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 commit: fdda68feeca82610ccbcdcbda7250623a6d187d2 [1290/1290] arm64/ascend: Set mem_sleep_current to PM_SUSPEND_ON for ascend platform config: arm64-randconfig-003-20241112 (https://download.01.org/0day-ci/archive/20241113/202411130037.24hgbc37-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411130037.24hgbc37-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411130037.24hgbc37-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/mm/init.c:469:13: warning: no previous prototype for 'arm64_memblock_init' [-Wmissing-prototypes] 469 | void __init arm64_memblock_init(void) | ^~~~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c: In function 'ascend_enable_setup': >> arch/arm64/mm/init.c:784:17: error: 'mem_sleep_current' undeclared (first use in this function) 784 | mem_sleep_current = PM_SUSPEND_ON; | ^~~~~~~~~~~~~~~~~ arch/arm64/mm/init.c:784:17: note: each undeclared identifier is reported only once for each function it appears in vim +/mem_sleep_current +784 arch/arm64/mm/init.c 770 771 #ifdef CONFIG_ASCEND_FEATURES 772 static int __init ascend_enable_setup(char *__unused) 773 { 774 if (IS_ENABLED(CONFIG_ASCEND_DVPP_MMAP)) 775 enable_mmap_dvpp = 1; 776 777 if (IS_ENABLED(CONFIG_ASCEND_IOPF_HIPRI)) 778 enable_iopf_hipri = 1; 779 780 if (IS_ENABLED(CONFIG_ASCEND_CHARGE_MIGRATE_HUGEPAGES)) 781 enable_charge_mighp = 1; 782 783 if (IS_ENABLED(CONFIG_SUSPEND)) > 784 mem_sleep_current = PM_SUSPEND_ON; 785 786 return 1; 787 } 788 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD REGRESSION 400fd9ccb52e01bf78acae2bbc1710923a15f033
by kernel test robot 12 Nov '24

12 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 400fd9ccb52e01bf78acae2bbc1710923a15f033 !13095 Update ASPM sysfs on MFD function removal to avoid use-after-free Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411121519.FfuB626X-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411121753.yQqZUvdw-lkp@intel.com crypto/asymmetric_keys/pgp_public_key.c:201:33: warning: unused variable 'pgp' [-Wunused-variable] crypto/asymmetric_keys/pgp_public_key.c:48:39: warning: 'struct pgp_parse_pubkey' declared inside parameter list will not be visible outside of this definition or declaration drivers/gpu/drm/phytium/phytium_dp.c:300:17: warning: 'strncpy' output may be truncated copying 32 bytes from a string of length 439 [-Wstringop-truncation] Unverified Error/Warning (likely false positive, kindly check if interested): fs/btrfs/extent_io.c:1945 __process_pages_contig() warn: variable dereferenced before check 'index_ret' (see line 1888) Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20241112 | |-- drivers-gpu-drm-phytium-phytium_dp.c:warning:strncpy-output-may-be-truncated-copying-bytes-from-a-string-of-length | `-- kernel-sched-topology.c:error:implicit-declaration-of-function-register_sysctl_init |-- arm64-randconfig-002-20241112 | |-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r2-in-asm | `-- arch-arm64-include-asm-archrandom.h:error:unknown-register-name-r3-in-asm |-- x86_64-allnoconfig | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | `-- ld.lld:error:duplicate-symbol:debug |-- x86_64-buildonly-randconfig-003-20241112 | `-- vmlinux.o:warning:objtool:do_syscall_64:call-to-memset()-leaves-.noinstr.text-section |-- x86_64-kexec | `-- kernel-trace-trace_uprobe.o:warning:objtool:__uprobe_perf_func:unreachable-instruction |-- x86_64-randconfig-001-20241112 | |-- crypto-asymmetric_keys-pgp_public_key.c:warning:struct-pgp_parse_pubkey-declared-inside-parameter-list-will-not-be-visible-outside-of-this-definition-or-declaration | `-- crypto-asymmetric_keys-pgp_public_key.c:warning:unused-variable-pgp `-- x86_64-randconfig-161-20241112 `-- fs-btrfs-extent_io.c-__process_pages_contig()-warn:variable-dereferenced-before-check-index_ret-(see-line-) elapsed time: 779m configs tested: 11 configs skipped: 93 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241112 gcc-14.2.0 arm64 randconfig-002-20241112 clang-20 arm64 randconfig-003-20241112 clang-20 arm64 randconfig-004-20241112 clang-20 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-50115
by Liao Chen 12 Nov '24

12 Nov '24

fix CVE-2024-50115 Sean Christopherson (1): [Backport] KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory arch/x86/kvm/svm/nested.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 1290/1290] drivers/clocksource/arm_arch_timer.c:554:44: error: 'hisi_161010101_read_cntvct_el0' undeclared
by kernel test robot 12 Nov '24

12 Nov '24

Hi Yang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 078e0901be705959736f37cb993768ed39658448 commit: e63b4759933f6a5c5ce6cdc1d11c7bf2201d0612 [1290/1290] arm64: arch_timer: only do cntvct workaround on VDSO path on D05 config: arm64-randconfig-002-20241112 (https://download.01.org/0day-ci/archive/20241112/202411122158.hK6m4BFI-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241112/202411122158.hK6m4BFI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411122158.hK6m4BFI-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/clocksource/arm_arch_timer.c: In function 'arch_timer_enable_workaround': >> drivers/clocksource/arm_arch_timer.c:554:44: error: 'hisi_161010101_read_cntvct_el0' undeclared (first use in this function) 554 | if (wa->read_cntvct_el0 == hisi_161010101_read_cntvct_el0) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/clocksource/arm_arch_timer.c:554:44: note: each undeclared identifier is reported only once for each function it appears in vim +/hisi_161010101_read_cntvct_el0 +554 drivers/clocksource/arm_arch_timer.c 527 528 static 529 void arch_timer_enable_workaround(const struct arch_timer_erratum_workaround *wa, 530 bool local) 531 { 532 int i; 533 534 if (local) { 535 __this_cpu_write(timer_unstable_counter_workaround, wa); 536 } else { 537 for_each_possible_cpu(i) 538 per_cpu(timer_unstable_counter_workaround, i) = wa; 539 } 540 541 /* 542 * Use the locked version, as we're called from the CPU 543 * hotplug framework. Otherwise, we end-up in deadlock-land. 544 */ 545 static_branch_enable_cpuslocked(&arch_timer_read_ool_enabled); 546 547 /* 548 * Don't use the vdso fastpath if errata require using the 549 * out-of-line counter accessor. We may change our mind pretty 550 * late in the game (with a per-CPU erratum, for example), so 551 * change both the default value and the vdso itself. 552 */ 553 if (wa->read_cntvct_el0) { > 554 if (wa->read_cntvct_el0 == hisi_161010101_read_cntvct_el0) { 555 clocksource_counter.archdata.vdso_direct = true; 556 vdso_default = true; 557 vdso_fix = true; 558 } else { 559 clocksource_counter.archdata.vdso_direct = false; 560 vdso_default = false; 561 } 562 } 563 } 564 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/1] fix CVE-2024-50115
by Liao Chen 12 Nov '24

12 Nov '24

fix CVE-2024-50115 Sean Christopherson (1): [Backport] KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory arch/x86/kvm/svm/nested.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] fix CVE-2024-50115
by Liao Chen 12 Nov '24

12 Nov '24

fix CVE-2024-50115 Sean Christopherson (1): [Backport] KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory arch/x86/kvm/svm/nested.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] net/ncsi: Disable the ncsi work before freeing the associated structure
by Zhang Changzhong 12 Nov '24

12 Nov '24

From: Eddie James <eajames(a)linux.ibm.com> mainline inclusion from mainline-v6.12-rc2 commit a0ffa68c70b367358b2672cdab6fa5bc4c40de2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA5 CVE: CVE-2024-49945 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic. Fixes: 2d283bdd079c ("net/ncsi: Resource management") Signed-off-by: Eddie James <eajames(a)linux.ibm.com> Link: https://patch.msgid.link/20240925155523.1017097-1-eajames@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ncsi/ncsi-manage.c [commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed) work items") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ncsi/ncsi-manage.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c index 90c6cf6..60725e0 100644 --- a/net/ncsi/ncsi-manage.c +++ b/net/ncsi/ncsi-manage.c @@ -1949,6 +1949,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd) list_del_rcu(&ndp->node); spin_unlock_irqrestore(&ncsi_dev_lock, flags); + cancel_work_sync(&ndp->work); + kfree(ndp); } EXPORT_SYMBOL_GPL(ncsi_unregister_dev); -- 2.9.5

2 1

[PATCH openEuler-22.03-LTS-SP1] net/ncsi: Disable the ncsi work before freeing the associated structure
by Zhang Changzhong 12 Nov '24

12 Nov '24

From: Eddie James <eajames(a)linux.ibm.com> mainline inclusion from mainline-v6.12-rc2 commit a0ffa68c70b367358b2672cdab6fa5bc4c40de2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA5 CVE: CVE-2024-49945 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic. Fixes: 2d283bdd079c ("net/ncsi: Resource management") Signed-off-by: Eddie James <eajames(a)linux.ibm.com> Link: https://patch.msgid.link/20240925155523.1017097-1-eajames@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ncsi/ncsi-manage.c [commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed) work items") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ncsi/ncsi-manage.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c index ffff8da..4f51dc0 100644 --- a/net/ncsi/ncsi-manage.c +++ b/net/ncsi/ncsi-manage.c @@ -1895,6 +1895,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd) list_del_rcu(&ndp->node); spin_unlock_irqrestore(&ncsi_dev_lock, flags); + cancel_work_sync(&ndp->work); + kfree(ndp); } EXPORT_SYMBOL_GPL(ncsi_unregister_dev); -- 2.9.5

2 1

[PATCH OLK-5.10] net/ncsi: Disable the ncsi work before freeing the associated structure
by Zhang Changzhong 12 Nov '24

12 Nov '24

From: Eddie James <eajames(a)linux.ibm.com> mainline inclusion from mainline-v6.12-rc2 commit a0ffa68c70b367358b2672cdab6fa5bc4c40de2c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA5 CVE: CVE-2024-49945 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic. Fixes: 2d283bdd079c ("net/ncsi: Resource management") Signed-off-by: Eddie James <eajames(a)linux.ibm.com> Link: https://patch.msgid.link/20240925155523.1017097-1-eajames@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/ncsi/ncsi-manage.c [commit 86898fa6b8cd ("workqueue: Implement disable/enable for (delayed) work items") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ncsi/ncsi-manage.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c index ffff8da..4f51dc0 100644 --- a/net/ncsi/ncsi-manage.c +++ b/net/ncsi/ncsi-manage.c @@ -1895,6 +1895,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd) list_del_rcu(&ndp->node); spin_unlock_irqrestore(&ncsi_dev_lock, flags); + cancel_work_sync(&ndp->work); + kfree(ndp); } EXPORT_SYMBOL_GPL(ncsi_unregister_dev); -- 2.9.5

2 1

[openeuler:OLK-5.10 2418/2418] drivers/gpu/drm/phytium/phytium_dp.c:300:17: warning: 'strncpy' output may be truncated copying 32 bytes from a string of length 439
by kernel test robot 12 Nov '24

12 Nov '24

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 400fd9ccb52e01bf78acae2bbc1710923a15f033 commit: b2a83bcdafcaaaa60199147d04798d431cc800cc [2418/2418] DRM: Phytium display DRM driver config: arm64-randconfig-001-20241112 (https://download.01.org/0day-ci/archive/20241112/202411121753.yQqZUvdw-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241112/202411121753.yQqZUvdw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411121753.yQqZUvdw-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/phytium/phytium_dp.c:503:6: warning: no previous prototype for 'phytium_dp_coding_8b10b_need_enable' [-Wmissing-prototypes] 503 | bool phytium_dp_coding_8b10b_need_enable(unsigned char test_pattern) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:520:6: warning: no previous prototype for 'phytium_dp_scrambled_need_enable' [-Wmissing-prototypes] 520 | bool phytium_dp_scrambled_need_enable(unsigned char test_pattern) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:653:6: warning: no previous prototype for 'phytium_dp_hw_enable_audio' [-Wmissing-prototypes] 653 | void phytium_dp_hw_enable_audio(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:822:6: warning: no previous prototype for 'phytium_dp_hw_disable_video' [-Wmissing-prototypes] 822 | void phytium_dp_hw_disable_video(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:833:6: warning: no previous prototype for 'phytium_dp_hw_video_is_enable' [-Wmissing-prototypes] 833 | bool phytium_dp_hw_video_is_enable(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:844:6: warning: no previous prototype for 'phytium_dp_hw_enable_video' [-Wmissing-prototypes] 844 | void phytium_dp_hw_enable_video(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:856:6: warning: no previous prototype for 'phytium_dp_hw_config_video' [-Wmissing-prototypes] 856 | void phytium_dp_hw_config_video(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:945:6: warning: no previous prototype for 'phytium_dp_hw_disable_output' [-Wmissing-prototypes] 945 | void phytium_dp_hw_disable_output(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:957:6: warning: no previous prototype for 'phytium_dp_hw_enable_output' [-Wmissing-prototypes] 957 | void phytium_dp_hw_enable_output(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:969:6: warning: no previous prototype for 'phytium_dp_hw_enable_input_source' [-Wmissing-prototypes] 969 | void phytium_dp_hw_enable_input_source(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:980:6: warning: no previous prototype for 'phytium_dp_hw_disable_input_source' [-Wmissing-prototypes] 980 | void phytium_dp_hw_disable_input_source(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:990:6: warning: no previous prototype for 'phytium_dp_hw_output_is_enable' [-Wmissing-prototypes] 990 | bool phytium_dp_hw_output_is_enable(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1027:6: warning: no previous prototype for 'phytium_dp_hw_hpd_irq_setup' [-Wmissing-prototypes] 1027 | void phytium_dp_hw_hpd_irq_setup(struct phytium_dp_device *phytium_dp, bool enable) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1042:5: warning: no previous prototype for 'phytium_dp_hw_init' [-Wmissing-prototypes] 1042 | int phytium_dp_hw_init(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1220:6: warning: no previous prototype for 'phytium_dp_dpcd_sink_dpms' [-Wmissing-prototypes] 1220 | void phytium_dp_dpcd_sink_dpms(struct phytium_dp_device *phytium_dp, int mode) | ^~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1445:5: warning: no previous prototype for 'phytium_dp_get_link_train_fallback_values' [-Wmissing-prototypes] 1445 | int phytium_dp_get_link_train_fallback_values(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1494:5: warning: no previous prototype for 'phytium_dp_start_link_train' [-Wmissing-prototypes] 1494 | int phytium_dp_start_link_train(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1799:6: warning: no previous prototype for 'phytium_dp_hpd_poll_handler' [-Wmissing-prototypes] 1799 | void phytium_dp_hpd_poll_handler(struct phytium_display_private *priv) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:1946:6: warning: no previous prototype for 'phytium_dp_fast_link_train' [-Wmissing-prototypes] 1946 | bool phytium_dp_fast_link_train(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:2137:6: warning: no previous prototype for 'phytium_dp_adjust_link_train_parameter' [-Wmissing-prototypes] 2137 | void phytium_dp_adjust_link_train_parameter(struct phytium_dp_device *phytium_dp) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:2197:1: warning: no previous prototype for 'phytium_encoder_mode_valid' [-Wmissing-prototypes] 2197 | phytium_encoder_mode_valid(struct drm_encoder *encoder, const struct drm_display_mode *mode) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c:2447:5: warning: no previous prototype for 'phytium_get_encoder_crtc_mask' [-Wmissing-prototypes] 2447 | int phytium_get_encoder_crtc_mask(struct phytium_dp_device *phytium_dp, int port) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/phytium/phytium_dp.c: In function 'phytium_connector_add_common_modes': >> drivers/gpu/drm/phytium/phytium_dp.c:300:17: warning: 'strncpy' output may be truncated copying 32 bytes from a string of length 439 [-Wstringop-truncation] 300 | strncpy(mode->name, common_mode[i].name, DRM_DISPLAY_MODE_LEN); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/strncpy +300 drivers/gpu/drm/phytium/phytium_dp.c 244 245 static int phytium_connector_add_common_modes(struct phytium_dp_device *phytium_dp) 246 { 247 int i = 0, ret = 0; 248 struct drm_device *dev = phytium_dp->dev; 249 struct drm_display_mode *mode = NULL, *current_mode = NULL; 250 struct drm_display_mode *native_mode = &phytium_dp->native_mode; 251 bool mode_existed = false; 252 struct mode_size { 253 char name[DRM_DISPLAY_MODE_LEN]; 254 int w; 255 int h; 256 } common_mode[] = { 257 { "640x480", 640, 480}, 258 { "800x600", 800, 600}, 259 { "1024x768", 1024, 768}, 260 { "1280x720", 1280, 720}, 261 { "1280x800", 1280, 800}, 262 {"1280x1024", 1280, 1024}, 263 { "1440x900", 1440, 900}, 264 {"1680x1050", 1680, 1050}, 265 {"1600x1200", 1600, 1200}, 266 {"1920x1080", 1920, 1080}, 267 {"1920x1200", 1920, 1200} 268 }; 269 270 if (native_mode->clock == 0) 271 return ret; 272 273 for (i = 0; i < ARRAY_SIZE(common_mode); i++) { 274 mode_existed = false; 275 276 if (common_mode[i].w > native_mode->hdisplay || 277 common_mode[i].h > native_mode->vdisplay || 278 (common_mode[i].w == native_mode->hdisplay && 279 common_mode[i].h == native_mode->vdisplay)) 280 continue; 281 282 list_for_each_entry(current_mode, &phytium_dp->connector.probed_modes, head) { 283 if (common_mode[i].w == current_mode->hdisplay && 284 common_mode[i].h == current_mode->vdisplay) { 285 mode_existed = true; 286 break; 287 } 288 } 289 290 if (mode_existed) 291 continue; 292 293 mode = drm_mode_duplicate(dev, native_mode); 294 if (mode == NULL) 295 continue; 296 297 mode->hdisplay = common_mode[i].w; 298 mode->vdisplay = common_mode[i].h; 299 mode->type &= ~DRM_MODE_TYPE_PREFERRED; > 300 strncpy(mode->name, common_mode[i].name, DRM_DISPLAY_MODE_LEN); 301 drm_mode_probed_add(&phytium_dp->connector, mode); 302 ret++; 303 } 304 305 return ret; 306 } 307 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] serial: core: Fix atomicity violation in uart_tiocmget
by Yi Yang 12 Nov '24

12 Nov '24

From: Gui-Dong Han <2045gemini(a)gmail.com> mainline inclusion from mainline-v6.8-rc3 commit 30926783a46841c2d1bbf3f74067ba85d304fd0d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB1MRY CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In uart_tiocmget(): result = uport->mctrl; uart_port_lock_irq(uport); result |= uport->ops->get_mctrl(uport); uart_port_unlock_irq(uport); ... return result; In uart_update_mctrl(): uart_port_lock_irqsave(port, &flags); ... port->mctrl = (old & ~clear) | set; ... port->ops->set_mctrl(port, port->mctrl); ... uart_port_unlock_irqrestore(port, flags); An atomicity violation is identified due to the concurrent execution of uart_tiocmget() and uart_update_mctrl(). After assigning result = uport->mctrl, the mctrl value may change in uart_update_mctrl(), leading to a mismatch between the value returned by uport->ops->get_mctrl(uport) and the mctrl value previously read. This can result in uart_tiocmget() returning an incorrect value. This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 5.17. To address this issue, it is suggested to move the line result = uport->mctrl inside the uart_port_lock block to ensure atomicity and prevent the mctrl value from being altered during the execution of uart_tiocmget(). With this patch applied, our tool no longer reports the bug, with the kernel configuration allyesconfig for x86_64. Due to the absence of the requisite hardware, we are unable to conduct runtime testing of the patch. Therefore, our verification is solely based on code logic analysis. [1] https://sites.google.com/view/basscheck/ Fixes: c5f4644e6c8b ("[PATCH] Serial: Adjust serial locking") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <2045gemini(a)gmail.com> Link: https://lore.kernel.org/r/20240112113624.17048-1-2045gemini@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/serial_core.c [Commit 559c7ff4e324("serial: core: Use port lock wrappers") not merged, no functional change.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 537bcd7c4941..d9d7506a9f6e 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -1078,8 +1078,8 @@ static int uart_tiocmget(struct tty_struct *tty) goto out; if (!tty_io_error(tty)) { - result = uport->mctrl; spin_lock_irq(&uport->lock); + result = uport->mctrl; result |= uport->ops->get_mctrl(uport); spin_unlock_irq(&uport->lock); } -- 2.25.1

2 1

[openeuler:OLK-5.10 2417/2417] vmlinux.o: warning: objtool: do_syscall_64()+0x8b: call to memset() leaves .noinstr.text section
by kernel test robot 12 Nov '24

12 Nov '24

Hi Kees, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 400fd9ccb52e01bf78acae2bbc1710923a15f033 commit: 130620d5878d2348208258965876547a69353f9f [2417/2417] x86/entry: Enable random_kstack_offset support config: x86_64-buildonly-randconfig-003-20241112 (https://download.01.org/0day-ci/archive/20241112/202411121519.FfuB626X-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241112/202411121519.FfuB626X-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411121519.FfuB626X-lkp@intel.com/ All warnings (new ones prefixed by >>): >> vmlinux.o: warning: objtool: do_syscall_64()+0x8b: call to memset() leaves .noinstr.text section vmlinux.o: warning: objtool: sync_regs()+0x1c: call to memcpy() leaves .noinstr.text section vmlinux.o: warning: objtool: fixup_bad_iret()+0x32: call to memset() leaves .noinstr.text section vmlinux.o: warning: objtool: mce_read_aux()+0x42: call to {dynamic}() leaves .noinstr.text section vmlinux.o: warning: objtool: do_machine_check()+0x13f: call to mce_no_way_out() leaves .noinstr.text section -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS v3] sched: smart_grid: Prevent double-free in sched_grid_qos_free
by Yipeng Zou 12 Nov '24

12 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3N2A ---------------------------------------- KASAN detected a double-free bug in the smart grid. This issue arises from the uninitialized use of p->grid_qos within the task {fork,free} processes. The sequence of events leading to the double-free is as follows: CPU0 CPU1 fork (in some error process) goto bad_fork_free call_rcu(__delayed_free_task) __delayed_free_task sched_grid_qos_free realse_task delayed_put_task_struct __put_task_struct sched_grid_qos_free(double free) When copy_process returns with an error, grid_qos is double-freed. To address this, grid_qos is initialized to NULL in dup_task_struct, and a NULL check is added for p->grid_qos before freeing. Bug report details: ================================================================== BUG: KASAN: double-free or invalid-free in sched_grid_qos_free+0x3c/0x90 CPU: 343 PID: 0 Comm: swapper/343 Kdump: loaded Tainted: G B E Call trace: dump_backtrace+0x0/0x3e0 show_stack+0x1c/0x28 dump_stack+0x13c/0x190 print_address_description.constprop.0+0x28/0x1f0 kasan_report_invalid_free+0x44/0x6c __kasan_slab_free+0x158/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __put_task_struct+0x264/0x31c delayed_put_task_struct+0x94/0x180 rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 irq_exit+0x2d4/0x35c __handle_domain_irq+0x108/0x1f0 gic_handle_irq+0x74/0x620 el1_irq+0xbc/0x140 arch_cpu_idle+0x14/0x3c default_idle_call+0x80/0x320 cpuidle_idle_call+0x244/0x2b0 do_idle+0x138/0x260 cpu_startup_entry+0x2c/0x70 secondary_start_kernel+0x35c/0x4e4 Allocated by task 44027: kasan_save_stack+0x24/0x50 __kasan_kmalloc.constprop.0+0xa0/0xcc kasan_kmalloc+0xc/0x14 kmem_cache_alloc_trace+0xdc/0x5d0 sched_grid_qos_fork+0x50/0x20c copy_process+0x8fc/0x3f60 kernel_clone+0x12c/0x660 __se_sys_clone+0xc0/0x110 __arm64_sys_clone+0xa8/0x110 invoke_syscall+0x70/0x274 el0_svc_common.constprop.0+0x1fc/0x2dc do_el0_svc+0xe8/0x140 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180 Freed by task 1748: kasan_save_stack+0x24/0x50 kasan_set_track+0x24/0x34 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0xf8/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __delayed_free_task+0x18/0x3c rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 Fixes: ce35ded5d577 ("sched: smart grid: init sched_grid_qos structure on QOS purpose") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/grid/qos.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/sched/grid/qos.c b/kernel/sched/grid/qos.c index b3df69d91499..bf9f7069c19a 100644 --- a/kernel/sched/grid/qos.c +++ b/kernel/sched/grid/qos.c @@ -68,6 +68,9 @@ int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) void sched_grid_qos_free(struct task_struct *p) { + if (!p->_resvd->grid_qos) + return; + kfree(p->_resvd->grid_qos); p->_resvd->grid_qos = NULL; } -- 2.34.1

2 1

[PATCH OLK-5.10] virtio_pmem: Check device status before requesting flush
by Jinjie Ruan 12 Nov '24

12 Nov '24

From: Philip Chen <philipchen(a)chromium.org> stable inclusion from stable-v5.10.227 commit 4ce662fe4be6fbc2595d9ef4888b2b6e778c99ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUI CVE: CVE-2024-50184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit e25fbcd97cf52c3c9824d44b5c56c19673c3dd50 ] If a pmem device is in a bad status, the driver side could wait for host ack forever in virtio_pmem_flush(), causing the system to hang. So add a status check in the beginning of virtio_pmem_flush() to return early if the device is not activated. Signed-off-by: Philip Chen <philipchen(a)chromium.org> Message-Id: <20240826215313.2673566-1-philipchen(a)chromium.org> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/nvdimm/nd_virtio.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index 10351d5b49fa..41e97c6567cf 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -44,6 +44,15 @@ static int virtio_pmem_flush(struct nd_region *nd_region) unsigned long flags; int err, err1; + /* + * Don't bother to submit the request to the device if the device is + * not activated. + */ + if (vdev->config->get_status(vdev) & VIRTIO_CONFIG_S_NEEDS_RESET) { + dev_info(&vdev->dev, "virtio pmem device needs a reset\n"); + return -EIO; + } + might_sleep(); req_data = kmalloc(sizeof(*req_data), GFP_KERNEL); if (!req_data) -- 2.34.1

2 1

[PATCH OLK-5.10] virtio_pmem: Check device status before requesting flush
by Jinjie Ruan 12 Nov '24

12 Nov '24

From: Philip Chen <philipchen(a)chromium.org> stable inclusion from stable-v5.10.227 commit 4ce662fe4be6fbc2595d9ef4888b2b6e778c99ed category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUI CVE: CVE-2024-50184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit e25fbcd97cf52c3c9824d44b5c56c19673c3dd50 ] If a pmem device is in a bad status, the driver side could wait for host ack forever in virtio_pmem_flush(), causing the system to hang. So add a status check in the beginning of virtio_pmem_flush() to return early if the device is not activated. Signed-off-by: Philip Chen <philipchen(a)chromium.org> Message-Id: <20240826215313.2673566-1-philipchen(a)chromium.org> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Pankaj Gupta <pankaj.gupta.linux(a)gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/nvdimm/nd_virtio.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index 10351d5b49fa..41e97c6567cf 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -44,6 +44,15 @@ static int virtio_pmem_flush(struct nd_region *nd_region) unsigned long flags; int err, err1; + /* + * Don't bother to submit the request to the device if the device is + * not activated. + */ + if (vdev->config->get_status(vdev) & VIRTIO_CONFIG_S_NEEDS_RESET) { + dev_info(&vdev->dev, "virtio pmem device needs a reset\n"); + return -EIO; + } + might_sleep(); req_data = kmalloc(sizeof(*req_data), GFP_KERNEL); if (!req_data) -- 2.34.1

2 1

[PATCH OLK-6.6 0/6] Script execution control
by Gu Bowen 12 Nov '24

12 Nov '24

Ensure that direct file execution (e.g. ./script.sh) and indirect file execution (e.g. sh script.sh) lead to the same result to support script protection. Gu Bowen (2): IMA support script execution check fix kabi breakage due to exec is_check Kees Cook (1): exec: Check __FMODE_EXEC instead of in_execve for LSMs Linus Torvalds (2): execve: open the executable file before doing anything else uselib: remove use of __FMODE_EXEC Mickaël Salaün (1): exec: Add a new AT_CHECK flag to execveat(2) V2: Add a new patch to fix kabi breakage. Align with the original variables to prevent others from inserting new variables before is_check in the future. V3: Add a mainline patch to fix commit 4759ff71f23e(exec: __FMODE_EXEC instead of in_execve for LSMs). fs/exec.c | 89 ++++++++++++++++++------------- include/linux/binfmts.h | 9 ++++ include/linux/ima.h | 1 + include/uapi/linux/fcntl.h | 31 +++++++++++ kernel/audit.h | 3 ++ kernel/auditsc.c | 1 + security/apparmor/lsm.c | 4 +- security/integrity/ima/ima_main.c | 11 ++++ security/security.c | 17 +++++- security/tomoyo/tomoyo.c | 3 +- 10 files changed, 129 insertions(+), 40 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS v2] sched: smart_grid: Prevent double-free in sched_grid_qos_free
by Yipeng Zou 12 Nov '24

12 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3N2A ---------------------------------------- KASAN detected a double-free bug in the smart grid. This issue arises from the uninitialized use of p->grid_qos within the task {fork,free} processes. The sequence of events leading to the double-free is as follows: CPU0 CPU1 fork (in some error process) goto bad_fork_free call_rcu(__delayed_free_task) __delayed_free_task sched_grid_qos_free realse_task delayed_put_task_struct __put_task_struct sched_grid_qos_free(double free) When copy_process returns with an error, grid_qos is double-freed. To address this, grid_qos is initialized to NULL in dup_task_struct, and a NULL check is added for p->grid_qos before freeing. Bug report details: ================================================================== BUG: KASAN: double-free or invalid-free in sched_grid_qos_free+0x3c/0x90 CPU: 343 PID: 0 Comm: swapper/343 Kdump: loaded Tainted: G B E Call trace: dump_backtrace+0x0/0x3e0 show_stack+0x1c/0x28 dump_stack+0x13c/0x190 print_address_description.constprop.0+0x28/0x1f0 kasan_report_invalid_free+0x44/0x6c __kasan_slab_free+0x158/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __put_task_struct+0x264/0x31c delayed_put_task_struct+0x94/0x180 rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 irq_exit+0x2d4/0x35c __handle_domain_irq+0x108/0x1f0 gic_handle_irq+0x74/0x620 el1_irq+0xbc/0x140 arch_cpu_idle+0x14/0x3c default_idle_call+0x80/0x320 cpuidle_idle_call+0x244/0x2b0 do_idle+0x138/0x260 cpu_startup_entry+0x2c/0x70 secondary_start_kernel+0x35c/0x4e4 Allocated by task 44027: kasan_save_stack+0x24/0x50 __kasan_kmalloc.constprop.0+0xa0/0xcc kasan_kmalloc+0xc/0x14 kmem_cache_alloc_trace+0xdc/0x5d0 sched_grid_qos_fork+0x50/0x20c copy_process+0x8fc/0x3f60 kernel_clone+0x12c/0x660 __se_sys_clone+0xc0/0x110 __arm64_sys_clone+0xa8/0x110 invoke_syscall+0x70/0x274 el0_svc_common.constprop.0+0x1fc/0x2dc do_el0_svc+0xe8/0x140 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180 Freed by task 1748: kasan_save_stack+0x24/0x50 kasan_set_track+0x24/0x34 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0xf8/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __delayed_free_task+0x18/0x3c rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 Fixes: ce35ded5d577 ("sched: smart grid: init sched_grid_qos structure on QOS purpose") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/fork.c | 4 ++++ kernel/sched/grid/qos.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c index 02b676d10054..54c9b8841e00 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -919,6 +919,10 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) tsk->se.dyn_affi_stats = NULL; #endif +#ifdef CONFIG_QOS_SCHED_SMART_GRID + tsk->grid_qos = NULL; +#endif + setup_thread_stack(tsk, orig); clear_user_return_notifier(tsk); clear_tsk_need_resched(tsk); diff --git a/kernel/sched/grid/qos.c b/kernel/sched/grid/qos.c index b3df69d91499..d6c8525fc16f 100644 --- a/kernel/sched/grid/qos.c +++ b/kernel/sched/grid/qos.c @@ -68,6 +68,9 @@ int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) void sched_grid_qos_free(struct task_struct *p) { + if (!p->grid_qos) + return; + kfree(p->_resvd->grid_qos); p->_resvd->grid_qos = NULL; } -- 2.34.1

2 1

[PATCH OLK-5.10] arm64: restore pc after fixup iff mcs failed in arm64_do_kernel_sea
by Wupeng Ma 12 Nov '24

12 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0OV7 -------------------------------- Commit 9fb439551cb4("arm64: send sig fault for user task when apei_claim_sea fails") try to restore regs->pc if apei_claim_sea failes. However this is needed for arm64_notify_die to dump the right stack before panic not for other scenarios and this may lead to memory errors be triggered repeatedly and cannot be handled correctly. Fix it. Fixes: 9fb439551cb4 ("arm64: send sig fault for user task when apei_claim_sea fails") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- arch/arm64/mm/fault.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 427b1152b008..b2996525b273 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -745,14 +745,19 @@ static bool arm64_do_kernel_sea(void __user *addr, unsigned int esr, return false; err = apei_claim_sea(regs); - if (err) { - regs->pc = orig_pc; - pr_emerg("apei claim sea failed. addr: %#lx, esr: %#x\n", - (unsigned long)addr, esr); - } + if (err) + pr_emerg( + "comm: %s pid: %d apei claim sea failed. addr: %#lx, esr: %#x\n", + current->comm, current->pid, (unsigned long)addr, esr); + + if (!current->mm) { + if (err) { + regs->pc = orig_pc; + return false; + } - if (!current->mm) - return err ? false : true; + return true; + } set_thread_esr(0, esr); arm64_force_sig_fault(sig, code, addr, -- 2.25.1

2 1

[PATCH OLK-6.6] drm/msm: Avoid NULL dereference in msm_disp_state_print_regs()
by Liu Mingrui 12 Nov '24

12 Nov '24

From: Douglas Anderson <dianders(a)chromium.org> mainline inclusion from mainline-v6.12-rc4 commit 293f53263266bc4340d777268ab4328a97f041fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2STZ CVE: CVE-2024-50156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If the allocation in msm_disp_state_dump_regs() failed then `block->state` can be NULL. The msm_disp_state_print_regs() function _does_ have code to try to handle it with: if (*reg) dump_addr = *reg; ...but since "dump_addr" is initialized to NULL the above is actually a noop. The code then goes on to dereference `dump_addr`. Make the function print "Registers not stored" when it sees a NULL to solve this. Since we're touching the code, fix msm_disp_state_print_regs() not to pointlessly take a double-pointer and properly mark the pointer as `const`. Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot") Signed-off-by: Douglas Anderson <dianders(a)chromium.org> Reviewed-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Patchwork: https://patchwork.freedesktop.org/patch/619657/ Link: https://lore.kernel.org/r/20241014093605.1.Ia1217cecec9ef09eb3c6d125360cc6c… Signed-off-by: Abhinav Kumar <quic_abhinavk(a)quicinc.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c index add72bbc28b1..bb149281d31f 100644 --- a/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c +++ b/drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c @@ -48,20 +48,21 @@ static void msm_disp_state_dump_regs(u32 **reg, u32 aligned_len, void __iomem *b } } -static void msm_disp_state_print_regs(u32 **reg, u32 len, void __iomem *base_addr, - struct drm_printer *p) +static void msm_disp_state_print_regs(const u32 *dump_addr, u32 len, + void __iomem *base_addr, struct drm_printer *p) { int i; - u32 *dump_addr = NULL; void __iomem *addr; u32 num_rows; + if (!dump_addr) { + drm_printf(p, "Registers not stored\n"); + return; + } + addr = base_addr; num_rows = len / REG_DUMP_ALIGN; - if (*reg) - dump_addr = *reg; - for (i = 0; i < num_rows; i++) { drm_printf(p, "0x%lx : %08x %08x %08x %08x\n", (unsigned long)(addr - base_addr), @@ -89,7 +90,7 @@ void msm_disp_state_print(struct msm_disp_state *state, struct drm_printer *p) list_for_each_entry_safe(block, tmp, &state->blocks, node) { drm_printf(p, "====================%s================\n", block->name); - msm_disp_state_print_regs(&block->state, block->size, block->base_addr, p); + msm_disp_state_print_regs(block->state, block->size, block->base_addr, p); } drm_printf(p, "===================dpu drm state================\n"); -- 2.25.1

2 1

[PATCH OLK-6.6 00/16] Add objtool, orc and livepatch support for LoongArch
by Tiezhu Yang 12 Nov '24

12 Nov '24

The patches come from the upstream mainline kernel, backport them to OLK-6.6 to support objtool, orc and livepatch on LoongArch. Huacai Chen (1): LoongArch: Update Loongson-3 default config file Jinyang He (1): LoongArch: Add kernel livepatching support Tiezhu Yang (13): objtool/LoongArch: Enable objtool to be built objtool/LoongArch: Implement instruction decoder objtool/x86: Separate arch-specific and generic parts objtool/LoongArch: Enable orc to be built objtool: Check local label in add_dead_ends() objtool: Check local label in read_unwind_hints() LoongArch: Add ORC stack unwinder support LoongArch: Fix definition of ftrace_regs_set_instruction_pointer() LoongArch: Add ifdefs to fix LSX and LASX related warnings objtool: Handle frame pointer related instructions LoongArch: Enable objtool for Clang LoongArch: Set AS_HAS_THIN_ADD_SUB as y if AS_IS_LLVM compiler.h: specify correct attribute for .rodata..c_jump_table Xi Ruoyao (1): LoongArch: Only allow OBJTOOL & ORC unwinder if toolchain supports -mthin-add-sub arch/loongarch/Kconfig | 10 + arch/loongarch/Kconfig.debug | 12 + arch/loongarch/Makefile | 23 +- arch/loongarch/configs/loongson3_defconfig | 3 + arch/loongarch/include/asm/Kbuild | 2 + arch/loongarch/include/asm/bug.h | 1 + arch/loongarch/include/asm/exception.h | 2 + arch/loongarch/include/asm/ftrace.h | 2 +- arch/loongarch/include/asm/livepatch.h | 15 + arch/loongarch/include/asm/module.h | 7 + arch/loongarch/include/asm/orc_header.h | 18 + arch/loongarch/include/asm/orc_lookup.h | 31 + arch/loongarch/include/asm/orc_types.h | 58 ++ arch/loongarch/include/asm/stackframe.h | 3 + arch/loongarch/include/asm/thread_info.h | 2 + arch/loongarch/include/asm/unwind.h | 20 +- arch/loongarch/include/asm/unwind_hints.h | 28 + arch/loongarch/kernel/Makefile | 4 + arch/loongarch/kernel/entry.S | 5 + arch/loongarch/kernel/fpu.S | 11 + arch/loongarch/kernel/genex.S | 6 + arch/loongarch/kernel/lbt.S | 3 + arch/loongarch/kernel/mcount_dyn.S | 6 + arch/loongarch/kernel/module.c | 22 +- arch/loongarch/kernel/relocate_kernel.S | 7 +- arch/loongarch/kernel/rethook_trampoline.S | 1 + arch/loongarch/kernel/setup.c | 2 + arch/loongarch/kernel/stacktrace.c | 41 ++ arch/loongarch/kernel/traps.c | 42 +- arch/loongarch/kernel/unwind_orc.c | 528 ++++++++++++++++++ arch/loongarch/kernel/vmlinux.lds.S | 3 + arch/loongarch/kvm/switch.S | 13 +- arch/loongarch/lib/clear_user.S | 3 + arch/loongarch/lib/copy_user.S | 3 + arch/loongarch/lib/memcpy.S | 3 + arch/loongarch/lib/memset.S | 3 + arch/loongarch/mm/tlb.c | 27 +- arch/loongarch/mm/tlbex.S | 9 + arch/loongarch/vdso/Makefile | 1 + include/linux/compiler.h | 11 +- scripts/Makefile | 7 +- tools/arch/loongarch/include/asm/inst.h | 161 ++++++ tools/arch/loongarch/include/asm/orc_types.h | 58 ++ tools/include/linux/bitops.h | 11 + tools/objtool/Makefile | 4 + tools/objtool/arch/loongarch/Build | 3 + tools/objtool/arch/loongarch/decode.c | 365 ++++++++++++ .../arch/loongarch/include/arch/cfi_regs.h | 22 + .../objtool/arch/loongarch/include/arch/elf.h | 30 + .../arch/loongarch/include/arch/special.h | 33 ++ tools/objtool/arch/loongarch/orc.c | 171 ++++++ tools/objtool/arch/loongarch/special.c | 15 + tools/objtool/arch/x86/Build | 1 + tools/objtool/arch/x86/orc.c | 188 +++++++ tools/objtool/check.c | 75 ++- tools/objtool/include/objtool/elf.h | 2 + tools/objtool/include/objtool/orc.h | 14 + tools/objtool/orc_dump.c | 69 +-- tools/objtool/orc_gen.c | 113 +--- 59 files changed, 2089 insertions(+), 244 deletions(-) create mode 100644 arch/loongarch/include/asm/livepatch.h create mode 100644 arch/loongarch/include/asm/orc_header.h create mode 100644 arch/loongarch/include/asm/orc_lookup.h create mode 100644 arch/loongarch/include/asm/orc_types.h create mode 100644 arch/loongarch/include/asm/unwind_hints.h create mode 100644 arch/loongarch/kernel/unwind_orc.c create mode 100644 tools/arch/loongarch/include/asm/inst.h create mode 100644 tools/arch/loongarch/include/asm/orc_types.h create mode 100644 tools/objtool/arch/loongarch/Build create mode 100644 tools/objtool/arch/loongarch/decode.c create mode 100644 tools/objtool/arch/loongarch/include/arch/cfi_regs.h create mode 100644 tools/objtool/arch/loongarch/include/arch/elf.h create mode 100644 tools/objtool/arch/loongarch/include/arch/special.h create mode 100644 tools/objtool/arch/loongarch/orc.c create mode 100644 tools/objtool/arch/loongarch/special.c create mode 100644 tools/objtool/arch/x86/orc.c create mode 100644 tools/objtool/include/objtool/orc.h -- 2.42.0

2 17

[PATCH OLK-6.6] bpf: Use raw_spinlock_t in ringbuf
by Xiaomeng Zhang 12 Nov '24

12 Nov '24

From: Wander Lairson Costa <wander.lairson(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 8b62645b09f870d70c7910e7550289d444239a46 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3I26 CVE: CVE-2024-50138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in the example below: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 INFO: lockdep is turned off. Preemption disabled at: [<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c CPU: 7 PID: 556208 Comm: test_progs Tainted: G Hardware name: Qualcomm SA8775P Ride (DT) Call trace: dump_backtrace+0xac/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0xac/0xe8 dump_stack+0x18/0x30 __might_resched+0x3bc/0x4fc rt_spin_lock+0x8c/0x1a4 __bpf_ringbuf_reserve+0xc4/0x254 bpf_ringbuf_reserve_dynptr+0x5c/0xdc bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238 trace_call_bpf+0x238/0x774 perf_call_bpf_enter.isra.0+0x104/0x194 perf_syscall_enter+0x2f8/0x510 trace_sys_enter+0x39c/0x564 syscall_trace_enter+0x220/0x3c0 do_el0_svc+0x138/0x1dc el0_svc+0x54/0x130 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Switch the spinlock to raw_spinlock_t to avoid this error. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Brian Grech <bgrech(a)redhat.com> Signed-off-by: Wander Lairson Costa <wander.lairson(a)gmail.com> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240920190700.617253-1-wander@redhat.com Conflicts: kernel/bpf/ringbuf.c [The conflicts were due to not merge the commits 457f44363a889] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/ringbuf.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index 238d9b206bbd..74796ab421a7 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -29,7 +29,7 @@ struct bpf_ringbuf { u64 mask; struct page **pages; int nr_pages; - spinlock_t spinlock ____cacheline_aligned_in_smp; + raw_spinlock_t spinlock ____cacheline_aligned_in_smp; /* For user-space producer ring buffers, an atomic_t busy bit is used * to synchronize access to the ring buffers in the kernel, rather than * the spinlock that is used for kernel-producer ring buffers. This is @@ -173,7 +173,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) if (!rb) return NULL; - spin_lock_init(&rb->spinlock); + raw_spin_lock_init(&rb->spinlock); atomic_set(&rb->busy, 0); init_waitqueue_head(&rb->waitq); init_irq_work(&rb->work, bpf_ringbuf_notify); @@ -421,10 +421,10 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) cons_pos = smp_load_acquire(&rb->consumer_pos); if (in_nmi()) { - if (!spin_trylock_irqsave(&rb->spinlock, flags)) + if (!raw_spin_trylock_irqsave(&rb->spinlock, flags)) return NULL; } else { - spin_lock_irqsave(&rb->spinlock, flags); + raw_spin_lock_irqsave(&rb->spinlock, flags); } pend_pos = rb->pending_pos; @@ -450,7 +450,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) */ if (new_prod_pos - cons_pos > rb->mask || new_prod_pos - pend_pos > rb->mask) { - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } @@ -462,7 +462,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) /* pairs with consumer's smp_load_acquire() */ smp_store_release(&rb->producer_pos, new_prod_pos); - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return (void *)hdr + BPF_RINGBUF_HDR_SZ; } -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Use raw_spinlock_t in ringbuf
by Xiaomeng Zhang 12 Nov '24

12 Nov '24

From: Wander Lairson Costa <wander.lairson(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 8b62645b09f870d70c7910e7550289d444239a46 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3I26 CVE: CVE-2024-50138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in the example below: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 INFO: lockdep is turned off. Preemption disabled at: [<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c CPU: 7 PID: 556208 Comm: test_progs Tainted: G Hardware name: Qualcomm SA8775P Ride (DT) Call trace: dump_backtrace+0xac/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0xac/0xe8 dump_stack+0x18/0x30 __might_resched+0x3bc/0x4fc rt_spin_lock+0x8c/0x1a4 __bpf_ringbuf_reserve+0xc4/0x254 bpf_ringbuf_reserve_dynptr+0x5c/0xdc bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238 trace_call_bpf+0x238/0x774 perf_call_bpf_enter.isra.0+0x104/0x194 perf_syscall_enter+0x2f8/0x510 trace_sys_enter+0x39c/0x564 syscall_trace_enter+0x220/0x3c0 do_el0_svc+0x138/0x1dc el0_svc+0x54/0x130 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Switch the spinlock to raw_spinlock_t to avoid this error. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Brian Grech <bgrech(a)redhat.com> Signed-off-by: Wander Lairson Costa <wander.lairson(a)gmail.com> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240920190700.617253-1-wander@redhat.com Conflicts: kernel/bpf/ringbuf.c [The conflicts were due to not merge the commits 457f44363a889] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/ringbuf.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index d21d4ba2eb39..984f4772a01e 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -36,7 +36,7 @@ struct bpf_ringbuf { u64 mask; struct page **pages; int nr_pages; - spinlock_t spinlock ____cacheline_aligned_in_smp; + raw_spinlock_t spinlock ____cacheline_aligned_in_smp; /* Consumer and producer counters are put into separate pages to allow * mapping consumer page as r/w, but restrict producer page to r/o. * This protects producer position from being modified by user-space @@ -139,7 +139,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) if (!rb) return ERR_PTR(-ENOMEM); - spin_lock_init(&rb->spinlock); + raw_spin_lock_init(&rb->spinlock); init_waitqueue_head(&rb->waitq); init_irq_work(&rb->work, bpf_ringbuf_notify); @@ -339,10 +339,10 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) cons_pos = smp_load_acquire(&rb->consumer_pos); if (in_nmi()) { - if (!spin_trylock_irqsave(&rb->spinlock, flags)) + if (!raw_spin_trylock_irqsave(&rb->spinlock, flags)) return NULL; } else { - spin_lock_irqsave(&rb->spinlock, flags); + raw_spin_lock_irqsave(&rb->spinlock, flags); } pend_pos = rb->pending_pos; @@ -368,7 +368,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) */ if (new_prod_pos - cons_pos > rb->mask || new_prod_pos - pend_pos > rb->mask) { - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } @@ -380,7 +380,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) /* pairs with consumer's smp_load_acquire() */ smp_store_release(&rb->producer_pos, new_prod_pos); - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return (void *)hdr + BPF_RINGBUF_HDR_SZ; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Use raw_spinlock_t in ringbuf
by Xiaomeng Zhang 12 Nov '24

12 Nov '24

From: Wander Lairson Costa <wander.lairson(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 8b62645b09f870d70c7910e7550289d444239a46 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3I26 CVE: CVE-2024-50138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in the example below: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 INFO: lockdep is turned off. Preemption disabled at: [<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c CPU: 7 PID: 556208 Comm: test_progs Tainted: G Hardware name: Qualcomm SA8775P Ride (DT) Call trace: dump_backtrace+0xac/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0xac/0xe8 dump_stack+0x18/0x30 __might_resched+0x3bc/0x4fc rt_spin_lock+0x8c/0x1a4 __bpf_ringbuf_reserve+0xc4/0x254 bpf_ringbuf_reserve_dynptr+0x5c/0xdc bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238 trace_call_bpf+0x238/0x774 perf_call_bpf_enter.isra.0+0x104/0x194 perf_syscall_enter+0x2f8/0x510 trace_sys_enter+0x39c/0x564 syscall_trace_enter+0x220/0x3c0 do_el0_svc+0x138/0x1dc el0_svc+0x54/0x130 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Switch the spinlock to raw_spinlock_t to avoid this error. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Brian Grech <bgrech(a)redhat.com> Signed-off-by: Wander Lairson Costa <wander.lairson(a)gmail.com> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240920190700.617253-1-wander@redhat.com Conflicts: kernel/bpf/ringbuf.c [The conflicts were due to not merge the commits 457f44363a889] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/ringbuf.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index d21d4ba2eb39..984f4772a01e 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -36,7 +36,7 @@ struct bpf_ringbuf { u64 mask; struct page **pages; int nr_pages; - spinlock_t spinlock ____cacheline_aligned_in_smp; + raw_spinlock_t spinlock ____cacheline_aligned_in_smp; /* Consumer and producer counters are put into separate pages to allow * mapping consumer page as r/w, but restrict producer page to r/o. * This protects producer position from being modified by user-space @@ -139,7 +139,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) if (!rb) return ERR_PTR(-ENOMEM); - spin_lock_init(&rb->spinlock); + raw_spin_lock_init(&rb->spinlock); init_waitqueue_head(&rb->waitq); init_irq_work(&rb->work, bpf_ringbuf_notify); @@ -339,10 +339,10 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) cons_pos = smp_load_acquire(&rb->consumer_pos); if (in_nmi()) { - if (!spin_trylock_irqsave(&rb->spinlock, flags)) + if (!raw_spin_trylock_irqsave(&rb->spinlock, flags)) return NULL; } else { - spin_lock_irqsave(&rb->spinlock, flags); + raw_spin_lock_irqsave(&rb->spinlock, flags); } pend_pos = rb->pending_pos; @@ -368,7 +368,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) */ if (new_prod_pos - cons_pos > rb->mask || new_prod_pos - pend_pos > rb->mask) { - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } @@ -380,7 +380,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) /* pairs with consumer's smp_load_acquire() */ smp_store_release(&rb->producer_pos, new_prod_pos); - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return (void *)hdr + BPF_RINGBUF_HDR_SZ; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Use raw_spinlock_t in ringbuf
by Xiaomeng Zhang 12 Nov '24

12 Nov '24

From: Wander Lairson Costa <wander.lairson(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 8b62645b09f870d70c7910e7550289d444239a46 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3I26 CVE: CVE-2024-50138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in the example below: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 INFO: lockdep is turned off. Preemption disabled at: [<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c CPU: 7 PID: 556208 Comm: test_progs Tainted: G Hardware name: Qualcomm SA8775P Ride (DT) Call trace: dump_backtrace+0xac/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0xac/0xe8 dump_stack+0x18/0x30 __might_resched+0x3bc/0x4fc rt_spin_lock+0x8c/0x1a4 __bpf_ringbuf_reserve+0xc4/0x254 bpf_ringbuf_reserve_dynptr+0x5c/0xdc bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238 trace_call_bpf+0x238/0x774 perf_call_bpf_enter.isra.0+0x104/0x194 perf_syscall_enter+0x2f8/0x510 trace_sys_enter+0x39c/0x564 syscall_trace_enter+0x220/0x3c0 do_el0_svc+0x138/0x1dc el0_svc+0x54/0x130 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Switch the spinlock to raw_spinlock_t to avoid this error. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Brian Grech <bgrech(a)redhat.com> Signed-off-by: Wander Lairson Costa <wander.lairson(a)gmail.com> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240920190700.617253-1-wander@redhat.com Conflicts: kernel/bpf/ringbuf.c [The conflicts were due to not merge the commits 457f44363a889] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/ringbuf.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index d21d4ba2eb39..984f4772a01e 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -36,7 +36,7 @@ struct bpf_ringbuf { u64 mask; struct page **pages; int nr_pages; - spinlock_t spinlock ____cacheline_aligned_in_smp; + raw_spinlock_t spinlock ____cacheline_aligned_in_smp; /* Consumer and producer counters are put into separate pages to allow * mapping consumer page as r/w, but restrict producer page to r/o. * This protects producer position from being modified by user-space @@ -139,7 +139,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) if (!rb) return ERR_PTR(-ENOMEM); - spin_lock_init(&rb->spinlock); + raw_spin_lock_init(&rb->spinlock); init_waitqueue_head(&rb->waitq); init_irq_work(&rb->work, bpf_ringbuf_notify); @@ -339,10 +339,10 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) cons_pos = smp_load_acquire(&rb->consumer_pos); if (in_nmi()) { - if (!spin_trylock_irqsave(&rb->spinlock, flags)) + if (!raw_spin_trylock_irqsave(&rb->spinlock, flags)) return NULL; } else { - spin_lock_irqsave(&rb->spinlock, flags); + raw_spin_lock_irqsave(&rb->spinlock, flags); } pend_pos = rb->pending_pos; @@ -368,7 +368,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) */ if (new_prod_pos - cons_pos > rb->mask || new_prod_pos - pend_pos > rb->mask) { - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } @@ -380,7 +380,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) /* pairs with consumer's smp_load_acquire() */ smp_store_release(&rb->producer_pos, new_prod_pos); - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return (void *)hdr + BPF_RINGBUF_HDR_SZ; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] bpf: Use raw_spinlock_t in ringbuf
by Xiaomeng Zhang 12 Nov '24

12 Nov '24

From: Wander Lairson Costa <wander.lairson(a)gmail.com> mainline inclusion from mainline-v6.12-rc4 commit 8b62645b09f870d70c7910e7550289d444239a46 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3I26 CVE: CVE-2024-50138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in the example below: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 556208, name: test_progs preempt_count: 1, expected: 0 RCU nest depth: 1, expected: 1 INFO: lockdep is turned off. Preemption disabled at: [<ffffd33a5c88ea44>] migrate_enable+0xc0/0x39c CPU: 7 PID: 556208 Comm: test_progs Tainted: G Hardware name: Qualcomm SA8775P Ride (DT) Call trace: dump_backtrace+0xac/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0xac/0xe8 dump_stack+0x18/0x30 __might_resched+0x3bc/0x4fc rt_spin_lock+0x8c/0x1a4 __bpf_ringbuf_reserve+0xc4/0x254 bpf_ringbuf_reserve_dynptr+0x5c/0xdc bpf_prog_ac3d15160d62622a_test_read_write+0x104/0x238 trace_call_bpf+0x238/0x774 perf_call_bpf_enter.isra.0+0x104/0x194 perf_syscall_enter+0x2f8/0x510 trace_sys_enter+0x39c/0x564 syscall_trace_enter+0x220/0x3c0 do_el0_svc+0x138/0x1dc el0_svc+0x54/0x130 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x17c/0x180 Switch the spinlock to raw_spinlock_t to avoid this error. Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: Brian Grech <bgrech(a)redhat.com> Signed-off-by: Wander Lairson Costa <wander.lairson(a)gmail.com> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20240920190700.617253-1-wander@redhat.com Conflicts: kernel/bpf/ringbuf.c [The conflicts were due to not merge the commits 457f44363a889] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/ringbuf.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index d21d4ba2eb39..984f4772a01e 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -36,7 +36,7 @@ struct bpf_ringbuf { u64 mask; struct page **pages; int nr_pages; - spinlock_t spinlock ____cacheline_aligned_in_smp; + raw_spinlock_t spinlock ____cacheline_aligned_in_smp; /* Consumer and producer counters are put into separate pages to allow * mapping consumer page as r/w, but restrict producer page to r/o. * This protects producer position from being modified by user-space @@ -139,7 +139,7 @@ static struct bpf_ringbuf *bpf_ringbuf_alloc(size_t data_sz, int numa_node) if (!rb) return ERR_PTR(-ENOMEM); - spin_lock_init(&rb->spinlock); + raw_spin_lock_init(&rb->spinlock); init_waitqueue_head(&rb->waitq); init_irq_work(&rb->work, bpf_ringbuf_notify); @@ -339,10 +339,10 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) cons_pos = smp_load_acquire(&rb->consumer_pos); if (in_nmi()) { - if (!spin_trylock_irqsave(&rb->spinlock, flags)) + if (!raw_spin_trylock_irqsave(&rb->spinlock, flags)) return NULL; } else { - spin_lock_irqsave(&rb->spinlock, flags); + raw_spin_lock_irqsave(&rb->spinlock, flags); } pend_pos = rb->pending_pos; @@ -368,7 +368,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) */ if (new_prod_pos - cons_pos > rb->mask || new_prod_pos - pend_pos > rb->mask) { - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return NULL; } @@ -380,7 +380,7 @@ static void *__bpf_ringbuf_reserve(struct bpf_ringbuf *rb, u64 size) /* pairs with consumer's smp_load_acquire() */ smp_store_release(&rb->producer_pos, new_prod_pos); - spin_unlock_irqrestore(&rb->spinlock, flags); + raw_spin_unlock_irqrestore(&rb->spinlock, flags); return (void *)hdr + BPF_RINGBUF_HDR_SZ; } -- 2.34.1

2 1

[PATCH v6 OLK-5.10 0/3] arm64: support page mapping percpu first chunk allocator
by Kaixiong Yu 12 Nov '24

12 Nov '24

Percpu embedded first chunk allocator is the firstly option, but it could fails on ARM64 when turning on numa with CONFIG_KASAN=y. Let's implement page mapping percpu first chunk allocator as a fallback to the embedding allocator to increase the robustness of the system. Also fix a crash when both NEED_PER_CPU_PAGE_FIRST_CHUNK and KASAN_VMALLOC enabled. After merging this patch set, the ARM64 machine can start and work normally. Kefeng Wang (3): vmalloc: choose a better start address in vm_area_register_early() arm64: support page mapping percpu first chunk allocator kasan: arm64: fix pcpu_page_first_chunk crash with KASAN_VMALLOC arch/arm64/Kconfig | 4 ++ arch/arm64/mm/kasan_init.c | 16 ++++++++ arch/arm64/mm/numa.c | 83 +++++++++++++++++++++++++++++++++----- include/linux/kasan.h | 10 ++++- mm/kasan/common.c | 5 +++ mm/vmalloc.c | 19 ++++++--- 6 files changed, 119 insertions(+), 18 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] sched: smart_grid: Prevent double-free in sched_grid_qos_free
by Yipeng Zou 12 Nov '24

12 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3N2A ---------------------------------------- KASAN detected a double-free bug in the smart grid. This issue arises from the uninitialized use of p->grid_qos within the task {fork,free} processes. The sequence of events leading to the double-free is as follows: CPU0 CPU1 fork (in some error process) goto bad_fork_free call_rcu(__delayed_free_task) __delayed_free_task sched_grid_qos_free realse_task delayed_put_task_struct __put_task_struct sched_grid_qos_free(double free) When copy_process returns with an error, grid_qos is double-freed. To address this, grid_qos is initialized to NULL in dup_task_struct, and a NULL check is added for p->grid_qos before freeing. Bug report details: ================================================================== BUG: KASAN: double-free or invalid-free in sched_grid_qos_free+0x3c/0x90 CPU: 343 PID: 0 Comm: swapper/343 Kdump: loaded Tainted: G B E Call trace: dump_backtrace+0x0/0x3e0 show_stack+0x1c/0x28 dump_stack+0x13c/0x190 print_address_description.constprop.0+0x28/0x1f0 kasan_report_invalid_free+0x44/0x6c __kasan_slab_free+0x158/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __put_task_struct+0x264/0x31c delayed_put_task_struct+0x94/0x180 rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 irq_exit+0x2d4/0x35c __handle_domain_irq+0x108/0x1f0 gic_handle_irq+0x74/0x620 el1_irq+0xbc/0x140 arch_cpu_idle+0x14/0x3c default_idle_call+0x80/0x320 cpuidle_idle_call+0x244/0x2b0 do_idle+0x138/0x260 cpu_startup_entry+0x2c/0x70 secondary_start_kernel+0x35c/0x4e4 Allocated by task 44027: kasan_save_stack+0x24/0x50 __kasan_kmalloc.constprop.0+0xa0/0xcc kasan_kmalloc+0xc/0x14 kmem_cache_alloc_trace+0xdc/0x5d0 sched_grid_qos_fork+0x50/0x20c copy_process+0x8fc/0x3f60 kernel_clone+0x12c/0x660 __se_sys_clone+0xc0/0x110 __arm64_sys_clone+0xa8/0x110 invoke_syscall+0x70/0x274 el0_svc_common.constprop.0+0x1fc/0x2dc do_el0_svc+0xe8/0x140 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180 Freed by task 1748: kasan_save_stack+0x24/0x50 kasan_set_track+0x24/0x34 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0xf8/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __delayed_free_task+0x18/0x3c rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 Fixes: 700bfc4068cf ("sched: smart grid: init sched_grid_qos structure on QOS purpose") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/fork.c | 4 ++++ kernel/sched/grid/qos.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c index dcf1f9c655d8..9b1ea79deaa5 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -953,6 +953,10 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) tsk->prefer_cpus = NULL; #endif +#ifdef CONFIG_QOS_SCHED_SMART_GRID + tsk->grid_qos = NULL; +#endif + #ifdef CONFIG_SCHED_TASK_RELATIONSHIP tsk->rship = NULL; #endif diff --git a/kernel/sched/grid/qos.c b/kernel/sched/grid/qos.c index 7ee3687347ce..60b1ff843bbb 100644 --- a/kernel/sched/grid/qos.c +++ b/kernel/sched/grid/qos.c @@ -70,6 +70,9 @@ int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) void sched_grid_qos_free(struct task_struct *p) { + if (!p->grid_qos) + return; + kfree(p->grid_qos); p->grid_qos = NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6] sched: smart_grid: Prevent double-free in sched_grid_qos_free
by Yipeng Zou 12 Nov '24

12 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3N2A ---------------------------------------- KASAN detected a double-free bug in the smart grid. This issue arises from the uninitialized use of p->grid_qos within the task {fork,free} processes. The sequence of events leading to the double-free is as follows: CPU0 CPU1 fork (in some error process) goto bad_fork_free call_rcu(__delayed_free_task) __delayed_free_task sched_grid_qos_free realse_task delayed_put_task_struct __put_task_struct sched_grid_qos_free(double free) When copy_process returns with an error, grid_qos is double-freed. To address this, grid_qos is initialized to NULL in dup_task_struct, and a NULL check is added for p->grid_qos before freeing. Bug report details: ================================================================== BUG: KASAN: double-free or invalid-free in sched_grid_qos_free+0x3c/0x90 CPU: 343 PID: 0 Comm: swapper/343 Kdump: loaded Tainted: G B E Call trace: dump_backtrace+0x0/0x3e0 show_stack+0x1c/0x28 dump_stack+0x13c/0x190 print_address_description.constprop.0+0x28/0x1f0 kasan_report_invalid_free+0x44/0x6c __kasan_slab_free+0x158/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __put_task_struct+0x264/0x31c delayed_put_task_struct+0x94/0x180 rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 irq_exit+0x2d4/0x35c __handle_domain_irq+0x108/0x1f0 gic_handle_irq+0x74/0x620 el1_irq+0xbc/0x140 arch_cpu_idle+0x14/0x3c default_idle_call+0x80/0x320 cpuidle_idle_call+0x244/0x2b0 do_idle+0x138/0x260 cpu_startup_entry+0x2c/0x70 secondary_start_kernel+0x35c/0x4e4 Allocated by task 44027: kasan_save_stack+0x24/0x50 __kasan_kmalloc.constprop.0+0xa0/0xcc kasan_kmalloc+0xc/0x14 kmem_cache_alloc_trace+0xdc/0x5d0 sched_grid_qos_fork+0x50/0x20c copy_process+0x8fc/0x3f60 kernel_clone+0x12c/0x660 __se_sys_clone+0xc0/0x110 __arm64_sys_clone+0xa8/0x110 invoke_syscall+0x70/0x274 el0_svc_common.constprop.0+0x1fc/0x2dc do_el0_svc+0xe8/0x140 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180 Freed by task 1748: kasan_save_stack+0x24/0x50 kasan_set_track+0x24/0x34 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0xf8/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __delayed_free_task+0x18/0x3c rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 Fixes: 1a553561230a ("sched: smart grid: init sched_grid_qos structure on QOS purpose") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/fork.c | 4 ++++ kernel/sched/grid/qos.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c index 97a89ab68a26..a8a30a21799a 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1192,6 +1192,10 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) tsk->prefer_cpus = NULL; #endif +#ifdef CONFIG_QOS_SCHED_SMART_GRID + tsk->grid_qos = NULL; +#endif + setup_thread_stack(tsk, orig); clear_user_return_notifier(tsk); clear_tsk_need_resched(tsk); diff --git a/kernel/sched/grid/qos.c b/kernel/sched/grid/qos.c index 7c4cb867b60b..e1504170cc6c 100644 --- a/kernel/sched/grid/qos.c +++ b/kernel/sched/grid/qos.c @@ -71,6 +71,9 @@ int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) void sched_grid_qos_free(struct task_struct *p) { + if (!p->grid_qos) + return; + kfree(p->grid_qos); p->grid_qos = NULL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sched: smart_grid: Prevent double-free in sched_grid_qos_free
by Yipeng Zou 12 Nov '24

12 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB3N2A ---------------------------------------- KASAN detected a double-free bug in the smart grid. This issue arises from the uninitialized use of p->grid_qos within the task {fork,free} processes. The sequence of events leading to the double-free is as follows: CPU0 CPU1 fork (in some error process) goto bad_fork_free call_rcu(__delayed_free_task) __delayed_free_task sched_grid_qos_free realse_task delayed_put_task_struct __put_task_struct sched_grid_qos_free(double free) When copy_process returns with an error, grid_qos is double-freed. To address this, grid_qos is initialized to NULL in dup_task_struct, and a NULL check is added for p->grid_qos before freeing. Bug report details: ================================================================== BUG: KASAN: double-free or invalid-free in sched_grid_qos_free+0x3c/0x90 CPU: 343 PID: 0 Comm: swapper/343 Kdump: loaded Tainted: G B E Call trace: dump_backtrace+0x0/0x3e0 show_stack+0x1c/0x28 dump_stack+0x13c/0x190 print_address_description.constprop.0+0x28/0x1f0 kasan_report_invalid_free+0x44/0x6c __kasan_slab_free+0x158/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __put_task_struct+0x264/0x31c delayed_put_task_struct+0x94/0x180 rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 irq_exit+0x2d4/0x35c __handle_domain_irq+0x108/0x1f0 gic_handle_irq+0x74/0x620 el1_irq+0xbc/0x140 arch_cpu_idle+0x14/0x3c default_idle_call+0x80/0x320 cpuidle_idle_call+0x244/0x2b0 do_idle+0x138/0x260 cpu_startup_entry+0x2c/0x70 secondary_start_kernel+0x35c/0x4e4 Allocated by task 44027: kasan_save_stack+0x24/0x50 __kasan_kmalloc.constprop.0+0xa0/0xcc kasan_kmalloc+0xc/0x14 kmem_cache_alloc_trace+0xdc/0x5d0 sched_grid_qos_fork+0x50/0x20c copy_process+0x8fc/0x3f60 kernel_clone+0x12c/0x660 __se_sys_clone+0xc0/0x110 __arm64_sys_clone+0xa8/0x110 invoke_syscall+0x70/0x274 el0_svc_common.constprop.0+0x1fc/0x2dc do_el0_svc+0xe8/0x140 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180 Freed by task 1748: kasan_save_stack+0x24/0x50 kasan_set_track+0x24/0x34 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0xf8/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __delayed_free_task+0x18/0x3c rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 Fixes: ce35ded5d577 ("sched: smart grid: init sched_grid_qos structure on QOS purpose") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/fork.c | 4 ++++ kernel/sched/grid/qos.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c index 02b676d10054..54c9b8841e00 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -919,6 +919,10 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) tsk->se.dyn_affi_stats = NULL; #endif +#ifdef CONFIG_QOS_SCHED_SMART_GRID + tsk->grid_qos = NULL; +#endif + setup_thread_stack(tsk, orig); clear_user_return_notifier(tsk); clear_tsk_need_resched(tsk); diff --git a/kernel/sched/grid/qos.c b/kernel/sched/grid/qos.c index b3df69d91499..d6c8525fc16f 100644 --- a/kernel/sched/grid/qos.c +++ b/kernel/sched/grid/qos.c @@ -68,6 +68,9 @@ int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) void sched_grid_qos_free(struct task_struct *p) { + if (!p->grid_qos) + return; + kfree(p->_resvd->grid_qos); p->_resvd->grid_qos = NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6] sched: smart_grid: Prevent double-free in sched_grid_qos_free
by Yipeng Zou 12 Nov '24

12 Nov '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8WMOG CVE: NA ---------------------------------------- KASAN detected a double-free bug in the smart grid. This issue arises from the uninitialized use of p->grid_qos within the task {fork,free} processes. The sequence of events leading to the double-free is as follows: CPU0 CPU1 fork (in some error process) goto bad_fork_free call_rcu(__delayed_free_task) __delayed_free_task sched_grid_qos_free realse_task delayed_put_task_struct __put_task_struct sched_grid_qos_free(double free) When copy_process returns with an error, grid_qos is double-freed. To address this, grid_qos is initialized to NULL in dup_task_struct, and a NULL check is added for p->grid_qos before freeing. Bug report details: ================================================================== BUG: KASAN: double-free or invalid-free in sched_grid_qos_free+0x3c/0x90 CPU: 343 PID: 0 Comm: swapper/343 Kdump: loaded Tainted: G B E Call trace: dump_backtrace+0x0/0x3e0 show_stack+0x1c/0x28 dump_stack+0x13c/0x190 print_address_description.constprop.0+0x28/0x1f0 kasan_report_invalid_free+0x44/0x6c __kasan_slab_free+0x158/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __put_task_struct+0x264/0x31c delayed_put_task_struct+0x94/0x180 rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 irq_exit+0x2d4/0x35c __handle_domain_irq+0x108/0x1f0 gic_handle_irq+0x74/0x620 el1_irq+0xbc/0x140 arch_cpu_idle+0x14/0x3c default_idle_call+0x80/0x320 cpuidle_idle_call+0x244/0x2b0 do_idle+0x138/0x260 cpu_startup_entry+0x2c/0x70 secondary_start_kernel+0x35c/0x4e4 Allocated by task 44027: kasan_save_stack+0x24/0x50 __kasan_kmalloc.constprop.0+0xa0/0xcc kasan_kmalloc+0xc/0x14 kmem_cache_alloc_trace+0xdc/0x5d0 sched_grid_qos_fork+0x50/0x20c copy_process+0x8fc/0x3f60 kernel_clone+0x12c/0x660 __se_sys_clone+0xc0/0x110 __arm64_sys_clone+0xa8/0x110 invoke_syscall+0x70/0x274 el0_svc_common.constprop.0+0x1fc/0x2dc do_el0_svc+0xe8/0x140 el0_svc+0x1c/0x2c el0_sync_handler+0xb0/0xb4 el0_sync+0x168/0x180 Freed by task 1748: kasan_save_stack+0x24/0x50 kasan_set_track+0x24/0x34 kasan_set_free_info+0x24/0x4c __kasan_slab_free+0xf8/0x180 kasan_slab_free+0x10/0x20 kfree+0xe0/0x6e0 sched_grid_qos_free+0x3c/0x90 free_task+0xc4/0x164 __delayed_free_task+0x18/0x3c rcu_do_batch+0x2ec/0x9f0 rcu_core+0x34c/0x530 rcu_core_si+0x14/0x30 __do_softirq+0x284/0x900 Fixes: 1a553561230a ("sched: smart grid: init sched_grid_qos structure on QOS purpose") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/fork.c | 4 ++++ kernel/sched/grid/qos.c | 3 +++ 2 files changed, 7 insertions(+) diff --git a/kernel/fork.c b/kernel/fork.c index 97a89ab68a26..a8a30a21799a 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1192,6 +1192,10 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) tsk->prefer_cpus = NULL; #endif +#ifdef CONFIG_QOS_SCHED_SMART_GRID + tsk->grid_qos = NULL; +#endif + setup_thread_stack(tsk, orig); clear_user_return_notifier(tsk); clear_tsk_need_resched(tsk); diff --git a/kernel/sched/grid/qos.c b/kernel/sched/grid/qos.c index 7c4cb867b60b..e1504170cc6c 100644 --- a/kernel/sched/grid/qos.c +++ b/kernel/sched/grid/qos.c @@ -71,6 +71,9 @@ int sched_grid_qos_fork(struct task_struct *p, struct task_struct *orig) void sched_grid_qos_free(struct task_struct *p) { + if (!p->grid_qos) + return; + kfree(p->grid_qos); p->grid_qos = NULL; } -- 2.34.1

2 1