- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
by Baogen Shang 15 May '24

15 May '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v5.10.214 commit 330caa061af53ea6d287d7c43d0703714e510e08 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit 9ccfe80d022df7c595f1925afb31de2232900656 ] The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875) Fixes: ddef02de0d71 ("drm/amd/display: add null checks before logging") Cc: Wyatt Wood <wyatt.wood(a)amd.com> Cc: Anthony Koo <Anthony.Koo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Anthony Koo <Anthony.Koo(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c index 1c669f115dd8..8cf6e307ae36 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c @@ -1669,6 +1669,9 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx, { struct dpp *dpp = pipe_ctx->plane_res.dpp; + if (!stream) + return false; + if (dpp == NULL) return false; @@ -1691,8 +1694,8 @@ bool dcn10_set_output_transfer_func(struct dc *dc, struct pipe_ctx *pipe_ctx, } else dpp->funcs->dpp_program_regamma_pwl(dpp, NULL, OPP_REGAMMA_BYPASS); - if (stream != NULL && stream->ctx != NULL && - stream->out_transfer_func != NULL) { + if (stream->ctx && + stream->out_transfer_func) { log_tf(stream->ctx, stream->out_transfer_func, dpp->regamma_params.hw_points_num); -- 2.33.0

1 0

[PATCH OLK-5.10] drm/amd/display: Fix memory leak in dm_sw_fini()
by Baogen Shang 15 May '24

15 May '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v5.10.211 commit b49b022f7dfce85eb77d0d987008fde5c01d7857 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9J6AL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… ------------------------- [ Upstream commit bae67893578d608e35691dcdfa90c4957debf1d3 ] After destroying dmub_srv, the memory associated with it is not freed, causing a memory leak: unreferenced object 0xffff896302b45800 (size 1024): comm "(udev-worker)", pid 222, jiffies 4294894636 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 6265fd77): [<ffffffff993495ed>] kmalloc_trace+0x29d/0x340 [<ffffffffc0ea4a94>] dm_dmub_sw_init+0xb4/0x450 [amdgpu] [<ffffffffc0ea4e55>] dm_sw_init+0x15/0x2b0 [amdgpu] [<ffffffffc0ba8557>] amdgpu_device_init+0x1417/0x24e0 [amdgpu] [<ffffffffc0bab285>] amdgpu_driver_load_kms+0x15/0x190 [amdgpu] [<ffffffffc0ba09c7>] amdgpu_pci_probe+0x187/0x4e0 [amdgpu] [<ffffffff9968fd1e>] local_pci_probe+0x3e/0x90 [<ffffffff996918a3>] pci_device_probe+0xc3/0x230 [<ffffffff99805872>] really_probe+0xe2/0x480 [<ffffffff99805c98>] __driver_probe_device+0x78/0x160 [<ffffffff99805daf>] driver_probe_device+0x1f/0x90 [<ffffffff9980601e>] __driver_attach+0xce/0x1c0 [<ffffffff99803170>] bus_for_each_dev+0x70/0xc0 [<ffffffff99804822>] bus_add_driver+0x112/0x210 [<ffffffff99807245>] driver_register+0x55/0x100 [<ffffffff990012d1>] do_one_initcall+0x41/0x300 Fix this by freeing dmub_srv after destroying it. Fixes: 743b9786b14a ("drm/amd/display: Hook up the DMUB service in DM") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Baogen Shang <baogen.shang(a)windriver.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 54d6b4128721..3578e3b3536e 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -1456,6 +1456,7 @@ static int dm_sw_fini(void *handle) if (adev->dm.dmub_srv) { dmub_srv_destroy(adev->dm.dmub_srv); + kfree(adev->dm.dmub_srv); adev->dm.dmub_srv = NULL; } -- 2.33.0

1 0

[PATCH OLK-5.10] smart_grid: introducing rebuild_affinity_domain
by Yipeng Zou 15 May '24

15 May '24

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9OJK9 CVE: NA ---------------------------------------- Here are many scenarios we tested with smart_grid, we found that the first domain level is key to the benchmark. The reason is that there are many things such as interrupt affinity, memory affinity factor that can have a big impact on the test. Before this patch, the first domain level is unchangeable after creation. This patch introduce the 'cpu.rebuild_affinity_domain' to dynamically reconfigure all domain levels. Typical use cases: echo $cpu_id > cpu.rebuild_affinity_domain The cpu_id means which cpu we want to set first level. If we set cpu_id = 34, we can see some change like: ---------------- ----------------- | level 0 (0-31) | | level 0 (32-63) | ---------------- ----------------- v v ------------------- ------------------ | level 1 (0-63) | | level 1 (0-63) | ------------------- ------------------ v --> v --------------------- -------------------- | level 2 (0-95) | | level 2 (0-95) | --------------------- -------------------- v v ------------------------ ---------------------- | level 3 (0-127) | | level 3 (0-127) | ------------------------ ---------------------- There are number of constraints on the rebuild feature: 1. Only rebuild domain while auto mode disabled. (cpu.dynamic_affinity_mode == 1) 2. Only rebuild on active and housekeeping cpu. (Offline and isolate CPUs are forbidden) 3. This file is write only. Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/core.c | 13 +++++++++++++ kernel/sched/fair.c | 43 +++++++++++++++++++++++++++++++++++++++++++ kernel/sched/sched.h | 1 + 3 files changed, 57 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index fa71c7c51196..77dc6e0e3f8b 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9690,6 +9690,15 @@ static int cpu_affinity_stat_show(struct seq_file *sf, void *v) return 0; } + +static int cpu_rebuild_affinity_domain_u64(struct cgroup_subsys_state *css, + struct cftype *cftype, + u64 cpu) +{ + struct task_group *tg = css_tg(css); + + return tg_rebuild_affinity_domains(cpu, tg->auto_affinity); +} #endif /* CONFIG_QOS_SCHED_SMART_GRID */ #ifdef CONFIG_QOS_SCHED @@ -9873,6 +9882,10 @@ static struct cftype cpu_legacy_files[] = { .name = "affinity_stat", .seq_show = cpu_affinity_stat_show, }, + { + .name = "rebuild_affinity_domain", + .write_u64 = cpu_rebuild_affinity_domain_u64, + }, #endif #ifdef CONFIG_CFS_BANDWIDTH { diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index f39e7547523c..1458878f5464 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -6242,6 +6242,49 @@ static void destroy_auto_affinity(struct task_group *tg) kfree(tg->auto_affinity); tg->auto_affinity = NULL; } + +int tg_rebuild_affinity_domains(int cpu, struct auto_affinity *auto_affi) +{ + int ret = 0; + int level = 0; + struct sched_domain *tmp; + + if (unlikely(!auto_affi)) + return -EPERM; + + mutex_lock(&smart_grid_used_mutex); + raw_spin_lock_irq(&auto_affi->lock); + /* Only build domain while auto mode disabled */ + if (auto_affi->mode) { + ret = -EPERM; + goto unlock_all; + } + + /* Only build on active and housekeeping cpu */ + if (!cpu_active(cpu) || !housekeeping_cpu(cpu, HK_FLAG_DOMAIN)) { + ret = -EINVAL; + goto unlock_all; + } + + for_each_domain(cpu, tmp) { + if (!auto_affi->ad.domains[level] || !auto_affi->ad.domains_orig[level]) + continue; + + /* rebuild domain[,_orig] and reset schedstat counter */ + cpumask_copy(auto_affi->ad.domains[level], sched_domain_span(tmp)); + cpumask_copy(auto_affi->ad.domains_orig[level], auto_affi->ad.domains[level]); + __schedstat_set(auto_affi->ad.stay_cnt[level], 0); + level++; + } + + /* trigger to update smart grid zone */ + sched_grid_zone_update(false); + +unlock_all: + raw_spin_unlock_irq(&auto_affi->lock); + mutex_unlock(&smart_grid_used_mutex); + return ret; +} #else static void destroy_auto_affinity(struct task_group *tg) {} diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index e6f934af7062..e10f65a7f87f 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -580,6 +580,7 @@ extern void start_auto_affinity(struct auto_affinity *auto_affi); extern void stop_auto_affinity(struct auto_affinity *auto_affi); extern int init_auto_affinity(struct task_group *tg); extern void tg_update_affinity_domains(int cpu, int online); +extern int tg_rebuild_affinity_domains(int cpu, struct auto_affinity *auto_affi); #else static inline int init_auto_affinity(struct task_group *tg) -- 2.34.1

2 1

[PATCH OLK-5.10 v2] scsi: sr: Do not leak information in ioctl
by Li Lingfeng 15 May '24

15 May '24

From: Tom Rix <trix(a)redhat.com> mainline inclusion from mainline-v5.18-rc4 commit faad6cebded8e0fd902b672f220449b93db479eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sr_ioctl.c uses this pattern: result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally, initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel. Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Tom Rix <trix(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/sr_ioctl.c [Commit aaff5ebaa269 ("scsi: remove the unchecked_isa_dma flag") remove the unchecked_isa_dma flag] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- v1->v2: Correct commit message. drivers/scsi/sr_ioctl.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index 4c1de11e69fb..0808217f2d7b 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -45,7 +45,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -59,10 +59,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk1 = buffer[3]; +err: kfree(buffer); return result; } @@ -75,7 +78,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -90,6 +93,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_adr = buffer[5] >> 4; @@ -102,6 +107,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11]; +err: kfree(buffer); return result; } @@ -388,7 +394,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) { Scsi_CD *cd = cdi->handle; struct packet_command cgc; - char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); int result; if (!buffer) @@ -404,10 +410,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) cgc.data_direction = DMA_FROM_DEVICE; cgc.timeout = IOCTL_TIMEOUT; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] = 0; +err: kfree(buffer); return result; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS v2] scsi: sr: Do not leak information in ioctl
by Li Lingfeng 15 May '24

15 May '24

From: Tom Rix <trix(a)redhat.com> mainline inclusion from mainline-v5.18-rc4 commit faad6cebded8e0fd902b672f220449b93db479eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sr_ioctl.c uses this pattern: result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally, initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel. Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Tom Rix <trix(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/sr_ioctl.c [Commit aaff5ebaa269 ("scsi: remove the unchecked_isa_dma flag") remove the unchecked_isa_dma flag] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- v1->v2: Correct commit message. drivers/scsi/sr_ioctl.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index 335cfdde0cf0..85ed1c6be6ce 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -45,7 +45,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -59,10 +59,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk1 = buffer[3]; +err: kfree(buffer); return result; } @@ -75,7 +78,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -90,6 +93,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_adr = buffer[5] >> 4; @@ -102,6 +107,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11]; +err: kfree(buffer); return result; } @@ -389,7 +395,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) { Scsi_CD *cd = cdi->handle; struct packet_command cgc; - char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); int result; if (!buffer) @@ -405,10 +411,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) cgc.data_direction = DMA_FROM_DEVICE; cgc.timeout = IOCTL_TIMEOUT; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] = 0; +err: kfree(buffer); return result; } -- 2.31.1

2 1

[PATCH OLK-6.6] mm: prepare to support weighted interleaving mempolicy
by Ze Zuo 15 May '24

15 May '24

hulk inclusion category: feature https://gitee.com/openeuler/kernel/issues/I9PD4G ---------------------------------------------------------------------- To support weighted interleaving mempolicy, we need to round up two series of patch sets, patch set one is "mempolicy: cleanups leading to NUMA mpol without vma" and patch set two is "mm/mempolicy: weighted interleave mempolicy and sysfs extension", however, where commit ddc1a5cbc05d ("mempolicy: alloc_pages_mpol() for NUMA policy without vma") for patch set one and commit fa3bea4e1f82 ("mm/mempolicy: introduce MPOL_ WEIGHTED_INTERLEAVE for weighted interleaving") will see kabi changes for whitelisted structures, for which the KABI field needs to be reserved in advance for the mempolicy's relevant data structures. Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- fs/kernfs/file.c | 4 ++-- include/linux/mm.h | 2 +- include/linux/sched.h | 1 + include/uapi/linux/mempolicy.h | 1 + ipc/shm.c | 4 ++-- mm/mempolicy.c | 6 +++--- mm/shmem.c | 2 +- 7 files changed, 11 insertions(+), 9 deletions(-) diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c index 1cbf9a44422e..4df293c645e1 100644 --- a/fs/kernfs/file.c +++ b/fs/kernfs/file.c @@ -456,7 +456,7 @@ static int kernfs_vma_set_policy(struct vm_area_struct *vma, } static struct mempolicy *kernfs_vma_get_policy(struct vm_area_struct *vma, - unsigned long addr) + unsigned long addr, pgoff_t *ilx) { struct file *file = vma->vm_file; struct kernfs_open_file *of = kernfs_of(file); @@ -470,7 +470,7 @@ static struct mempolicy *kernfs_vma_get_policy(struct vm_area_struct *vma, pol = vma->vm_policy; if (of->vm_ops->get_policy) - pol = of->vm_ops->get_policy(vma, addr); + pol = of->vm_ops->get_policy(vma, addr, NULL); kernfs_put_active(of->kn); return pol; diff --git a/include/linux/mm.h b/include/linux/mm.h index f86fd573a4a1..49f4fac2dcf7 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -640,7 +640,7 @@ struct vm_operations_struct { * policy. */ struct mempolicy *(*get_policy)(struct vm_area_struct *vma, - unsigned long addr); + unsigned long addr, pgoff_t *ilx); #endif /* * Called by vm_normal_page() for special PTEs to find the diff --git a/include/linux/sched.h b/include/linux/sched.h index b65d74c5e765..f40411aa7b70 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1285,6 +1285,7 @@ struct task_struct { /* Protected by alloc_lock: */ struct mempolicy *mempolicy; short il_prev; + u8 il_weight; short pref_node_fork; #endif #ifdef CONFIG_NUMA_BALANCING diff --git a/include/uapi/linux/mempolicy.h b/include/uapi/linux/mempolicy.h index 046d0ccba4cd..8494de333376 100644 --- a/include/uapi/linux/mempolicy.h +++ b/include/uapi/linux/mempolicy.h @@ -23,6 +23,7 @@ enum { MPOL_INTERLEAVE, MPOL_LOCAL, MPOL_PREFERRED_MANY, + MPOL_WEIGHTED_INTERLEAVE, MPOL_MAX, /* always last member of enum */ }; diff --git a/ipc/shm.c b/ipc/shm.c index 576a543b7cff..0a02bc6d7cdf 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -574,14 +574,14 @@ static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new) } static struct mempolicy *shm_get_policy(struct vm_area_struct *vma, - unsigned long addr) + unsigned long addr, pgoff_t *ilx) { struct file *file = vma->vm_file; struct shm_file_data *sfd = shm_file_data(file); struct mempolicy *pol = NULL; if (sfd->vm_ops->get_policy) - pol = sfd->vm_ops->get_policy(vma, addr); + pol = sfd->vm_ops->get_policy(vma, addr, NULL); else if (vma->vm_policy) pol = vma->vm_policy; diff --git a/mm/mempolicy.c b/mm/mempolicy.c index a80f99751904..17aadb5ca5f7 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -970,7 +970,7 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask, return -EFAULT; } if (vma->vm_ops && vma->vm_ops->get_policy) - pol = vma->vm_ops->get_policy(vma, addr); + pol = vma->vm_ops->get_policy(vma, addr, NULL); else pol = vma->vm_policy; } else if (addr) @@ -1778,7 +1778,7 @@ struct mempolicy *__get_vma_policy(struct vm_area_struct *vma, if (vma) { if (vma->vm_ops && vma->vm_ops->get_policy) { - pol = vma->vm_ops->get_policy(vma, addr); + pol = vma->vm_ops->get_policy(vma, addr, NULL); } else if (vma->vm_policy) { pol = vma->vm_policy; @@ -1826,7 +1826,7 @@ bool vma_policy_mof(struct vm_area_struct *vma) if (vma->vm_ops && vma->vm_ops->get_policy) { bool ret = false; - pol = vma->vm_ops->get_policy(vma, vma->vm_start); + pol = vma->vm_ops->get_policy(vma, vma->vm_start, NULL); if (pol && (pol->flags & MPOL_F_MOF)) ret = true; mpol_cond_put(pol); diff --git a/mm/shmem.c b/mm/shmem.c index a7550982a13d..cf27e1785f80 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -2352,7 +2352,7 @@ static int shmem_set_policy(struct vm_area_struct *vma, struct mempolicy *mpol) } static struct mempolicy *shmem_get_policy(struct vm_area_struct *vma, - unsigned long addr) + unsigned long addr, pgoff_t *ilx) { struct inode *inode = file_inode(vma->vm_file); pgoff_t index; -- 2.33.0

2 1

[openeuler:OLK-6.6 3971/9610] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 15 May '24

15 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7c6c7d83d2bc788cd9aef8983afa59eae25e148e commit: 9c1c9598010fbb9daa1e2a67d23830092fb6246a [3971/9610] net/hinic: Update Huawei Intelligent Network Card Driver: hinic config: arm64-randconfig-r132-20240515 (https://download.01.org/0day-ci/archive/20240515/202405151557.G5fbOVUN-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240515/202405151557.G5fbOVUN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405151557.G5fbOVUN-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:40:16: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] value @@ got restricted __be32 [usertype] @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: expected unsigned int [usertype] value drivers/net/ethernet/huawei/hinic/hinic_hwif.c:46:16: sparse: got restricted __be32 [usertype] drivers/net/ethernet/huawei/hinic/hinic_hwif.c:592:29: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base @@ got void *cfg_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:592:29: sparse: expected unsigned char [noderef] [usertype] __iomem *cfg_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:592:29: sparse: got void *cfg_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:593:30: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *intr_regs_base @@ got void *intr_reg_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:593:30: sparse: expected unsigned char [noderef] [usertype] __iomem *intr_regs_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:593:30: sparse: got void *intr_reg_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:596:23: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *db_base @@ got void *db_base @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:596:23: sparse: expected unsigned char [noderef] [usertype] __iomem *db_base drivers/net/ethernet/huawei/hinic/hinic_hwif.c:596:23: sparse: got void *db_base >> drivers/net/ethernet/huawei/hinic/hinic_hwif.c:597:28: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void [noderef] __iomem *dwqe_mapping @@ got void *dwqe_mapping @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:597:28: sparse: expected void [noderef] __iomem *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:597:28: sparse: got void *dwqe_mapping drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:64: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] gfp @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:64: sparse: expected restricted gfp_t [usertype] gfp drivers/net/ethernet/huawei/hinic/hinic_hwif.c:664:64: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:679:64: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted gfp_t [usertype] gfp @@ got unsigned int flag @@ drivers/net/ethernet/huawei/hinic/hinic_hwif.c:679:64: sparse: expected restricted gfp_t [usertype] gfp drivers/net/ethernet/huawei/hinic/hinic_hwif.c:679:64: sparse: got unsigned int flag drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:984:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c:993:17: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/huawei/hinic/hinic_hwif.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/xarray.h, ...): include/linux/page-flags.h:245:46: sparse: sparse: self-comparison always evaluates to false vim +46 drivers/net/ethernet/huawei/hinic/hinic_hwif.c 42 43 /* For UEFI driver, this function can only write BAR0 */ 44 void hinic_hwif_write_reg(struct hinic_hwif *hwif, u32 reg, u32 val) 45 { > 46 writel(cpu_to_be32(val), hwif->cfg_regs_base + reg); 47 } 48 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] scsi: sr: Do not leak information in ioctl
by Li Lingfeng 15 May '24

15 May '24

From: Tom Rix <trix(a)redhat.com> stable inclusion from stable-v5.18-rc4 commit faad6cebded8e0fd902b672f220449b93db479eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sr_ioctl.c uses this pattern: result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally, initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel. Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Tom Rix <trix(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/sr_ioctl.c [Commit aaff5ebaa269 ("scsi: remove the unchecked_isa_dma flag") remove the unchecked_isa_dma flag] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/sr_ioctl.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index 4c1de11e69fb..0808217f2d7b 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -45,7 +45,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -59,10 +59,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk1 = buffer[3]; +err: kfree(buffer); return result; } @@ -75,7 +78,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -90,6 +93,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_adr = buffer[5] >> 4; @@ -102,6 +107,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11]; +err: kfree(buffer); return result; } @@ -388,7 +394,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) { Scsi_CD *cd = cdi->handle; struct packet_command cgc; - char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); int result; if (!buffer) @@ -404,10 +410,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) cgc.data_direction = DMA_FROM_DEVICE; cgc.timeout = IOCTL_TIMEOUT; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] = 0; +err: kfree(buffer); return result; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] scsi: sr: Do not leak information in ioctl
by Li Lingfeng 15 May '24

15 May '24

From: Tom Rix <trix(a)redhat.com> stable inclusion from stable-v5.18-rc4 commit faad6cebded8e0fd902b672f220449b93db479eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sr_ioctl.c uses this pattern: result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally, initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel. Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Tom Rix <trix(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/sr_ioctl.c [Commit aaff5ebaa269 ("scsi: remove the unchecked_isa_dma flag") remove the unchecked_isa_dma flag] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/sr_ioctl.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index 335cfdde0cf0..85ed1c6be6ce 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -45,7 +45,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -59,10 +59,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk1 = buffer[3]; +err: kfree(buffer); return result; } @@ -75,7 +78,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -90,6 +93,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_adr = buffer[5] >> 4; @@ -102,6 +107,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11]; +err: kfree(buffer); return result; } @@ -389,7 +395,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) { Scsi_CD *cd = cdi->handle; struct packet_command cgc; - char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); int result; if (!buffer) @@ -405,10 +411,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) cgc.data_direction = DMA_FROM_DEVICE; cgc.timeout = IOCTL_TIMEOUT; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] = 0; +err: kfree(buffer); return result; } -- 2.31.1

2 1

[PATCH OLK-5.10 0/1] CVE-2024-27002
by Yongqiang Liu 15 May '24

15 May '24

Yongqiang Liu (1): clk: mediatek: Do a runtime PM get on controllers during probe drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.34.1

2 2

[openeuler:OLK-6.6 6911/9610] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1182:29: sparse: sparse: restricted __be32 degrades to integer
by kernel test robot 15 May '24

15 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7c6c7d83d2bc788cd9aef8983afa59eae25e148e commit: 92e27ee40a7ac6d7716ce01305906610e50f577a [6911/9610] net: hns3: add support handling tx dhcp packets for ROH config: arm64-randconfig-r132-20240515 (https://download.01.org/0day-ci/archive/20240515/202405151226.9E443DSy-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240515/202405151226.9E443DSy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405151226.9E443DSy-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1182:29: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/xarray.h, ...): include/linux/page-flags.h:245:46: sparse: sparse: self-comparison always evaluates to false vim +1182 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 1165 1166 static struct hns3_dhcp_packet *hns3_get_dhcp_packet(struct sk_buff *skb, 1167 int *dhcp_len) 1168 { 1169 struct hns3_dhcp_packet *dhcp; 1170 union l4_hdr_info l4; 1171 int l4_payload_len; 1172 1173 l4.hdr = skb_transport_header(skb); 1174 if (l4.udp->dest != htons(HNS3_DHCP_CLIENT_PORT) || 1175 l4.udp->source != htons(HNS3_DHCP_SERVER_PORT)) 1176 return NULL; 1177 1178 dhcp = (struct hns3_dhcp_packet *)(l4.hdr + sizeof(struct udphdr)); 1179 l4_payload_len = ntohs(l4.udp->len) - sizeof(struct udphdr); 1180 if (l4_payload_len < offsetof(struct hns3_dhcp_packet, options) || 1181 dhcp->hlen != ETH_ALEN || > 1182 dhcp->cookie != htonl(HNS3_DHCP_MAGIC)) 1183 return NULL; 1184 1185 *dhcp_len = l4_payload_len; 1186 return dhcp; 1187 } 1188 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] xfs: pass the correct cursor to xfs_iomap_prealloc_size
by Zizhi Wo 15 May '24

15 May '24

From: "Darrick J. Wong" <djwong(a)kernel.org> mainline inclusion from mainline-v6.3-rc4 commit fcde88af6a783d32e735dd2615528e2bf7a0f533 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PFXW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In xfs_buffered_write_iomap_begin, @icur is the iext cursor for the data fork and @ccur is the cursor for the cow fork. Pass in whichever cursor corresponds to allocfork, because otherwise the xfs_iext_prev_extent call can use the data fork cursor to walk off the end of the cow fork structure. Best case it returns the wrong results, worst case it does this: stack segment: 0000 [#1] PREEMPT SMP CPU: 2 PID: 3141909 Comm: fsstress Tainted: G W 6.3.0-rc2-xfsx #6.3.0-rc2 7bf5cc2e98997627cae5c930d890aba3aeec65dd Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20171121_152543-x86-ol7-builder-01.us.oracle.com-4.el7.1 04/01/2014 RIP: 0010:xfs_iext_prev+0x71/0x150 [xfs] RSP: 0018:ffffc90002233aa8 EFLAGS: 00010297 RAX: 000000000000000f RBX: 000000000000000e RCX: 000000000000000c RDX: 0000000000000002 RSI: 000000000000000e RDI: ffff8883d0019ba0 RBP: 989642409af8a7a7 R08: ffffea0000000001 R09: 0000000000000002 R10: 0000000000000000 R11: 000000000000000c R12: ffffc90002233b00 R13: ffff8883d0019ba0 R14: 989642409af8a6bf R15: 000ffffffffe0000 FS: 00007fdf8115f740(0000) GS:ffff88843fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdf8115e000 CR3: 0000000357256000 CR4: 00000000003506e0 Call Trace: <TASK> xfs_iomap_prealloc_size.constprop.0.isra.0+0x1a6/0x410 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] xfs_buffered_write_iomap_begin+0xa87/0xc60 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] iomap_iter+0x132/0x2f0 iomap_file_buffered_write+0x92/0x330 xfs_file_buffered_write+0xb1/0x330 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] vfs_write+0x2eb/0x410 ksys_write+0x65/0xe0 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Found by xfs/538 in alwayscow mode, but this doesn't seem particular to that test. Fixes: 590b16516ef3 ("xfs: refactor xfs_iomap_prealloc_size") Actually-Fixes: 66ae56a53f0e ("xfs: introduce an always_cow mode") Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/xfs/xfs_iomap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index ae96ac52c974..8fa09970b0d4 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1027,9 +1027,12 @@ xfs_buffered_write_iomap_begin( */ if (xfs_has_allocsize(mp)) prealloc_blocks = mp->m_allocsize_blocks; - else + else if (allocfork == XFS_DATA_FORK) prealloc_blocks = xfs_iomap_prealloc_size(ip, allocfork, offset, count, &icur); + else + prealloc_blocks = xfs_iomap_prealloc_size(ip, allocfork, + offset, count, &ccur); if (prealloc_blocks) { xfs_extlen_t align; xfs_off_t end_offset; -- 2.39.2

2 1

[PATCH OLK-6.6 v2] sched: smart_grid: silence complier error
by Yipeng Zou 15 May '24

15 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PEF6 CVE: NA ---------------------------------------- Silence complier error with allnoconfig. Implicit declaration of function without CONFIG_CGROUP_SCHED: 1. tg_update_affinity_domains 2. init_auto_affinity Fixes: 6eb07f9925a9 ("sched: Introduce smart grid scheduling strategy for cfs") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/core.c | 7 +++++++ kernel/sched/fair.c | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 07bcc5f2e2d9..9e7a99947de6 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9733,7 +9733,9 @@ int sched_cpu_activate(unsigned int cpu) static_branch_inc_cpuslocked(&sched_smt_present); #endif set_cpu_active(cpu, true); +#ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 1); +#endif if (sched_smp_initialized) { sched_update_numa(cpu, true); @@ -9823,7 +9825,9 @@ int sched_cpu_deactivate(unsigned int cpu) return ret; } sched_domains_numa_masks_clear(cpu); +#ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 0); +#endif return 0; } @@ -9947,7 +9951,10 @@ void __init sched_init_smp(void) sched_smp_initialized = true; sched_grid_zone_init(); + +#ifdef CONFIG_QOS_SCHED_SMART_GRID init_auto_affinity(&root_task_group); +#endif } static int __init migration_init(void) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8de28b182763..3dcbf50b677f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7253,7 +7253,7 @@ static void destroy_auto_affinity(struct task_group *tg) tg->auto_affinity = NULL; } #else -static void destroy_auto_affinity(struct task_group *tg) {} +static void __maybe_unused destroy_auto_affinity(struct task_group *tg) {} #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY static inline bool prefer_cpus_valid(struct task_struct *p); -- 2.34.1

2 1

[PATCH OLK-6.6] sched: smart_grid: silence complier error
by Yipeng Zou 15 May '24

15 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PEF6 CVE: NA ---------------------------------------- Silence complier error with allnoconfig. Implicit declaration of function without CONFIG_CGROUP_SCHED: 1. tg_update_affinity_domains 2. init_auto_affinity Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/core.c | 7 +++++++ kernel/sched/fair.c | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 07bcc5f2e2d9..9e7a99947de6 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9733,7 +9733,9 @@ int sched_cpu_activate(unsigned int cpu) static_branch_inc_cpuslocked(&sched_smt_present); #endif set_cpu_active(cpu, true); +#ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 1); +#endif if (sched_smp_initialized) { sched_update_numa(cpu, true); @@ -9823,7 +9825,9 @@ int sched_cpu_deactivate(unsigned int cpu) return ret; } sched_domains_numa_masks_clear(cpu); +#ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 0); +#endif return 0; } @@ -9947,7 +9951,10 @@ void __init sched_init_smp(void) sched_smp_initialized = true; sched_grid_zone_init(); + +#ifdef CONFIG_QOS_SCHED_SMART_GRID init_auto_affinity(&root_task_group); +#endif } static int __init migration_init(void) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8de28b182763..3dcbf50b677f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7253,7 +7253,7 @@ static void destroy_auto_affinity(struct task_group *tg) tg->auto_affinity = NULL; } #else -static void destroy_auto_affinity(struct task_group *tg) {} +static void __maybe_unused destroy_auto_affinity(struct task_group *tg) {} #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY static inline bool prefer_cpus_valid(struct task_struct *p); -- 2.34.1

2 1

[openeuler:OLK-6.6 6910/9610] drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 15 May '24

15 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7c6c7d83d2bc788cd9aef8983afa59eae25e148e commit: c7489eeb1b4ed08f28172986d496abb02d1258f1 [6910/9610] net: hns3: support arp proxy config: arm64-randconfig-r132-20240515 (https://download.01.org/0day-ci/archive/20240515/202405151052.AH2YMcM9-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240515/202405151052.AH2YMcM9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405151052.AH2YMcM9-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_tci @@ got unsigned short [usertype] vlan_tci @@ drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: expected restricted __be16 [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: got unsigned short [usertype] vlan_tci >> drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] vlan_tci @@ got restricted __be16 [usertype] vlan_tci @@ drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: expected unsigned short [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: got restricted __be16 [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/xarray.h, ...): include/linux/page-flags.h:245:46: sparse: sparse: self-comparison always evaluates to false vim +79 drivers/net/ethernet/hisilicon/hns3/hns3_roh.c 56 57 int hns3_handle_roh_arp_req(struct sk_buff *skb, struct hns3_nic_priv *priv) 58 { 59 struct hnae3_handle *h = priv->ae_handle; 60 struct hns3_enet_ring *ring; 61 struct arphdr *arphdr; 62 struct ethhdr *ethhdr; 63 int reply_idx, len; 64 __be32 *sip, *tip; 65 66 /* use same queue num in rx */ 67 ring = &priv->ring[skb->queue_mapping + h->kinfo.num_tqps]; 68 reply_idx = ring->arp_reply_tail; 69 reply_idx = hns3_roh_arp_reply_idx_move_fd(reply_idx); 70 /* This smp_load_acquire() pairs with smp_store_release() in 71 * hns3_handle_roh_arp_reply(). 72 */ 73 if (reply_idx == smp_load_acquire(&ring->arp_reply_head)) 74 return NETDEV_TX_BUSY; 75 len = skb->len; 76 77 if (skb_vlan_tagged(skb)) { 78 ring->arp_reply[reply_idx].has_vlan = true; > 79 ring->arp_reply[reply_idx].vlan_tci = skb_vlan_tag_get(skb); 80 skb_vlan_pop(skb); 81 len += VLAN_HLEN; 82 } else { 83 ring->arp_reply[reply_idx].has_vlan = false; 84 } 85 86 ethhdr = eth_hdr(skb); 87 arphdr = arp_hdr(skb); 88 89 hns3_extract_arp_ip_field(arphdr, &sip, &tip, skb->dev->addr_len); 90 ether_addr_copy(ring->arp_reply[reply_idx].dest_hw, ethhdr->h_source); 91 ether_addr_copy(ring->arp_reply[reply_idx].src_hw, ethhdr->h_dest); 92 ring->arp_reply[reply_idx].dest_ip = *sip; 93 ring->arp_reply[reply_idx].src_ip = *tip; 94 hns3_roh_update_mac_by_ip(be32_to_cpu(*tip), 95 ring->arp_reply[reply_idx].src_hw); 96 /* This smp_store_release() pairs with smp_load_acquire() in 97 * hns3_handle_roh_arp_reply(). Ensure that the arp_reply_tail is 98 * update validly. 99 */ 100 smp_store_release(&ring->arp_reply_tail, reply_idx); 101 102 ring = &priv->ring[skb->queue_mapping]; 103 u64_stats_update_begin(&ring->syncp); 104 ring->stats.tx_pkts++; 105 ring->stats.tx_bytes += len; 106 u64_stats_update_end(&ring->syncp); 107 108 dev_kfree_skb_any(skb); 109 napi_schedule(&ring->tqp_vector->napi); 110 return NETDEV_TX_OK; 111 } 112 113 static struct sk_buff *setup_arp_reply_skb(struct hns3_arp_reply *arp_reply, 114 struct hns3_nic_priv *priv) 115 { 116 struct sk_buff *skb = arp_create(ARPOP_REPLY, ETH_P_ARP, 117 arp_reply->dest_ip, priv->netdev, 118 arp_reply->src_ip, arp_reply->dest_hw, 119 arp_reply->src_hw, arp_reply->dest_hw); 120 if (!skb) 121 return NULL; 122 123 skb_reset_mac_header(skb); 124 skb_reset_mac_len(skb); 125 126 if (arp_reply->has_vlan) { 127 skb = vlan_insert_tag_set_proto(skb, htons(ETH_P_8021Q), > 128 arp_reply->vlan_tci); 129 if (!skb) 130 return NULL; 131 skb_reset_network_header(skb); 132 } 133 134 skb_reserve(skb, skb->mac_len); 135 return skb; 136 } 137 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] iommu/iova: Make depot list more efficient
by Zhang Zekun 15 May '24

15 May '24

In some scenarios in which is sensitive to the efficiency of allocating iova from iova_rcache. The commit 911aa1245da8 ("iommu/iova: Make the rcache depot scale better") change the format of depot from the fix length array to a list to make depot scale better for machines which has much cores. But the list operation is not as efficiency as the array operation, for some test case, such as IP tansfering, in which allocating iova from iova_rcache can become a bottle neck, this list operation can be reflected by a performance decrease. We can see the higher occupation of queue_iova() and __iova_rcache_get() in perf top. Operating iova_rache->depot on a list: 14.47% [kernel] [k] queue_iova 12.99% [kernel] [k] __iova_rcache_get 8.22% [kernel] [k] __arm_lpae_unmap 6.98% [kernel] [k] arm_lpae_map 6.20% [kernel] [k] native_queued_spin_unlock 4.63% [kernel] [k] __arm_lpae_map 2.56% [kernel] [k] __dev_queue_xmit Operating iova_rache->depot on a array: 10.50% [kernel] [k] __arm_lpae_unmap 7.80% [kernel] [k] native_queued_spin_unlock 7.23% [kernel] [k] queue_iova 7.16% [kernel] [k] arm_lpae_map 5.90% [kernel] [k] __arm_lpae_map 3.67% [kernel] [k] __iova_rcache_get 3.20% [kernel] [k] __dev_queue_xmit To make the depot operation more efficient, we can introduce a array buffer before using the depot list, the length of the array will be set to NR_CPUS, which should be enough for most workloads. iova_rcache will first try to use magazines in the array part of the depot. If we have too much magazines which need to be put in the depot, then the depot list will be used. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/iova.c | 40 ++++++++++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c index d59d0ea2fd21..220256dde24f 100644 --- a/drivers/iommu/iova.c +++ b/drivers/iommu/iova.c @@ -563,6 +563,7 @@ EXPORT_SYMBOL_GPL(reserve_iova); * we don't need to waste PFN capacity on a separate list head either. */ #define IOVA_MAG_SIZE 127 +#define IOVA_DEPOT_POOL_LEN NR_CPUS #define IOVA_DEPOT_DELAY msecs_to_jiffies(100) @@ -581,10 +582,15 @@ struct iova_cpu_rcache { struct iova_magazine *prev; }; +struct iova_rcache_depot { + struct iova_magazine *pool[IOVA_DEPOT_POOL_LEN]; + struct iova_magazine *list; +}; + struct iova_rcache { spinlock_t lock; unsigned int depot_size; - struct iova_magazine *depot; + struct iova_rcache_depot *depot; struct iova_cpu_rcache __percpu *cpu_rcaches; struct iova_domain *iovad; struct delayed_work work; @@ -671,9 +677,14 @@ static void iova_magazine_push(struct iova_magazine *mag, unsigned long pfn) static struct iova_magazine *iova_depot_pop(struct iova_rcache *rcache) { - struct iova_magazine *mag = rcache->depot; + struct iova_rcache_depot *depot = rcache->depot; + struct iova_magazine *mag; - rcache->depot = mag->next; + if (rcache->depot_size <= IOVA_DEPOT_POOL_LEN) + return depot->pool[--rcache->depot_size]; + + mag = depot->list; + depot->list = mag->next; mag->size = IOVA_MAG_SIZE; rcache->depot_size--; return mag; @@ -681,8 +692,15 @@ static struct iova_magazine *iova_depot_pop(struct iova_rcache *rcache) static void iova_depot_push(struct iova_rcache *rcache, struct iova_magazine *mag) { - mag->next = rcache->depot; - rcache->depot = mag; + struct iova_rcache_depot *depot = rcache->depot; + + if (rcache->depot_size < IOVA_DEPOT_POOL_LEN) { + depot->pool[rcache->depot_size++] = mag; + return; + } + + mag->next = depot->list; + depot->list = mag; rcache->depot_size++; } @@ -729,6 +747,11 @@ int iova_domain_init_rcaches(struct iova_domain *iovad) ret = -ENOMEM; goto out_err; } + rcache->depot = kzalloc(sizeof(struct iova_rcache_depot), GFP_KERNEL); + if (!rcache->depot) { + ret = -ENOMEM; + goto out_err; + } for_each_possible_cpu(cpu) { cpu_rcache = per_cpu_ptr(rcache->cpu_rcaches, cpu); @@ -832,7 +855,7 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache, has_pfn = true; } else { spin_lock(&rcache->lock); - if (rcache->depot) { + if (rcache->depot_size > 0) { iova_magazine_free(cpu_rcache->loaded); cpu_rcache->loaded = iova_depot_pop(rcache); has_pfn = true; @@ -885,8 +908,9 @@ static void free_iova_rcaches(struct iova_domain *iovad) } free_percpu(rcache->cpu_rcaches); cancel_delayed_work_sync(&rcache->work); - while (rcache->depot) + while (rcache->depot_size > 0) iova_magazine_free(iova_depot_pop(rcache)); + kfree(rcache->depot); } kfree(iovad->rcaches); @@ -924,7 +948,7 @@ static void free_global_cached_iovas(struct iova_domain *iovad) for (int i = 0; i < IOVA_RANGE_CACHE_MAX_SIZE; ++i) { rcache = &iovad->rcaches[i]; spin_lock_irqsave(&rcache->lock, flags); - while (rcache->depot) { + while (rcache->depot_size > 0) { struct iova_magazine *mag = iova_depot_pop(rcache); iova_magazine_free_pfns(mag, iovad); -- 2.17.1

1 0

[PATCH OLK-5.10 0/3] bugfix from mainline
by Yang Yingliang 15 May '24

15 May '24

Josh Poimboeuf (3): x86/srso: Set CPUID feature bits independently of bug or mitigation status x86/srso: Don't probe microcode in a guest x86/srso: Fix vulnerability reporting for missing microcode Documentation/admin-guide/hw-vuln/srso.rst | 19 ++++++--- arch/x86/include/asm/processor.h | 2 - arch/x86/kernel/cpu/amd.c | 28 ++++--------- arch/x86/kernel/cpu/bugs.c | 49 ++++++++++------------ 4 files changed, 45 insertions(+), 53 deletions(-) -- 2.25.1

2 4

[openeuler:OLK-5.10] BUILD SUCCESS 34c4be6c8abcfe94069447044e819c47d7dca192
by kernel test robot 15 May '24

15 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 34c4be6c8abcfe94069447044e819c47d7dca192 !7226 x86/fpu: Invalidate FPU state correctly on exec() Warning ids grouped by kconfigs: clang_recent_errors `-- x86_64-allnoconfig `-- Warning:openEuler-MAINTAINERS-references-a-file-that-doesn-t-exist:Documentation-networking-hinic3.rst elapsed time: 732m configs tested: 35 configs skipped: 150 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240514 clang arm64 randconfig-002-20240514 clang arm64 randconfig-003-20240514 gcc arm64 randconfig-004-20240514 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240514 clang x86_64 buildonly-randconfig-002-20240514 clang x86_64 buildonly-randconfig-003-20240514 gcc x86_64 buildonly-randconfig-004-20240514 clang x86_64 buildonly-randconfig-005-20240514 clang x86_64 buildonly-randconfig-006-20240514 clang x86_64 defconfig gcc x86_64 randconfig-001-20240514 gcc x86_64 randconfig-002-20240514 gcc x86_64 randconfig-003-20240514 clang x86_64 randconfig-004-20240514 clang x86_64 randconfig-005-20240514 gcc x86_64 randconfig-006-20240514 gcc x86_64 randconfig-011-20240514 clang x86_64 randconfig-012-20240514 gcc x86_64 randconfig-013-20240514 gcc x86_64 randconfig-014-20240514 clang x86_64 randconfig-015-20240514 gcc x86_64 randconfig-016-20240514 gcc x86_64 randconfig-071-20240514 clang x86_64 randconfig-072-20240514 clang x86_64 randconfig-073-20240514 gcc x86_64 randconfig-074-20240514 gcc x86_64 randconfig-075-20240514 clang x86_64 randconfig-076-20240514 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION 7c6c7d83d2bc788cd9aef8983afa59eae25e148e
by kernel test robot 15 May '24

15 May '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 7c6c7d83d2bc788cd9aef8983afa59eae25e148e !5291 [OLK-6.6] iommu/dma: Fix not fully traversing iova reservations issue Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | `-- arch-arm64-kernel-cpufeature.c:error:enable_pseudo_nmi-undeclared-(first-use-in-this-function) |-- arm64-defconfig | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used `-- x86_64-randconfig-161-20240514 `-- mm-readahead.c-page_cache_sync_ra()-warn:bitwise-AND-condition-is-false-here clang_recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_after_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_active | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_deactive | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_before_bond_modify | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_before_active_check | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_destroy | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_init_slave | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_netdev_event | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_service_proc | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_bond_tracker_get | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_deatch_bond | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_detach_nic_bond_work | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_get_bond_dev_by_name | |-- drivers-infiniband-hw-hiroce3-bond-roce_bond_common.c:warning:no-previous-prototype-for-function-roce3_queue_bond_work | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-cq-roce_cq_destroy.c:warning:no-previous-prototype-for-function-roce3_cq_hw2sw | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_cleanup_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_init_mtt_table | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_alloc | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_mtt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mtt.c:warning:no-previous-prototype-for-function-hmm_rdma_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_disable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_mw_mr.c:warning:no-previous-prototype-for-function-hmm_rdma_enable_mr_mpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_comp_res.c:warning:no-previous-prototype-for-function-hmm_rdma_mpt_free | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_alloc_mr | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_free_tpt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_mr.c:warning:no-previous-prototype-for-function-hmm_umem_write_mtt | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Excess-function-parameter-context-description-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:warning:Function-parameter-or-member-device-not-described-in-hmm_umem_get | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_context_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-rdma_ext_ctx_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_dif_format.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-include-rdma-roce_verbs_cmd.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-mr-roce_mr.c:warning:no-previous-prototype-for-function-roce3_check_mr_status | |-- drivers-infiniband-hw-hiroce3-rdma-rdma_comp.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce.h:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_bond_event | |-- drivers-infiniband-hw-hiroce3-roce_main.c:warning:no-previous-prototype-for-function-roce3_need_proc_link_event | |-- drivers-infiniband-hw-hiroce3-roce_sysfs.c:warning:the-current-pragma-pack-alignment-value-is-modified-in-the-included-file | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_deinit_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_detach | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_hwdev_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:no-previous-prototype-for-function-sss_init_hwdev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-fault_level-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_init.c:warning:variable-pcie_src-set-but-not-used | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_io_flush.c:warning:no-previous-prototype-for-function-sss_hwdev_flush_io | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_deinit_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwdev_mgmt_info.c:warning:no-previous-prototype-for-function-sss_init_mgmt_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_read_ack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_adm_msg_write_nack | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm.c:warning:no-previous-prototype-for-function-sss_sync_send_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_complete_adm_event | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_destroy_adm_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_adm_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_adm | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_ceq_intr_handle | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ceq.c:warning:no-previous-prototype-for-function-sss_init_ceqe_desc | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_ctrlq_flush_sync_cmd | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_deinit_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_init_ctrlq_channel | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_reinit_ctrlq_ctx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_ctrlq_init.c:warning:no-previous-prototype-for-function-sss_wait_ctrlq_stop | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_alloc_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_auto_mask | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_chip_set_msix_state | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_free_db_addr | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_glb_pf_vf_offset | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_global_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pcie_itf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_pf_id_of_vf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_export.c:warning:no-previous-prototype-for-function-sss_get_ppf_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_deinit_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_irq.c:warning:no-previous-prototype-for-function-sss_init_irq_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_deinit_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_hwif_init_mbx | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_init_func_mbx_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mbx_init.c:warning:no-previous-prototype-for-function-sss_recv_mbx_aeq_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_flush_mgmt_workq | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_force_complete_all | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_hwif_mgmt_init.c:warning:no-previous-prototype-for-function-sss_mgmt_msg_aeqe_handler | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_error.c:warning:no-previous-prototype-for-function-sss_detect_pci_error | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_attach_is_enable | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_info | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_get_uld_names | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_init_uld_lock | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_lock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_global.c:warning:no-previous-prototype-for-function-sss_unlock_uld | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_attach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_probe.c:warning:no-previous-prototype-for-function-sss_pci_probe | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_adapter | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_function | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_deinit_pci_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_all_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_detach_uld_driver | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_dettach_uld_dev | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_pci_remove | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_remove.c:warning:no-previous-prototype-for-function-sss_unmap_pci_bar | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-sss_pci_shutdown.c:warning:no-previous-prototype-for-function-sss_pci_shutdown | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_rd32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_adm_csr_wr32 | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_chip.c:warning:no-previous-prototype-for-function-sss_tool_send_clp_msg | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_alloc_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_copy_to_user | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_in_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_main.c:warning:no-previous-prototype-for-function-sss_tool_free_out_buf | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_id | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_func_type | |-- drivers-net-ethernet-3snic-sssnic-nic-..-hw-tool-sss_tool_sdk.c:warning:no-previous-prototype-for-function-sss_tool_get_hw_driver_stats | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_alloc_rx_buffers | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_jumbo_sgl | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_desc | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_fill_tx_priv_tag | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_unmap_and_free_tx_resource | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_jumbo | |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:warning:no-previous-prototype-for-function-ne6x_xmit_simple | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_add_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_arfs_del_flow_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_add_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_dev_del_fster_rules | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_arfs.c:warning:no-previous-prototype-for-function-ne6x_get_irq_num | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-getparam | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_atoi | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_isdigit | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-my_strtok | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clean_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_clr_table | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_erase_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_fru_info | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_get_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_meter_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_read_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_dev_type_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_hw_flag_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_set_mac_to_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_arfs_cnt | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_cqring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_pcie_drop_counter | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_rxring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txdesc_states | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txq | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_show_txtail | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_soc_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_delete | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_insert | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_search | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_tab_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_help | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_templ_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_update_adpt_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_debugfs.c:warning:no-previous-prototype-for-function-ne6x_dbg_write_norflash | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ext_toeplitz_key | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_crc32_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_eeprom | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_get_speed | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_recv | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_proto_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_set_mac_inloop | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_spd_verify | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_transform_vf_stat_format | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_dev.c:warning:no-previous-prototype-for-function-ne6x_dev_update_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_intx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_adpt_request_irq_msix | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_interrupt.c:warning:no-previous-prototype-for-function-ne6x_msix_clean_vf_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adjust_adpt_port_max_queue | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_adpt_release | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_phy_capabilities | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_aq_get_vf_link_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_rx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_clean_tx_ring | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_exit_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_cq_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_rx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_free_tx_resources | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_hw_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_init_module | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_link_speed_to_rate | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_pf_init | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_print_link_message | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:no-previous-prototype-for-function-ne6x_set_vf_port_vlan | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_main.c:warning:variable-tx_linearize-set-but-not-used | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_procfs.c:warning:no-previous-prototype-for-function-ne6x_proc_i2c_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-_reg_apb_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_axi_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_get_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_lock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_read | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_mem_write | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_perform | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_polling | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_send | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_set_user_data_template | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_table_update | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_reg.c:warning:no-previous-prototype-for-function-ne6x_reg_unlock | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_close_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_release_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_adpt_setup_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_clear_vf_status | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_conv_link_speed_to_virtchnl | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_free_vfs | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_is_reset_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_deinit_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_mbx_init_snapshot | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_reset_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_sdk_send_msg_to_vf | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_send_init_mbx_mesg | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_bw_for_max_vpnum | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_set_vf_state_qs_dis | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_status_to_errno | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_notify_vf_link_state | |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x_virtchnl_pf.c:warning:no-previous-prototype-for-function-ne6x_vc_set_default_allowlist | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showqueue | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_debugfs.c:warning:no-previous-prototype-for-function-ne6xvf_showring | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_ethtool.c:warning:unannotated-fall-through-between-switch-labels | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-nce_get_vsi_stats_struct | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_add_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_asq_done | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_configure_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_del_vlan_list | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_down | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_interrupt_scheme | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_init_sdk_mbx | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_irq_enable_queues | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_is_remove_in_progress | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_pdev_to_adapter | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_process_config | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_promiscuous_mode_changed | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_main.c:warning:no-previous-prototype-for-function-ne6xvf_replace_primary_mac | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_sdk_send_msg_to_pf | |-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf_virtchnl.c:warning:no-previous-prototype-for-function-ne6xvf_vf_parse_hw_config | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-bat_table-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_child-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-buf_node_parent-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-child_index-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cla_update_mode-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-count-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_fill_cla | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_bat_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_update | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_cla_xyz | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_numb-not-described-in-cqm_cla_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-entry_type-not-described-in-cqm_cla_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-index-not-described-in-cqm_cla_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_lock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:Function-parameter-or-member-pa-not-described-in-cqm_cla_get_unlock | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_fill_cla()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bat_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_lock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_get_unlock()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_update()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bat_cla.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cla_xyz()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:a-randomized-struct-can-only-be-initialized-with-a-designated-initializer | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-free_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bitmap_table.c:error:invalid-application-of-sizeof-to-an-incomplete-type-const-struct-malloc_memory | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-bloomfilter_init_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_bloomfilter_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-func_id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_dec | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-id-not-described-in-cqm_bloomfilter_inc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-k_flag-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:Function-parameter-or-member-op-not-described-in-cqm_bloomfilter_cmd | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-bloomfilter_init_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_cmd()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_dec()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_inc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_bloomfilter.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_bloomfilter_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_in-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-buf_out-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-channel-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cmd_buf-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-cos_id-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-mod-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-out_param-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:Function-parameter-or-member-timeout-not-described-in-cqm_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_cmd_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_lb_send_cmd_box_async()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_box()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_send_cmd_imm()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_cmd_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_lb_send_cmd_box_async | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_box | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_cmd.c:warning:no-previous-prototype-for-function-cqm3_send_cmd_imm | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_count-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-db_record-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-direct_wqe-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-dwqe_addr-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_db_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-object-not-described-in-cqm_ring_software_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-pagenum-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_get_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_direct_wqe_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_fc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_ring_hardware_db_update_pri | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_addr_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_db_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_get_db_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_direct_wqe_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_fc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_hardware_db_update_pri()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ring_software_db()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_db_addr_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_db.c:warning:no-previous-prototype-for-function-cqm3_get_hardware_db_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ceqe_data-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-cqm_handle-not-described-in-cqm_fake_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-data-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-event-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_aeq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_capability_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_ecq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_event_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_mem_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_nocq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_scq_callback | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_uninit | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_template-not-described-in-cqm_service_register | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_service_unregister | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_aeq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_capability_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_ecq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_event_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_fake_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_mem_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nocq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_scq_callback()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_register()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_service_unregister()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_main.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_uninit()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-bh-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-common-not-described-in-cqm_object_share_recv_queue_add_container | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_number-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-container_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_gid_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-ex_handle-not-described-in-cqm_timer_base | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-function_id-not-described-in-cqm_function_timer_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-global_funcid-not-described-in-cqm_function_hash_buf_clear | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_base-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-index_number-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-init_rq_num-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_funcid | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_put | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object-not-described-in-cqm_object_resize_free_old | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_priv-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_size-not-described-in-cqm_object_resize_alloc_new | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-object_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_object_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-room_header_alloc-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_rdma_table_get | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-service_type-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_fc_srq_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_object_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:Function-parameter-or-member-xid-not-described-in-cqm_object_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_hash_buf_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_function_timer_clear()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_gid_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_fc_srq_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_funcid()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_put()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_rdma_table_get()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_alloc_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_new()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_resize_free_old()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_add_container()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_object_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_timer_base()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_free_srq_bitmap_index | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object.c:warning:no-previous-prototype-for-function-cqm3_dtoe_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-cla_table-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-common-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-container_addr-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-link_mode-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-low2bit_align_en-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_container_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_nonrdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_bitmap_alloc | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_qpc_mpt_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_create | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_share_recv_queue_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_container_init | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-object-not-described-in-cqm_srq_used_rq_delete | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-offset-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-paddr-not-described-in-cqm_rdma_table_offset_addr | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_head_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-srq_tail_container-not-described-in-cqm_container_free | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-tail-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_number-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_per_buf-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:Function-parameter-or-member-wqe_size-not-described-in-cqm_linkwqe_fill | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_container_free()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_linkwqe_fill()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_nonrdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_bitmap_alloc()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_qpc_mpt_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_rdma_table_offset_addr()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_create()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_share_recv_queue_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_container_init()-instead | |-- drivers-net-ethernet-huawei-hinic3-cqm-cqm_object_intern.c:warning:expecting-prototype-for-Prototype().-Prototype-was-for-cqm_srq_used_rq_delete()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hw_cfg.c:warning:expecting-prototype-for-hinic_set_vf_dev_cap().-Prototype-was-for-hinic3_init_vf_dev_cap()-instead | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:This-comment-starts-with-but-isn-t-a-kernel-doc-comment.-Refer-Documentation-doc-guide-kernel-doc.rst | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_get | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_hwif.c:warning:no-previous-prototype-for-function-hinic3_global_func_id_hw | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__mbox_to_host | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-__ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-comm_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-get_slave_func_netdev_state | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hilink_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_get_master_host_mbox_enable | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_nic_ppf_mbox_handler | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_ppf_process_mbox_msg | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-hinic3_register_slave_ppf | |-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-set_slave_func_nic_state | `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:warning:no-previous-prototype-for-function-sw_func_ppf_mbox_handler |-- arm64-randconfig-001-20240514 | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used |-- arm64-randconfig-004-20240514 | `-- arch-arm64-kvm-vgic-vgic-mmio.c:warning:variable-is_pending-set-but-not-used `-- x86_64-allnoconfig |-- drivers-infiniband-hw-hiroce3-host-hmm-hmm_umem.c:linux-version.h-not-needed. |-- drivers-infiniband-hw-hiroce3-roce.h:linux-version.h-not-needed. |-- drivers-net-ethernet-huawei-hinic3-bond-hinic3_bond.c:linux-version.h-not-needed. `-- drivers-net-ethernet-huawei-hinic3-hw-hinic3_multi_host_mgmt.c:hinic3_hwif.h-is-included-more-than-once. elapsed time: 727m configs tested: 40 configs skipped: 142 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240514 clang arm64 randconfig-002-20240514 clang arm64 randconfig-003-20240514 gcc arm64 randconfig-004-20240514 clang loongarch allmodconfig gcc loongarch allnoconfig gcc loongarch defconfig gcc loongarch randconfig-001-20240514 gcc loongarch randconfig-002-20240514 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240514 clang x86_64 buildonly-randconfig-002-20240514 clang x86_64 buildonly-randconfig-003-20240514 gcc x86_64 buildonly-randconfig-004-20240514 clang x86_64 buildonly-randconfig-005-20240514 clang x86_64 buildonly-randconfig-006-20240514 clang x86_64 defconfig gcc x86_64 randconfig-001-20240514 gcc x86_64 randconfig-002-20240514 gcc x86_64 randconfig-003-20240514 clang x86_64 randconfig-004-20240514 clang x86_64 randconfig-005-20240514 gcc x86_64 randconfig-006-20240514 gcc x86_64 randconfig-011-20240514 clang x86_64 randconfig-012-20240514 gcc x86_64 randconfig-013-20240514 gcc x86_64 randconfig-014-20240514 clang x86_64 randconfig-015-20240514 gcc x86_64 randconfig-016-20240514 gcc x86_64 randconfig-071-20240514 clang x86_64 randconfig-072-20240514 clang x86_64 randconfig-073-20240514 gcc x86_64 randconfig-074-20240514 gcc x86_64 randconfig-075-20240514 clang x86_64 randconfig-076-20240514 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 98ca839cbf9cfdac07854ab39950a8281ef93143
by kernel test robot 15 May '24

15 May '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 98ca839cbf9cfdac07854ab39950a8281ef93143 !7194 s390/dasd: fix double module refcount decrement Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allmodconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-defconfig | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- arm64-randconfig-001-20240514 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code |-- x86_64-buildonly-randconfig-003-20240514 | `-- arch-x86-include-asm-paravirt.h:warning:mcu_ctrl-may-be-used-uninitialized `-- x86_64-randconfig-002-20240514 `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:ISO-C90-forbids-mixed-declarations-and-code clang_recent_errors |-- x86_64-allyesconfig | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-001-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-buildonly-randconfig-002-20240514 | `-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension |-- x86_64-buildonly-randconfig-004-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-003-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-004-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-011-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-014-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-071-20240514 | |-- drivers-gpu-drm-nouveau-nvkm-core-object.c:warning:mixing-declarations-and-code-is-a-C99-extension | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-072-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-075-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-076-20240514 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-101-20240515 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) |-- x86_64-randconfig-103-20240515 | `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) `-- x86_64-rhel-8.3-rust `-- net-ipv4-arp.c:warning:comparison-of-distinct-pointer-types-(-typeof-(dev-addr_len)-(aka-unsigned-char-)-and-typeof-(sizeof-(r-arp_ha.sa_data))-(aka-unsigned-long-)) elapsed time: 732m configs tested: 35 configs skipped: 147 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240514 gcc arm64 randconfig-002-20240514 gcc arm64 randconfig-003-20240514 gcc arm64 randconfig-004-20240514 gcc x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240514 clang x86_64 buildonly-randconfig-002-20240514 clang x86_64 buildonly-randconfig-003-20240514 gcc x86_64 buildonly-randconfig-004-20240514 clang x86_64 buildonly-randconfig-005-20240514 clang x86_64 buildonly-randconfig-006-20240514 clang x86_64 defconfig gcc x86_64 randconfig-001-20240514 gcc x86_64 randconfig-002-20240514 gcc x86_64 randconfig-003-20240514 clang x86_64 randconfig-004-20240514 clang x86_64 randconfig-005-20240514 gcc x86_64 randconfig-006-20240514 gcc x86_64 randconfig-011-20240514 clang x86_64 randconfig-012-20240514 gcc x86_64 randconfig-013-20240514 gcc x86_64 randconfig-014-20240514 clang x86_64 randconfig-015-20240514 gcc x86_64 randconfig-016-20240514 gcc x86_64 randconfig-071-20240514 clang x86_64 randconfig-072-20240514 clang x86_64 randconfig-073-20240514 gcc x86_64 randconfig-074-20240514 gcc x86_64 randconfig-075-20240514 clang x86_64 randconfig-076-20240514 clang x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
by Guo Mengqi 15 May '24

15 May '24

From: Guan Jing <guanjing6(a)huawei.com> mainline inclusion from mainline-v6.5-rc2 commit 246f80a0b17f8f582b2c0996db02998239057c65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9CTGE CVE: CVE-2023-52629 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations. Fixes: 9f5e8eee5cfe ("sh: generic push-switch framework.") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Geert Uytterhoeven <geert+renesas(a)glider.be> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Link: https://lore.kernel.org/r/20230802033737.9738-1-duoming@zju.edu.cn Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> --- arch/sh/drivers/push-switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/drivers/push-switch.c b/arch/sh/drivers/push-switch.c index 2813140fd92b..c3e8feedfe37 100644 --- a/arch/sh/drivers/push-switch.c +++ b/arch/sh/drivers/push-switch.c @@ -101,8 +101,8 @@ static int switch_drv_remove(struct platform_device *pdev) device_remove_file(&pdev->dev, &dev_attr_switch); platform_set_drvdata(pdev, NULL); - flush_work(&psw->work); del_timer_sync(&psw->debounce); + flush_work(&psw->work); free_irq(irq, pdev); kfree(psw); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
by Guo Mengqi 15 May '24

15 May '24

From: Guan Jing <guanjing6(a)huawei.com> mainline inclusion from mainline-v6.5-rc2 commit 246f80a0b17f8f582b2c0996db02998239057c65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9CTGE CVE: CVE-2023-52629 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations. Fixes: 9f5e8eee5cfe ("sh: generic push-switch framework.") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Geert Uytterhoeven <geert+renesas(a)glider.be> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Link: https://lore.kernel.org/r/20230802033737.9738-1-duoming@zju.edu.cn Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> --- arch/sh/drivers/push-switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/drivers/push-switch.c b/arch/sh/drivers/push-switch.c index 2813140fd92b..c3e8feedfe37 100644 --- a/arch/sh/drivers/push-switch.c +++ b/arch/sh/drivers/push-switch.c @@ -101,8 +101,8 @@ static int switch_drv_remove(struct platform_device *pdev) device_remove_file(&pdev->dev, &dev_attr_switch); platform_set_drvdata(pdev, NULL); - flush_work(&psw->work); del_timer_sync(&psw->debounce); + flush_work(&psw->work); free_irq(irq, pdev); kfree(psw); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
by Guo Mengqi 15 May '24

15 May '24

From: Guan Jing <guanjing6(a)huawei.com> mainline inclusion from mainline-v6.5-rc2 commit 246f80a0b17f8f582b2c0996db02998239057c65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9CTGE CVE: CVE-2023-52629 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations. Fixes: 9f5e8eee5cfe ("sh: generic push-switch framework.") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Geert Uytterhoeven <geert+renesas(a)glider.be> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Link: https://lore.kernel.org/r/20230802033737.9738-1-duoming@zju.edu.cn Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> --- arch/sh/drivers/push-switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/drivers/push-switch.c b/arch/sh/drivers/push-switch.c index 2813140fd92b..c3e8feedfe37 100644 --- a/arch/sh/drivers/push-switch.c +++ b/arch/sh/drivers/push-switch.c @@ -101,8 +101,8 @@ static int switch_drv_remove(struct platform_device *pdev) device_remove_file(&pdev->dev, &dev_attr_switch); platform_set_drvdata(pdev, NULL); - flush_work(&psw->work); del_timer_sync(&psw->debounce); + flush_work(&psw->work); free_irq(irq, pdev); kfree(psw); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] blk-iocost: Fix an UBSAN shift-out-of-bounds warning
by Guo Mengqi 15 May '24

15 May '24

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v5.10.210 commit 9f56f38331171c9a19754004f0664686d67ee48d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNCI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a427b49d02995ea4a6ff93a1432c40fa4d36821 ] When iocg_kick_delay() is called from a CPU different than the one which set the delay, @now may be in the past of @iocg->delay_at leading to the following warning: UBSAN: shift-out-of-bounds in block/blk-iocost.c:1359:23 shift exponent 18446744073709 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <TASK> dump_stack_lvl+0x79/0xc0 __ubsan_handle_shift_out_of_bounds+0x2ab/0x300 iocg_kick_delay+0x222/0x230 ioc_rqos_merge+0x1d7/0x2c0 __rq_qos_merge+0x2c/0x80 bio_attempt_back_merge+0x83/0x190 blk_attempt_plug_merge+0x101/0x150 blk_mq_submit_bio+0x2b1/0x720 submit_bio_noacct_nocheck+0x320/0x3e0 __swap_writepage+0x2ab/0x9d0 The underflow itself doesn't really affect the behavior in any meaningful way; however, the past timestamp may exaggerate the delay amount calculated later in the code, which shouldn't be a material problem given the nature of the delay mechanism. If @now is in the past, this CPU is racing another CPU which recently set up the delay and there's nothing this CPU can contribute w.r.t. the delay. Let's bail early from iocg_kick_delay() in such cases. Reported-by: Breno Leitão <leitao(a)debian.org> Signed-off-by: Tejun Heo <tj(a)kernel.org> Fixes: 5160a5a53c0c ("blk-iocost: implement delay adjustment hysteresis") Link: https://lore.kernel.org/r/ZVvc9L_CYk5LO1fT@slm.duckdns.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- block/blk-iocost.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index a26a81ae9507..ef12e5d94a3b 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -1315,6 +1315,13 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now) lockdep_assert_held(&iocg->waitq.lock); + /* + * If the delay is set by another CPU, we may be in the past. No need to + * change anything if so. This avoids decay calculation underflow. + */ + if (time_before64(now->now, iocg->delay_at)) + return false; + /* calculate the current delay in effect - 1/2 every second */ tdelta = now->now - iocg->delay_at; if (iocg->delay) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] sh: push-switch: Reorder cleanup operations to avoid use-after-free bug
by Guo Mengqi 15 May '24

15 May '24

From: Guan Jing <guanjing6(a)huawei.com> mainline inclusion from mainline-v6.5-rc2 commit 246f80a0b17f8f582b2c0996db02998239057c65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9CTGE CVE: CVE-2023-52629 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() to stop the worker, it could be rescheduled in switch_timer(). As a result, a use-after-free bug can occur. The details are shown below: (cpu 0) | (cpu 1) switch_drv_remove() | flush_work() | ... | switch_timer // timer | schedule_work(&psw->work) timer_shutdown_sync() | ... | switch_work_handler // worker kfree(psw) // free | | psw->state = 0 // use This patch puts timer_shutdown_sync() before flush_work() to mitigate the bugs. As a result, the worker and timer will be stopped safely before the deallocate operations. Fixes: 9f5e8eee5cfe ("sh: generic push-switch framework.") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Geert Uytterhoeven <geert+renesas(a)glider.be> Reviewed-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Link: https://lore.kernel.org/r/20230802033737.9738-1-duoming@zju.edu.cn Signed-off-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> Signed-off-by: Guan Jing <guanjing6(a)huawei.com> --- arch/sh/drivers/push-switch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/sh/drivers/push-switch.c b/arch/sh/drivers/push-switch.c index 2813140fd92b..c3e8feedfe37 100644 --- a/arch/sh/drivers/push-switch.c +++ b/arch/sh/drivers/push-switch.c @@ -101,8 +101,8 @@ static int switch_drv_remove(struct platform_device *pdev) device_remove_file(&pdev->dev, &dev_attr_switch); platform_set_drvdata(pdev, NULL); - flush_work(&psw->work); del_timer_sync(&psw->debounce); + flush_work(&psw->work); free_irq(irq, pdev); kfree(psw); -- 2.17.1

2 1

[PATCH OLK-5.10] blk-iocost: Fix an UBSAN shift-out-of-bounds warning
by Guo Mengqi 15 May '24

15 May '24

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v5.10.210 commit 9f56f38331171c9a19754004f0664686d67ee48d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNCI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a427b49d02995ea4a6ff93a1432c40fa4d36821 ] When iocg_kick_delay() is called from a CPU different than the one which set the delay, @now may be in the past of @iocg->delay_at leading to the following warning: UBSAN: shift-out-of-bounds in block/blk-iocost.c:1359:23 shift exponent 18446744073709 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <TASK> dump_stack_lvl+0x79/0xc0 __ubsan_handle_shift_out_of_bounds+0x2ab/0x300 iocg_kick_delay+0x222/0x230 ioc_rqos_merge+0x1d7/0x2c0 __rq_qos_merge+0x2c/0x80 bio_attempt_back_merge+0x83/0x190 blk_attempt_plug_merge+0x101/0x150 blk_mq_submit_bio+0x2b1/0x720 submit_bio_noacct_nocheck+0x320/0x3e0 __swap_writepage+0x2ab/0x9d0 The underflow itself doesn't really affect the behavior in any meaningful way; however, the past timestamp may exaggerate the delay amount calculated later in the code, which shouldn't be a material problem given the nature of the delay mechanism. If @now is in the past, this CPU is racing another CPU which recently set up the delay and there's nothing this CPU can contribute w.r.t. the delay. Let's bail early from iocg_kick_delay() in such cases. Reported-by: Breno Leitão <leitao(a)debian.org> Signed-off-by: Tejun Heo <tj(a)kernel.org> Fixes: 5160a5a53c0c ("blk-iocost: implement delay adjustment hysteresis") Link: https://lore.kernel.org/r/ZVvc9L_CYk5LO1fT@slm.duckdns.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- block/blk-iocost.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index a26a81ae9507..ef12e5d94a3b 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -1315,6 +1315,13 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now) lockdep_assert_held(&iocg->waitq.lock); + /* + * If the delay is set by another CPU, we may be in the past. No need to + * change anything if so. This avoids decay calculation underflow. + */ + if (time_before64(now->now, iocg->delay_at)) + return false; + /* calculate the current delay in effect - 1/2 every second */ tdelta = now->now - iocg->delay_at; if (iocg->delay) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] blk-iocost: Fix an UBSAN shift-out-of-bounds warning
by Guo Mengqi 15 May '24

15 May '24

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v5.10.210 commit 9f56f38331171c9a19754004f0664686d67ee48d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNCI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a427b49d02995ea4a6ff93a1432c40fa4d36821 ] When iocg_kick_delay() is called from a CPU different than the one which set the delay, @now may be in the past of @iocg->delay_at leading to the following warning: UBSAN: shift-out-of-bounds in block/blk-iocost.c:1359:23 shift exponent 18446744073709 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <TASK> dump_stack_lvl+0x79/0xc0 __ubsan_handle_shift_out_of_bounds+0x2ab/0x300 iocg_kick_delay+0x222/0x230 ioc_rqos_merge+0x1d7/0x2c0 __rq_qos_merge+0x2c/0x80 bio_attempt_back_merge+0x83/0x190 blk_attempt_plug_merge+0x101/0x150 blk_mq_submit_bio+0x2b1/0x720 submit_bio_noacct_nocheck+0x320/0x3e0 __swap_writepage+0x2ab/0x9d0 The underflow itself doesn't really affect the behavior in any meaningful way; however, the past timestamp may exaggerate the delay amount calculated later in the code, which shouldn't be a material problem given the nature of the delay mechanism. If @now is in the past, this CPU is racing another CPU which recently set up the delay and there's nothing this CPU can contribute w.r.t. the delay. Let's bail early from iocg_kick_delay() in such cases. Reported-by: Breno Leitão <leitao(a)debian.org> Signed-off-by: Tejun Heo <tj(a)kernel.org> Fixes: 5160a5a53c0c ("blk-iocost: implement delay adjustment hysteresis") Link: https://lore.kernel.org/r/ZVvc9L_CYk5LO1fT@slm.duckdns.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- block/blk-iocost.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index 0003bf2f3b30..30dda16bb879 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -1306,6 +1306,13 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now) lockdep_assert_held(&iocg->waitq.lock); + /* + * If the delay is set by another CPU, we may be in the past. No need to + * change anything if so. This avoids decay calculation underflow. + */ + if (time_before64(now->now, iocg->delay_at)) + return false; + /* calculate the current delay in effect - 1/2 every second */ tdelta = now->now - iocg->delay_at; if (iocg->delay) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] blk-iocost: Fix an UBSAN shift-out-of-bounds warning
by Guo Mengqi 15 May '24

15 May '24

From: Tejun Heo <tj(a)kernel.org> stable inclusion from stable-v5.10.210 commit 9f56f38331171c9a19754004f0664686d67ee48d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNCI Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a427b49d02995ea4a6ff93a1432c40fa4d36821 ] When iocg_kick_delay() is called from a CPU different than the one which set the delay, @now may be in the past of @iocg->delay_at leading to the following warning: UBSAN: shift-out-of-bounds in block/blk-iocost.c:1359:23 shift exponent 18446744073709 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <TASK> dump_stack_lvl+0x79/0xc0 __ubsan_handle_shift_out_of_bounds+0x2ab/0x300 iocg_kick_delay+0x222/0x230 ioc_rqos_merge+0x1d7/0x2c0 __rq_qos_merge+0x2c/0x80 bio_attempt_back_merge+0x83/0x190 blk_attempt_plug_merge+0x101/0x150 blk_mq_submit_bio+0x2b1/0x720 submit_bio_noacct_nocheck+0x320/0x3e0 __swap_writepage+0x2ab/0x9d0 The underflow itself doesn't really affect the behavior in any meaningful way; however, the past timestamp may exaggerate the delay amount calculated later in the code, which shouldn't be a material problem given the nature of the delay mechanism. If @now is in the past, this CPU is racing another CPU which recently set up the delay and there's nothing this CPU can contribute w.r.t. the delay. Let's bail early from iocg_kick_delay() in such cases. Reported-by: Breno Leitão <leitao(a)debian.org> Signed-off-by: Tejun Heo <tj(a)kernel.org> Fixes: 5160a5a53c0c ("blk-iocost: implement delay adjustment hysteresis") Link: https://lore.kernel.org/r/ZVvc9L_CYk5LO1fT@slm.duckdns.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- block/blk-iocost.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index a4c99ae1e076..cc620c532c2e 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -1306,6 +1306,13 @@ static bool iocg_kick_delay(struct ioc_gq *iocg, struct ioc_now *now) lockdep_assert_held(&iocg->waitq.lock); + /* + * If the delay is set by another CPU, we may be in the past. No need to + * change anything if so. This avoids decay calculation underflow. + */ + if (time_before64(now->now, iocg->delay_at)) + return false; + /* calculate the current delay in effect - 1/2 every second */ tdelta = now->now - iocg->delay_at; if (iocg->delay) -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
by Guo Mengqi 15 May '24

15 May '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.8-rc4 commit 66951d98d9bf45ba25acf37fe0747253fafdf298 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNF6 CVE: CVE-2024-26661 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to ensure the tg is not NULL. Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.") Cc: Yongqiang Sun <yongqiang.sun(a)amd.com> Cc: Anthony Koo <Anthony.Koo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Anthony Koo <Anthony.Koo(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Liao Chen <liaochen4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c index 01f1d3d9a639..14abe2ce5073 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c @@ -179,9 +179,15 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) void dcn21_set_pipe(struct pipe_ctx *pipe_ctx) { struct abm *abm = pipe_ctx->stream_res.abm; - uint32_t otg_inst = pipe_ctx->stream_res.tg->inst; + struct timing_generator *tg = pipe_ctx->stream_res.tg; struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl; struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu; + uint32_t otg_inst; + + if (!abm && !tg && !panel_cntl) + return; + + otg_inst = tg->inst; if (dmcu) { dce110_set_pipe(pipe_ctx); -- 2.17.1

2 1

[PATCH OLK-5.10] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
by Guo Mengqi 15 May '24

15 May '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.8-rc4 commit 66951d98d9bf45ba25acf37fe0747253fafdf298 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNF6 CVE: CVE-2024-26661 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to ensure the tg is not NULL. Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.") Cc: Yongqiang Sun <yongqiang.sun(a)amd.com> Cc: Anthony Koo <Anthony.Koo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Anthony Koo <Anthony.Koo(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Liao Chen <liaochen4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c index 01f1d3d9a639..14abe2ce5073 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c @@ -179,9 +179,15 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) void dcn21_set_pipe(struct pipe_ctx *pipe_ctx) { struct abm *abm = pipe_ctx->stream_res.abm; - uint32_t otg_inst = pipe_ctx->stream_res.tg->inst; + struct timing_generator *tg = pipe_ctx->stream_res.tg; struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl; struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu; + uint32_t otg_inst; + + if (!abm && !tg && !panel_cntl) + return; + + otg_inst = tg->inst; if (dmcu) { dce110_set_pipe(pipe_ctx); -- 2.17.1

2 1

[PATCH OLK-5.10] PM / devfreq: Synchronize devfreq_monitor_[start/stop]
by Guo Mengqi 15 May '24

15 May '24

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v5.10.210 commit 3399cc7013e761fee9d6eec795e9b31ab0cbe475 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNGK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 ] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1]. while true do echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor done It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled. Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted. [1] ... .. <idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a [ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 ... [ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff889edc155c [ 9436.262227][ C4] x1 : ffffff8001005200 x0 : ffffff80444f0428 [ 9436.262232][ C4] Call trace: [ 9436.262236][ C4] expire_timers+0x9c/0x438 [ 9436.262240][ C4] __run_timers+0x1f0/0x330 [ 9436.262245][ C4] run_timer_softirq+0x28/0x58 [ 9436.262255][ C4] efi_header_end+0x168/0x5ec [ 9436.262265][ C4] __irq_exit_rcu+0x108/0x124 [ 9436.262274][ C4] __handle_domain_irq+0x118/0x1e4 [ 9436.262282][ C4] gic_handle_irq.30369+0x6c/0x2bc [ 9436.262286][ C4] el0_irq_naked+0x60/0x6c Link: https://lore.kernel.org/all/1700860318-4025-1-git-send-email-quic_mojha@qui… Reported-by: Joyyoung Huang <huangzaiyang(a)oppo.com> Acked-by: MyungJoo Ham <myungjoo.ham(a)samsung.com> Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/devfreq/devfreq.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c index 42c1eed44529..216594b86119 100644 --- a/drivers/devfreq/devfreq.c +++ b/drivers/devfreq/devfreq.c @@ -438,10 +438,14 @@ static void devfreq_monitor(struct work_struct *work) if (err) dev_err(&devfreq->dev, "dvfs failed with (%d) error\n", err); + if (devfreq->stop_polling) + goto out; + queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); - mutex_unlock(&devfreq->lock); +out: + mutex_unlock(&devfreq->lock); trace_devfreq_monitor(devfreq); } @@ -459,6 +463,10 @@ void devfreq_monitor_start(struct devfreq *devfreq) if (devfreq->governor->interrupt_driven) return; + mutex_lock(&devfreq->lock); + if (delayed_work_pending(&devfreq->work)) + goto out; + switch (devfreq->profile->timer) { case DEVFREQ_TIMER_DEFERRABLE: INIT_DEFERRABLE_WORK(&devfreq->work, devfreq_monitor); @@ -467,12 +475,16 @@ void devfreq_monitor_start(struct devfreq *devfreq) INIT_DELAYED_WORK(&devfreq->work, devfreq_monitor); break; default: - return; + goto out; } if (devfreq->profile->polling_ms) queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); + +out: + devfreq->stop_polling = false; + mutex_unlock(&devfreq->lock); } EXPORT_SYMBOL(devfreq_monitor_start); @@ -489,6 +501,14 @@ void devfreq_monitor_stop(struct devfreq *devfreq) if (devfreq->governor->interrupt_driven) return; + mutex_lock(&devfreq->lock); + if (devfreq->stop_polling) { + mutex_unlock(&devfreq->lock); + return; + } + + devfreq->stop_polling = true; + mutex_unlock(&devfreq->lock); cancel_delayed_work_sync(&devfreq->work); } EXPORT_SYMBOL(devfreq_monitor_stop); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
by Guo Mengqi 15 May '24

15 May '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.8-rc4 commit 66951d98d9bf45ba25acf37fe0747253fafdf298 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNF6 CVE: CVE-2024-26661 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to ensure the tg is not NULL. Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.") Cc: Yongqiang Sun <yongqiang.sun(a)amd.com> Cc: Anthony Koo <Anthony.Koo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Anthony Koo <Anthony.Koo(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Liao Chen <liaochen4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c index 01f1d3d9a639..14abe2ce5073 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c @@ -179,9 +179,15 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) void dcn21_set_pipe(struct pipe_ctx *pipe_ctx) { struct abm *abm = pipe_ctx->stream_res.abm; - uint32_t otg_inst = pipe_ctx->stream_res.tg->inst; + struct timing_generator *tg = pipe_ctx->stream_res.tg; struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl; struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu; + uint32_t otg_inst; + + if (!abm && !tg && !panel_cntl) + return; + + otg_inst = tg->inst; if (dmcu) { dce110_set_pipe(pipe_ctx); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] PM / devfreq: Synchronize devfreq_monitor_[start/stop]
by Guo Mengqi 15 May '24

15 May '24

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v5.10.210 commit 3399cc7013e761fee9d6eec795e9b31ab0cbe475 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNGK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 ] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1]. while true do echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor done It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled. Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted. [1] ... .. <idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a [ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 ... [ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff889edc155c [ 9436.262227][ C4] x1 : ffffff8001005200 x0 : ffffff80444f0428 [ 9436.262232][ C4] Call trace: [ 9436.262236][ C4] expire_timers+0x9c/0x438 [ 9436.262240][ C4] __run_timers+0x1f0/0x330 [ 9436.262245][ C4] run_timer_softirq+0x28/0x58 [ 9436.262255][ C4] efi_header_end+0x168/0x5ec [ 9436.262265][ C4] __irq_exit_rcu+0x108/0x124 [ 9436.262274][ C4] __handle_domain_irq+0x118/0x1e4 [ 9436.262282][ C4] gic_handle_irq.30369+0x6c/0x2bc [ 9436.262286][ C4] el0_irq_naked+0x60/0x6c Link: https://lore.kernel.org/all/1700860318-4025-1-git-send-email-quic_mojha@qui… Reported-by: Joyyoung Huang <huangzaiyang(a)oppo.com> Acked-by: MyungJoo Ham <myungjoo.ham(a)samsung.com> Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/devfreq/devfreq.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c index c6f460550f5e..0e10c2a05252 100644 --- a/drivers/devfreq/devfreq.c +++ b/drivers/devfreq/devfreq.c @@ -438,10 +438,14 @@ static void devfreq_monitor(struct work_struct *work) if (err) dev_err(&devfreq->dev, "dvfs failed with (%d) error\n", err); + if (devfreq->stop_polling) + goto out; + queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); - mutex_unlock(&devfreq->lock); +out: + mutex_unlock(&devfreq->lock); trace_devfreq_monitor(devfreq); } @@ -459,6 +463,10 @@ void devfreq_monitor_start(struct devfreq *devfreq) if (devfreq->governor->interrupt_driven) return; + mutex_lock(&devfreq->lock); + if (delayed_work_pending(&devfreq->work)) + goto out; + switch (devfreq->profile->timer) { case DEVFREQ_TIMER_DEFERRABLE: INIT_DEFERRABLE_WORK(&devfreq->work, devfreq_monitor); @@ -467,12 +475,16 @@ void devfreq_monitor_start(struct devfreq *devfreq) INIT_DELAYED_WORK(&devfreq->work, devfreq_monitor); break; default: - return; + goto out; } if (devfreq->profile->polling_ms) queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); + +out: + devfreq->stop_polling = false; + mutex_unlock(&devfreq->lock); } EXPORT_SYMBOL(devfreq_monitor_start); @@ -489,6 +501,14 @@ void devfreq_monitor_stop(struct devfreq *devfreq) if (devfreq->governor->interrupt_driven) return; + mutex_lock(&devfreq->lock); + if (devfreq->stop_polling) { + mutex_unlock(&devfreq->lock); + return; + } + + devfreq->stop_polling = true; + mutex_unlock(&devfreq->lock); cancel_delayed_work_sync(&devfreq->work); } EXPORT_SYMBOL(devfreq_monitor_stop); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
by Guo Mengqi 15 May '24

15 May '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.8-rc4 commit 66951d98d9bf45ba25acf37fe0747253fafdf298 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNF6 CVE: CVE-2024-26661 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to ensure the tg is not NULL. Fixes: 474ac4a875ca ("drm/amd/display: Implement some asic specific abm call backs.") Cc: Yongqiang Sun <yongqiang.sun(a)amd.com> Cc: Anthony Koo <Anthony.Koo(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Anthony Koo <Anthony.Koo(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Liao Chen <liaochen4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c index 01f1d3d9a639..14abe2ce5073 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_hwseq.c @@ -179,9 +179,15 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx) void dcn21_set_pipe(struct pipe_ctx *pipe_ctx) { struct abm *abm = pipe_ctx->stream_res.abm; - uint32_t otg_inst = pipe_ctx->stream_res.tg->inst; + struct timing_generator *tg = pipe_ctx->stream_res.tg; struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl; struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu; + uint32_t otg_inst; + + if (!abm && !tg && !panel_cntl) + return; + + otg_inst = tg->inst; if (dmcu) { dce110_set_pipe(pipe_ctx); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] PM / devfreq: Synchronize devfreq_monitor_[start/stop]
by Guo Mengqi 15 May '24

15 May '24

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v5.10.210 commit 3399cc7013e761fee9d6eec795e9b31ab0cbe475 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNGK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 ] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1]. while true do echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor done It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled. Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted. [1] ... .. <idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a [ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 ... [ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff889edc155c [ 9436.262227][ C4] x1 : ffffff8001005200 x0 : ffffff80444f0428 [ 9436.262232][ C4] Call trace: [ 9436.262236][ C4] expire_timers+0x9c/0x438 [ 9436.262240][ C4] __run_timers+0x1f0/0x330 [ 9436.262245][ C4] run_timer_softirq+0x28/0x58 [ 9436.262255][ C4] efi_header_end+0x168/0x5ec [ 9436.262265][ C4] __irq_exit_rcu+0x108/0x124 [ 9436.262274][ C4] __handle_domain_irq+0x118/0x1e4 [ 9436.262282][ C4] gic_handle_irq.30369+0x6c/0x2bc [ 9436.262286][ C4] el0_irq_naked+0x60/0x6c Link: https://lore.kernel.org/all/1700860318-4025-1-git-send-email-quic_mojha@qui… Reported-by: Joyyoung Huang <huangzaiyang(a)oppo.com> Acked-by: MyungJoo Ham <myungjoo.ham(a)samsung.com> Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/devfreq/devfreq.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c index 829128c0cc68..7d38d583e4d4 100644 --- a/drivers/devfreq/devfreq.c +++ b/drivers/devfreq/devfreq.c @@ -438,10 +438,14 @@ static void devfreq_monitor(struct work_struct *work) if (err) dev_err(&devfreq->dev, "dvfs failed with (%d) error\n", err); + if (devfreq->stop_polling) + goto out; + queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); - mutex_unlock(&devfreq->lock); +out: + mutex_unlock(&devfreq->lock); trace_devfreq_monitor(devfreq); } @@ -459,6 +463,10 @@ void devfreq_monitor_start(struct devfreq *devfreq) if (devfreq->governor->interrupt_driven) return; + mutex_lock(&devfreq->lock); + if (delayed_work_pending(&devfreq->work)) + goto out; + switch (devfreq->profile->timer) { case DEVFREQ_TIMER_DEFERRABLE: INIT_DEFERRABLE_WORK(&devfreq->work, devfreq_monitor); @@ -467,12 +475,16 @@ void devfreq_monitor_start(struct devfreq *devfreq) INIT_DELAYED_WORK(&devfreq->work, devfreq_monitor); break; default: - return; + goto out; } if (devfreq->profile->polling_ms) queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); + +out: + devfreq->stop_polling = false; + mutex_unlock(&devfreq->lock); } EXPORT_SYMBOL(devfreq_monitor_start); @@ -489,6 +501,14 @@ void devfreq_monitor_stop(struct devfreq *devfreq) if (devfreq->governor->interrupt_driven) return; + mutex_lock(&devfreq->lock); + if (devfreq->stop_polling) { + mutex_unlock(&devfreq->lock); + return; + } + + devfreq->stop_polling = true; + mutex_unlock(&devfreq->lock); cancel_delayed_work_sync(&devfreq->work); } EXPORT_SYMBOL(devfreq_monitor_stop); -- 2.17.1

2 1

[PATCH OLK-5.10] ppp_async: limit MRU to 64K
by Guo Mengqi 15 May '24

15 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit b06e067e93fa4b98acfd3a9f38a398ab91bbc58b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNIJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cb88cb53badb8aeb3955ad6ce80b07b598e310b8 ] syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound flush_to_ldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 __do_kmalloc_node mm/slub.c:3969 [inline] __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3235 [inline] dev_alloc_skb include/linux/skbuff.h:3248 [inline] ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://lore.kernel.org/r/20240205171004.1059724-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/ppp/ppp_async.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c index f14a9d190de9..aada8a3c1821 100644 --- a/drivers/net/ppp/ppp_async.c +++ b/drivers/net/ppp/ppp_async.c @@ -471,6 +471,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg) case PPPIOCSMRU: if (get_user(val, p)) break; + if (val > U16_MAX) { + err = -EINVAL; + break; + } if (val < PPP_MRU) val = PPP_MRU; ap->mru = val; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] PM / devfreq: Synchronize devfreq_monitor_[start/stop]
by Guo Mengqi 15 May '24

15 May '24

From: Mukesh Ojha <quic_mojha(a)quicinc.com> stable inclusion from stable-v5.10.210 commit 3399cc7013e761fee9d6eec795e9b31ab0cbe475 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNGK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aed5ed595960c6d301dcd4ed31aeaa7a8054c0c6 ] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1]. while true do echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor done It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled. Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted. [1] ... .. <idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a [ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 ... [ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff889edc155c [ 9436.262227][ C4] x1 : ffffff8001005200 x0 : ffffff80444f0428 [ 9436.262232][ C4] Call trace: [ 9436.262236][ C4] expire_timers+0x9c/0x438 [ 9436.262240][ C4] __run_timers+0x1f0/0x330 [ 9436.262245][ C4] run_timer_softirq+0x28/0x58 [ 9436.262255][ C4] efi_header_end+0x168/0x5ec [ 9436.262265][ C4] __irq_exit_rcu+0x108/0x124 [ 9436.262274][ C4] __handle_domain_irq+0x118/0x1e4 [ 9436.262282][ C4] gic_handle_irq.30369+0x6c/0x2bc [ 9436.262286][ C4] el0_irq_naked+0x60/0x6c Link: https://lore.kernel.org/all/1700860318-4025-1-git-send-email-quic_mojha@qui… Reported-by: Joyyoung Huang <huangzaiyang(a)oppo.com> Acked-by: MyungJoo Ham <myungjoo.ham(a)samsung.com> Signed-off-by: Mukesh Ojha <quic_mojha(a)quicinc.com> Signed-off-by: Chanwoo Choi <cw00.choi(a)samsung.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/devfreq/devfreq.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c index 829128c0cc68..7d38d583e4d4 100644 --- a/drivers/devfreq/devfreq.c +++ b/drivers/devfreq/devfreq.c @@ -438,10 +438,14 @@ static void devfreq_monitor(struct work_struct *work) if (err) dev_err(&devfreq->dev, "dvfs failed with (%d) error\n", err); + if (devfreq->stop_polling) + goto out; + queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); - mutex_unlock(&devfreq->lock); +out: + mutex_unlock(&devfreq->lock); trace_devfreq_monitor(devfreq); } @@ -459,6 +463,10 @@ void devfreq_monitor_start(struct devfreq *devfreq) if (devfreq->governor->interrupt_driven) return; + mutex_lock(&devfreq->lock); + if (delayed_work_pending(&devfreq->work)) + goto out; + switch (devfreq->profile->timer) { case DEVFREQ_TIMER_DEFERRABLE: INIT_DEFERRABLE_WORK(&devfreq->work, devfreq_monitor); @@ -467,12 +475,16 @@ void devfreq_monitor_start(struct devfreq *devfreq) INIT_DELAYED_WORK(&devfreq->work, devfreq_monitor); break; default: - return; + goto out; } if (devfreq->profile->polling_ms) queue_delayed_work(devfreq_wq, &devfreq->work, msecs_to_jiffies(devfreq->profile->polling_ms)); + +out: + devfreq->stop_polling = false; + mutex_unlock(&devfreq->lock); } EXPORT_SYMBOL(devfreq_monitor_start); @@ -489,6 +501,14 @@ void devfreq_monitor_stop(struct devfreq *devfreq) if (devfreq->governor->interrupt_driven) return; + mutex_lock(&devfreq->lock); + if (devfreq->stop_polling) { + mutex_unlock(&devfreq->lock); + return; + } + + devfreq->stop_polling = true; + mutex_unlock(&devfreq->lock); cancel_delayed_work_sync(&devfreq->work); } EXPORT_SYMBOL(devfreq_monitor_stop); -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] ppp_async: limit MRU to 64K
by Guo Mengqi 15 May '24

15 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit b06e067e93fa4b98acfd3a9f38a398ab91bbc58b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNIJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cb88cb53badb8aeb3955ad6ce80b07b598e310b8 ] syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound flush_to_ldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 __do_kmalloc_node mm/slub.c:3969 [inline] __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3235 [inline] dev_alloc_skb include/linux/skbuff.h:3248 [inline] ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://lore.kernel.org/r/20240205171004.1059724-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/ppp/ppp_async.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c index f14a9d190de9..aada8a3c1821 100644 --- a/drivers/net/ppp/ppp_async.c +++ b/drivers/net/ppp/ppp_async.c @@ -471,6 +471,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg) case PPPIOCSMRU: if (get_user(val, p)) break; + if (val > U16_MAX) { + err = -EINVAL; + break; + } if (val < PPP_MRU) val = PPP_MRU; ap->mru = val; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] ppp_async: limit MRU to 64K
by Guo Mengqi 15 May '24

15 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit b06e067e93fa4b98acfd3a9f38a398ab91bbc58b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNIJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cb88cb53badb8aeb3955ad6ce80b07b598e310b8 ] syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound flush_to_ldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 __do_kmalloc_node mm/slub.c:3969 [inline] __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3235 [inline] dev_alloc_skb include/linux/skbuff.h:3248 [inline] ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://lore.kernel.org/r/20240205171004.1059724-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/ppp/ppp_async.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c index f14a9d190de9..aada8a3c1821 100644 --- a/drivers/net/ppp/ppp_async.c +++ b/drivers/net/ppp/ppp_async.c @@ -471,6 +471,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg) case PPPIOCSMRU: if (get_user(val, p)) break; + if (val > U16_MAX) { + err = -EINVAL; + break; + } if (val < PPP_MRU) val = PPP_MRU; ap->mru = val; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] ppp_async: limit MRU to 64K
by Guo Mengqi 15 May '24

15 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit b06e067e93fa4b98acfd3a9f38a398ab91bbc58b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNIJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cb88cb53badb8aeb3955ad6ce80b07b598e310b8 ] syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound flush_to_ldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 __do_kmalloc_node mm/slub.c:3969 [inline] __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3235 [inline] dev_alloc_skb include/linux/skbuff.h:3248 [inline] ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933(a)syzkaller.appspotmail.com Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://lore.kernel.org/r/20240205171004.1059724-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/net/ppp/ppp_async.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c index f14a9d190de9..aada8a3c1821 100644 --- a/drivers/net/ppp/ppp_async.c +++ b/drivers/net/ppp/ppp_async.c @@ -471,6 +471,10 @@ ppp_async_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg) case PPPIOCSMRU: if (get_user(val, p)) break; + if (val > U16_MAX) { + err = -EINVAL; + break; + } if (val < PPP_MRU) val = PPP_MRU; ap->mru = val; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/3] CVE-2024-26669
by Guo Mengqi 15 May '24

15 May '24

CVE-2024-26669 Ido Schimmel (1): net/sched: flower: Fix chain template offload Zhengchao Shao (2): net/sched: flower: Fix kabi change net/sched: flower: Fix unable to handle page fault bug in fl_init net/sched/cls_api.c | 20 ++++++++++++++++++++ net/sched/cls_flower.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) -- 2.17.1

2 4

[PATCH openEuler-22.03-LTS-SP1] netfilter: nft_limit: reject configurations that cause integer overflow
by Guo Mengqi 15 May '24

15 May '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.8-rc2 commit c9d9eb9c53d37cdebbad56b91e40baf42d5a97aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNPD CVE: CVE-2024-26668 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this rather than having incorrect ratelimit. Fixes: d2168e849ebf ("netfilter: nft_limit: add per-byte limiting") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_limit.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nft_limit.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c index 82ec27bdf941..19679938f6f1 100644 --- a/net/netfilter/nft_limit.c +++ b/net/netfilter/nft_limit.c @@ -54,16 +54,18 @@ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost) static int nft_limit_init(struct nft_limit *limit, const struct nlattr * const tb[], bool pkts) { - u64 unit, tokens; + u64 unit, tokens, rate_with_burst; if (tb[NFTA_LIMIT_RATE] == NULL || tb[NFTA_LIMIT_UNIT] == NULL) return -EINVAL; limit->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE])); + if (limit->rate == 0) + return -EINVAL; + unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT])); - limit->nsecs = unit * NSEC_PER_SEC; - if (limit->rate == 0 || limit->nsecs < unit) + if (check_mul_overflow(unit, ((u64)NSEC_PER_SEC), &limit->nsecs)) return -EOVERFLOW; if (tb[NFTA_LIMIT_BURST]) @@ -72,18 +74,25 @@ static int nft_limit_init(struct nft_limit *limit, if (pkts && limit->burst == 0) limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT; - if (limit->rate + limit->burst < limit->rate) + if (check_add_overflow(limit->rate, ((u64)limit->burst), &rate_with_burst)) return -EOVERFLOW; if (pkts) { - tokens = div64_u64(limit->nsecs, limit->rate) * limit->burst; + u64 tmp = div64_u64(limit->nsecs, limit->rate); + + if (check_mul_overflow(tmp, ((u64)limit->burst), &tokens)) + return -EOVERFLOW; } else { + u64 tmp; + /* The token bucket size limits the number of tokens can be * accumulated. tokens_max specifies the bucket size. * tokens_max = unit * (rate + burst) / rate. */ - tokens = div64_u64(limit->nsecs * (limit->rate + limit->burst), - limit->rate); + if (check_mul_overflow(limit->nsecs, rate_with_burst, &tmp)) + return -EOVERFLOW; + + tokens = div64_u64(tmp, limit->rate); } limit->tokens = tokens; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] netfilter: nft_limit: reject configurations that cause integer overflow
by Guo Mengqi 15 May '24

15 May '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.8-rc2 commit c9d9eb9c53d37cdebbad56b91e40baf42d5a97aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNPD CVE: CVE-2024-26668 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this rather than having incorrect ratelimit. Fixes: d2168e849ebf ("netfilter: nft_limit: add per-byte limiting") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_limit.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nft_limit.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c index 82ec27bdf941..19679938f6f1 100644 --- a/net/netfilter/nft_limit.c +++ b/net/netfilter/nft_limit.c @@ -54,16 +54,18 @@ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost) static int nft_limit_init(struct nft_limit *limit, const struct nlattr * const tb[], bool pkts) { - u64 unit, tokens; + u64 unit, tokens, rate_with_burst; if (tb[NFTA_LIMIT_RATE] == NULL || tb[NFTA_LIMIT_UNIT] == NULL) return -EINVAL; limit->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE])); + if (limit->rate == 0) + return -EINVAL; + unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT])); - limit->nsecs = unit * NSEC_PER_SEC; - if (limit->rate == 0 || limit->nsecs < unit) + if (check_mul_overflow(unit, ((u64)NSEC_PER_SEC), &limit->nsecs)) return -EOVERFLOW; if (tb[NFTA_LIMIT_BURST]) @@ -72,18 +74,25 @@ static int nft_limit_init(struct nft_limit *limit, if (pkts && limit->burst == 0) limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT; - if (limit->rate + limit->burst < limit->rate) + if (check_add_overflow(limit->rate, ((u64)limit->burst), &rate_with_burst)) return -EOVERFLOW; if (pkts) { - tokens = div64_u64(limit->nsecs, limit->rate) * limit->burst; + u64 tmp = div64_u64(limit->nsecs, limit->rate); + + if (check_mul_overflow(tmp, ((u64)limit->burst), &tokens)) + return -EOVERFLOW; } else { + u64 tmp; + /* The token bucket size limits the number of tokens can be * accumulated. tokens_max specifies the bucket size. * tokens_max = unit * (rate + burst) / rate. */ - tokens = div64_u64(limit->nsecs * (limit->rate + limit->burst), - limit->rate); + if (check_mul_overflow(limit->nsecs, rate_with_burst, &tmp)) + return -EOVERFLOW; + + tokens = div64_u64(tmp, limit->rate); } limit->tokens = tokens; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] inet: read sk->sk_family once in inet_recv_error()
by Guo Mengqi 15 May '24

15 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit 88081ba415224cf413101def4343d660f56d082b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNRC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eef00a82c568944f113f2de738156ac591bbd5cd ] inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning. Fixes: f4713a3dfad0 ("net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv4/af_inet.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 44c8ce187919..967c5b51d524 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -1609,10 +1609,12 @@ EXPORT_SYMBOL(inet_current_timestamp); int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) { - if (sk->sk_family == AF_INET) + unsigned int family = READ_ONCE(sk->sk_family); + + if (family == AF_INET) return ip_recv_error(sk, msg, len, addr_len); #if IS_ENABLED(CONFIG_IPV6) - if (sk->sk_family == AF_INET6) + if (family == AF_INET6) return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len); #endif return -EINVAL; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] netfilter: nft_limit: reject configurations that cause integer overflow
by Guo Mengqi 15 May '24

15 May '24

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.8-rc2 commit c9d9eb9c53d37cdebbad56b91e40baf42d5a97aa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNPD CVE: CVE-2024-26668 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its better to reject this rather than having incorrect ratelimit. Fixes: d2168e849ebf ("netfilter: nft_limit: add per-byte limiting") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_limit.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/nft_limit.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c index 82ec27bdf941..19679938f6f1 100644 --- a/net/netfilter/nft_limit.c +++ b/net/netfilter/nft_limit.c @@ -54,16 +54,18 @@ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost) static int nft_limit_init(struct nft_limit *limit, const struct nlattr * const tb[], bool pkts) { - u64 unit, tokens; + u64 unit, tokens, rate_with_burst; if (tb[NFTA_LIMIT_RATE] == NULL || tb[NFTA_LIMIT_UNIT] == NULL) return -EINVAL; limit->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE])); + if (limit->rate == 0) + return -EINVAL; + unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT])); - limit->nsecs = unit * NSEC_PER_SEC; - if (limit->rate == 0 || limit->nsecs < unit) + if (check_mul_overflow(unit, ((u64)NSEC_PER_SEC), &limit->nsecs)) return -EOVERFLOW; if (tb[NFTA_LIMIT_BURST]) @@ -72,18 +74,25 @@ static int nft_limit_init(struct nft_limit *limit, if (pkts && limit->burst == 0) limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT; - if (limit->rate + limit->burst < limit->rate) + if (check_add_overflow(limit->rate, ((u64)limit->burst), &rate_with_burst)) return -EOVERFLOW; if (pkts) { - tokens = div64_u64(limit->nsecs, limit->rate) * limit->burst; + u64 tmp = div64_u64(limit->nsecs, limit->rate); + + if (check_mul_overflow(tmp, ((u64)limit->burst), &tokens)) + return -EOVERFLOW; } else { + u64 tmp; + /* The token bucket size limits the number of tokens can be * accumulated. tokens_max specifies the bucket size. * tokens_max = unit * (rate + burst) / rate. */ - tokens = div64_u64(limit->nsecs * (limit->rate + limit->burst), - limit->rate); + if (check_mul_overflow(limit->nsecs, rate_with_burst, &tmp)) + return -EOVERFLOW; + + tokens = div64_u64(tmp, limit->rate); } limit->tokens = tokens; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] inet: read sk->sk_family once in inet_recv_error()
by Guo Mengqi 15 May '24

15 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit 88081ba415224cf413101def4343d660f56d082b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNRC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eef00a82c568944f113f2de738156ac591bbd5cd ] inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning. Fixes: f4713a3dfad0 ("net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv4/af_inet.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index e8afd3924d54..61f512f6a200 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -1609,10 +1609,12 @@ EXPORT_SYMBOL(inet_current_timestamp); int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) { - if (sk->sk_family == AF_INET) + unsigned int family = READ_ONCE(sk->sk_family); + + if (family == AF_INET) return ip_recv_error(sk, msg, len, addr_len); #if IS_ENABLED(CONFIG_IPV6) - if (sk->sk_family == AF_INET6) + if (family == AF_INET6) return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len); #endif return -EINVAL; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] inet: read sk->sk_family once in inet_recv_error()
by Guo Mengqi 15 May '24

15 May '24

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.210 commit 88081ba415224cf413101def4343d660f56d082b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNRC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eef00a82c568944f113f2de738156ac591bbd5cd ] inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning. Fixes: f4713a3dfad0 ("net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Willem de Bruijn <willemb(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv4/af_inet.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index ecd518d62e20..e73ecdd8f2b3 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -1609,10 +1609,12 @@ EXPORT_SYMBOL(inet_current_timestamp); int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) { - if (sk->sk_family == AF_INET) + unsigned int family = READ_ONCE(sk->sk_family); + + if (family == AF_INET) return ip_recv_error(sk, msg, len, addr_len); #if IS_ENABLED(CONFIG_IPV6) - if (sk->sk_family == AF_INET6) + if (family == AF_INET6) return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len); #endif return -EINVAL; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] um: time-travel: fix time corruption
by Guo Mengqi 15 May '24

15 May '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v5.15.149 commit 0c7478a2da3f5fe106b4658338873d50c86ac7ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNRR CVE: CVE-2023-52633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit abe4eaa8618bb36c2b33e9cdde0499296a23448c ] In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating the new time to push to, but before actually finishing that, the interrupt will set the time to a value that's incompatible with the forward, and we'll crash because time goes backwards when we do the forwarding. Fix this by reading the time_travel_time, calculating the adjustment, and doing the adjustment all with interrupts disabled. Reported-by: Vincent Whitchurch <Vincent.Whitchurch(a)axis.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- arch/um/kernel/time.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c index 8dafc3f2add4..a853d8a29476 100644 --- a/arch/um/kernel/time.c +++ b/arch/um/kernel/time.c @@ -374,9 +374,29 @@ static void time_travel_update_time(unsigned long long next, bool idle) time_travel_del_event(&ne); } +static void time_travel_update_time_rel(unsigned long long offs) +{ + unsigned long flags; + + /* + * Disable interrupts before calculating the new time so + * that a real timer interrupt (signal) can't happen at + * a bad time e.g. after we read time_travel_time but + * before we've completed updating the time. + */ + local_irq_save(flags); + time_travel_update_time(time_travel_time + offs, false); + local_irq_restore(flags); +} + void time_travel_ndelay(unsigned long nsec) { - time_travel_update_time(time_travel_time + nsec, false); + /* + * Not strictly needed to use _rel() version since this is + * only used in INFCPU/EXT modes, but it doesn't hurt and + * is more readable too. + */ + time_travel_update_time_rel(nsec); } EXPORT_SYMBOL(time_travel_ndelay); @@ -479,7 +499,11 @@ static int time_travel_connect_external(const char *socket) #define time_travel_start 0 #define time_travel_time 0 -static inline void time_travel_update_time(unsigned long long ns, bool retearly) +static inline void time_travel_update_time(unsigned long long ns, bool idle) +{ +} + +static inline void time_travel_update_time_rel(unsigned long long offs) { } @@ -624,9 +648,7 @@ static u64 timer_read(struct clocksource *cs) * to return from time_travel_update_time(). */ if (!irqs_disabled() && !in_interrupt() && !in_softirq()) - time_travel_update_time(time_travel_time + - TIMER_MULTIPLIER, - false); + time_travel_update_time_rel(TIMER_MULTIPLIER); return time_travel_time / TIMER_MULTIPLIER; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] um: time-travel: fix time corruption
by Guo Mengqi 15 May '24

15 May '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v5.15.149 commit 0c7478a2da3f5fe106b4658338873d50c86ac7ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNRR CVE: CVE-2023-52633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit abe4eaa8618bb36c2b33e9cdde0499296a23448c ] In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating the new time to push to, but before actually finishing that, the interrupt will set the time to a value that's incompatible with the forward, and we'll crash because time goes backwards when we do the forwarding. Fix this by reading the time_travel_time, calculating the adjustment, and doing the adjustment all with interrupts disabled. Reported-by: Vincent Whitchurch <Vincent.Whitchurch(a)axis.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- arch/um/kernel/time.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c index 8dafc3f2add4..a853d8a29476 100644 --- a/arch/um/kernel/time.c +++ b/arch/um/kernel/time.c @@ -374,9 +374,29 @@ static void time_travel_update_time(unsigned long long next, bool idle) time_travel_del_event(&ne); } +static void time_travel_update_time_rel(unsigned long long offs) +{ + unsigned long flags; + + /* + * Disable interrupts before calculating the new time so + * that a real timer interrupt (signal) can't happen at + * a bad time e.g. after we read time_travel_time but + * before we've completed updating the time. + */ + local_irq_save(flags); + time_travel_update_time(time_travel_time + offs, false); + local_irq_restore(flags); +} + void time_travel_ndelay(unsigned long nsec) { - time_travel_update_time(time_travel_time + nsec, false); + /* + * Not strictly needed to use _rel() version since this is + * only used in INFCPU/EXT modes, but it doesn't hurt and + * is more readable too. + */ + time_travel_update_time_rel(nsec); } EXPORT_SYMBOL(time_travel_ndelay); @@ -479,7 +499,11 @@ static int time_travel_connect_external(const char *socket) #define time_travel_start 0 #define time_travel_time 0 -static inline void time_travel_update_time(unsigned long long ns, bool retearly) +static inline void time_travel_update_time(unsigned long long ns, bool idle) +{ +} + +static inline void time_travel_update_time_rel(unsigned long long offs) { } @@ -624,9 +648,7 @@ static u64 timer_read(struct clocksource *cs) * to return from time_travel_update_time(). */ if (!irqs_disabled() && !in_interrupt() && !in_softirq()) - time_travel_update_time(time_travel_time + - TIMER_MULTIPLIER, - false); + time_travel_update_time_rel(TIMER_MULTIPLIER); return time_travel_time / TIMER_MULTIPLIER; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] um: time-travel: fix time corruption
by Guo Mengqi 15 May '24

15 May '24

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from stable-v5.15.149 commit 0c7478a2da3f5fe106b4658338873d50c86ac7ab category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNRR CVE: CVE-2023-52633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit abe4eaa8618bb36c2b33e9cdde0499296a23448c ] In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_read(), which pushes time forward just a little bit. Then, if we happen to get the interrupt after calculating the new time to push to, but before actually finishing that, the interrupt will set the time to a value that's incompatible with the forward, and we'll crash because time goes backwards when we do the forwarding. Fix this by reading the time_travel_time, calculating the adjustment, and doing the adjustment all with interrupts disabled. Reported-by: Vincent Whitchurch <Vincent.Whitchurch(a)axis.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- arch/um/kernel/time.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c index 8dafc3f2add4..a853d8a29476 100644 --- a/arch/um/kernel/time.c +++ b/arch/um/kernel/time.c @@ -374,9 +374,29 @@ static void time_travel_update_time(unsigned long long next, bool idle) time_travel_del_event(&ne); } +static void time_travel_update_time_rel(unsigned long long offs) +{ + unsigned long flags; + + /* + * Disable interrupts before calculating the new time so + * that a real timer interrupt (signal) can't happen at + * a bad time e.g. after we read time_travel_time but + * before we've completed updating the time. + */ + local_irq_save(flags); + time_travel_update_time(time_travel_time + offs, false); + local_irq_restore(flags); +} + void time_travel_ndelay(unsigned long nsec) { - time_travel_update_time(time_travel_time + nsec, false); + /* + * Not strictly needed to use _rel() version since this is + * only used in INFCPU/EXT modes, but it doesn't hurt and + * is more readable too. + */ + time_travel_update_time_rel(nsec); } EXPORT_SYMBOL(time_travel_ndelay); @@ -479,7 +499,11 @@ static int time_travel_connect_external(const char *socket) #define time_travel_start 0 #define time_travel_time 0 -static inline void time_travel_update_time(unsigned long long ns, bool retearly) +static inline void time_travel_update_time(unsigned long long ns, bool idle) +{ +} + +static inline void time_travel_update_time_rel(unsigned long long offs) { } @@ -624,9 +648,7 @@ static u64 timer_read(struct clocksource *cs) * to return from time_travel_update_time(). */ if (!irqs_disabled() && !in_interrupt() && !in_softirq()) - time_travel_update_time(time_travel_time + - TIMER_MULTIPLIER, - false); + time_travel_update_time_rel(TIMER_MULTIPLIER); return time_travel_time / TIMER_MULTIPLIER; } -- 2.17.1

2 1

2024

2023

2022

2021

2020

2019

Kernel