- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 5053/23811] drivers/platform/x86/.tmp_intel_atomisp2_pm.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 01 Oct '24

01 Oct '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5c63bd0fa5e86474d30ecd06d67f2393de081434 commit: 1073f9d006321689fb82bdac7b7af58e8617f128 [5053/23811] platform/x86: Add Intel AtomISP2 dummy / power-management driver config: x86_64-buildonly-randconfig-004-20240923 (https://download.01.org/0day-ci/archive/20241001/202410010410.oqbogdcw-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241001/202410010410.oqbogdcw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202410010410.oqbogdcw-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/platform/x86/intel_atomisp2_pm.c:15: include/linux/module.h:140:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'isp_pci_driver_exit': 'cold' [-Wmissing-attributes] 140 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1637:1: note: in expansion of macro 'module_exit' 1637 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/pci.h:1335:9: note: in expansion of macro 'module_driver' 1335 | module_driver(__pci_driver, pci_register_driver, pci_unregister_driver) | ^~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/pci.h:32, from drivers/platform/x86/intel_atomisp2_pm.c:17: drivers/platform/x86/intel_atomisp2_pm.c:115:19: note: 'cleanup_module' target declared here 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1633:20: note: in definition of macro 'module_driver' 1633 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:134:13: warning: 'init_module' specifies less restrictive attribute than its target 'isp_pci_driver_init': 'cold' [-Wmissing-attributes] 134 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1632:1: note: in expansion of macro 'module_init' 1632 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/pci.h:1335:9: note: in expansion of macro 'module_driver' 1335 | module_driver(__pci_driver, pci_register_driver, pci_unregister_driver) | ^~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:19: note: 'init_module' target declared here 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~ include/linux/device.h:1628:19: note: in definition of macro 'module_driver' 1628 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/platform/x86/intel_atomisp2_pm.c:115:1: note: in expansion of macro 'module_pci_driver' 115 | module_pci_driver(isp_pci_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/platform/x86/.tmp_intel_atomisp2_pm.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 16561/23811] mm/pin_mem.c:844:63: error: lvalue required as unary '&' operand
by kernel test robot 30 Sep '24

30 Sep '24

Hi Jingxian, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5c63bd0fa5e86474d30ecd06d67f2393de081434 commit: 1a378b87531ea80e7847bf0105adedff28a73080 [16561/23811] mm: add pin memory method for checkpoint add restore config: arm64-randconfig-004-20240930 (https://download.01.org/0day-ci/archive/20240930/202409302301.ZKaIRM0E-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409302301.ZKaIRM0E-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409302301.ZKaIRM0E-lkp@intel.com/ All errors (new ones prefixed by >>): mm/pin_mem.c:171:6: warning: no previous prototype for 'reserve_page_from_buddy' [-Wmissing-prototypes] 171 | void reserve_page_from_buddy(unsigned long nr_pages, struct page *page) | ^~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:254:6: warning: no previous prototype for 'free_user_map_pages' [-Wmissing-prototypes] 254 | void free_user_map_pages(unsigned int pid_index, unsigned int entry_index, unsigned int page_index) | ^~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:311:6: warning: no previous prototype for 'check_redirect_end_valid' [-Wmissing-prototypes] 311 | bool check_redirect_end_valid(struct redirect_info *redirect_start, | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:392:5: warning: no previous prototype for 'calculate_pin_mem_digest' [-Wmissing-prototypes] 392 | int calculate_pin_mem_digest(struct pin_mem_dump_info *pmdi, char *digest) | ^~~~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:481:5: warning: no previous prototype for 'collect_pmd_huge_pages' [-Wmissing-prototypes] 481 | int collect_pmd_huge_pages(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c:544:5: warning: no previous prototype for 'collect_normal_pages' [-Wmissing-prototypes] 544 | int collect_normal_pages(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~~ mm/pin_mem.c: In function 'collect_normal_pages': mm/pin_mem.c:549:26: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 549 | unsigned long i, nr_pages; | ^~~~~~~~ mm/pin_mem.c: At top level: mm/pin_mem.c:610:6: warning: no previous prototype for 'free_pin_pages' [-Wmissing-prototypes] 610 | void free_pin_pages(struct page_map_entry *pme) | ^~~~~~~~~~~~~~ mm/pin_mem.c:770:12: warning: no previous prototype for 'remap_normal_pages' [-Wmissing-prototypes] 770 | vm_fault_t remap_normal_pages(struct mm_struct *mm, struct vm_area_struct *vma, | ^~~~~~~~~~~~~~~~~~ mm/pin_mem.c: In function 'get_hugepage_gfpmask': >> mm/pin_mem.c:844:63: error: lvalue required as unary '&' operand 844 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:846:63: error: lvalue required as unary '&' operand 846 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:848:71: error: lvalue required as unary '&' operand 848 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c:851:65: error: lvalue required as unary '&' operand 851 | if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags)) | ^ mm/pin_mem.c: At top level: mm/pin_mem.c:857:12: warning: no previous prototype for 'remap_huge_pmd_pages' [-Wmissing-prototypes] 857 | vm_fault_t remap_huge_pmd_pages(struct mm_struct *mm, struct vm_area_struct *vma, | ^~~~~~~~~~~~~~~~~~~~ vim +844 mm/pin_mem.c 839 840 static inline gfp_t get_hugepage_gfpmask(struct vm_area_struct *vma) 841 { 842 const bool vma_madvised = !!(vma->vm_flags & VM_HUGEPAGE); 843 > 844 if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags)) 845 return GFP_TRANSHUGE | (vma_madvised ? 0 : __GFP_NORETRY); 846 if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags)) 847 return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM; 848 if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags)) 849 return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM : 850 __GFP_KSWAPD_RECLAIM); 851 if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags)) 852 return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM : 853 0); 854 return GFP_TRANSHUGE_LIGHT; 855 } 856 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5c63bd0fa5e86474d30ecd06d67f2393de081434
by kernel test robot 30 Sep '24

30 Sep '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5c63bd0fa5e86474d30ecd06d67f2393de081434 !11918 dhugetlb: make spin_lock irq save Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-__bio_stage_hierarchy_start | `-- include-linux-thread_info.h:warning:b-may-be-used-uninitialized |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- arm64-randconfig-002-20240930 | |-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) | |-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | |-- drivers-clocksource-arm_arch_timer.c:error:hisi_161010101_read_cntvct_el0-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- include-linux-kern_levels.h:warning:format-lx-expects-argument-of-type-long-unsigned-int-but-argument-has-type-const-long-unsigned-int | |-- include-linux-kern_levels.h:warning:format-p-expects-a-matching-void-argument | |-- include-linux-kern_levels.h:warning:format-p-expects-argument-of-type-void-but-argument-has-type-int | |-- mm-share_pool.c:error:HUGETLB_ALLOC_BUDDY-undeclared-(first-use-in-this-function) | |-- mm-share_pool.c:error:HUGETLB_ALLOC_NONE-undeclared-(first-use-in-this-function) | |-- mm-share_pool.c:error:implicit-declaration-of-function-huge_add_to_page_cache | |-- mm-share_pool.c:error:implicit-declaration-of-function-huge_pte_none | |-- mm-share_pool.c:error:implicit-declaration-of-function-huge_ptep_get | |-- mm-share_pool.c:error:implicit-declaration-of-function-hugetlb_alloc_hugepage | |-- mm-share_pool.c:error:implicit-declaration-of-function-hugetlb_count_add | |-- mm-share_pool.c:error:implicit-declaration-of-function-set_huge_pte_at | `-- mm-share_pool.c:error:invalid-initializer |-- arm64-randconfig-003-20240930 | |-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) | `-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) |-- arm64-randconfig-004-20240930 | |-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:compat_uptr_t-undeclared-(first-use-in-this-function) | |-- drivers-nvme-host-core.c:error:expected-before-ptrval | `-- mm-pin_mem.c:error:lvalue-required-as-unary-operand |-- x86_64-allnoconfig | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- block-blk-io-hierarchy-iodump.c:warning:no-previous-prototype-for-function-__bio_stage_hierarchy_start | `-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int |-- x86_64-buildonly-randconfig-001-20240930 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-buildonly-randconfig-002-20240930 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-004-20240930 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- drivers-pci-hotplug-pciehp_core.o:warning:objtool:missing-symbol-for-section-.init.text | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-buildonly-randconfig-005-20240930 | |-- arch-x86-power-.tmp_cpu.o:warning:objtool:missing-symbol-for-section-.exit.text | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-006-20240930 | |-- fs-gfs2-bmap.c:warning:lblock-may-be-used-uninitialized | `-- net-ax25-ax25_dev.o:warning:objtool:missing-symbol-for-section-.exit.text |-- x86_64-kexec | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-001-20240930 | `-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- x86_64-randconfig-006-20240930 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-011-20240930 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration |-- x86_64-randconfig-016-20240930 | `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration `-- x86_64-randconfig-075-20240930 `-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa-Werror-Wimplicit-function-declaration elapsed time: 724m configs tested: 36 configs skipped: 128 tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240930 gcc-14.1.0 arm64 randconfig-002-20240930 gcc-14.1.0 arm64 randconfig-003-20240930 gcc-14.1.0 arm64 randconfig-004-20240930 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240930 gcc-12 x86_64 buildonly-randconfig-002-20240930 clang-18 x86_64 buildonly-randconfig-003-20240930 gcc-12 x86_64 buildonly-randconfig-004-20240930 gcc-12 x86_64 buildonly-randconfig-005-20240930 clang-18 x86_64 buildonly-randconfig-006-20240930 gcc-12 x86_64 defconfig gcc-11 x86_64 kexec clang-18 x86_64 randconfig-001-20240930 gcc-12 x86_64 randconfig-002-20240930 clang-18 x86_64 randconfig-003-20240930 clang-18 x86_64 randconfig-004-20240930 clang-18 x86_64 randconfig-005-20240930 gcc-12 x86_64 randconfig-006-20240930 clang-18 x86_64 randconfig-011-20240930 clang-18 x86_64 randconfig-012-20240930 gcc-11 x86_64 randconfig-013-20240930 gcc-11 x86_64 randconfig-014-20240930 gcc-12 x86_64 randconfig-015-20240930 clang-18 x86_64 randconfig-016-20240930 clang-18 x86_64 randconfig-071-20240930 clang-18 x86_64 randconfig-072-20240930 gcc-12 x86_64 randconfig-073-20240930 clang-18 x86_64 randconfig-074-20240930 gcc-12 x86_64 randconfig-075-20240930 clang-18 x86_64 randconfig-076-20240930 gcc-12 x86_64 rhel-8.3 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 7330/14264] drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sriov.c:301:13: warning: 'check_ari_mode' defined but not used
by kernel test robot 30 Sep '24

30 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c594039dbf93789c67e3d7fe031bada7b7fc8aae commit: f27f159f8a8867f846422bb8f1e0f01ff1803bf0 [7330/14264] RNPGBE: NET: Fix wanrings config: loongarch-randconfig-001-20240930 (https://download.01.org/0day-ci/archive/20240930/202409301900.jvcSphIC-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240930/202409301900.jvcSphIC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409301900.jvcSphIC-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sriov.c:301:13: warning: 'check_ari_mode' defined but not used [-Wunused-function] 301 | static bool check_ari_mode(struct pci_dev *dev) | ^~~~~~~~~~~~~~ vim +/check_ari_mode +301 drivers/net/ethernet/mucse/rnpgbe/rnpgbe_sriov.c 300 > 301 static bool check_ari_mode(struct pci_dev *dev) 302 { 303 struct pci_bus *bus = dev->bus; 304 305 return bus->self && bus->self->ari_enabled; 306 } 307 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] rtmutex: Drop rt_mutex::wait_lock before scheduling
by Xiongfeng Wang 30 Sep '24

30 Sep '24

From: Roland Xu <mu001999(a)outlook.com> stable inclusion from stable-v4.19.322 commit 432efdbe7da5ecfcbc0c2180cfdbab1441752a38 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9M4 CVE: CVE-2024-46829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d33d26036a0274b472299d7dcdaa5fb34329f91b upstream. rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop. [ tglx: Moved unlock before the WARN(), removed the pointless comment, massaged changelog, added Fixes tag ] Fixes: 3d5c9340d194 ("rtmutex: Handle deadlock detection smarter") Signed-off-by: Roland Xu <mu001999(a)outlook.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/ME0P300MB063599BEF0743B8FA339C2CECC802@ME0P300M… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- kernel/locking/rtmutex.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c index 861e14ce1956..dffa14dee033 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c @@ -1241,6 +1241,7 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state, } static void rt_mutex_handle_deadlock(int res, int detect_deadlock, + struct rt_mutex *lock, struct rt_mutex_waiter *w) { /* @@ -1250,6 +1251,7 @@ static void rt_mutex_handle_deadlock(int res, int detect_deadlock, if (res != -EDEADLOCK || detect_deadlock) return; + raw_spin_unlock_irq(&lock->wait_lock); /* * Yell lowdly and stop the task right here. */ @@ -1305,7 +1307,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state, if (unlikely(ret)) { __set_current_state(TASK_RUNNING); remove_waiter(lock, &waiter); - rt_mutex_handle_deadlock(ret, chwalk, &waiter); + rt_mutex_handle_deadlock(ret, chwalk, lock, &waiter); } /* -- 2.20.1

2 1

[PATCH OLK-5.10] rtmutex: Drop rt_mutex::wait_lock before scheduling
by Xiongfeng Wang 30 Sep '24

30 Sep '24

From: Roland Xu <mu001999(a)outlook.com> stable inclusion from stable-v5.10.226 commit 1401da1486dc1cdbef6025fd74a3977df3a3e5d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9M4 CVE: CVE-2024-46829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d33d26036a0274b472299d7dcdaa5fb34329f91b upstream. rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop. [ tglx: Moved unlock before the WARN(), removed the pointless comment, massaged changelog, added Fixes tag ] Fixes: 3d5c9340d194 ("rtmutex: Handle deadlock detection smarter") Signed-off-by: Roland Xu <mu001999(a)outlook.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/ME0P300MB063599BEF0743B8FA339C2CECC802@ME0P300M… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- kernel/locking/rtmutex.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c index 9d24d2263a863..b909b559a36f4 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c @@ -1220,6 +1220,7 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state, } static void rt_mutex_handle_deadlock(int res, int detect_deadlock, + struct rt_mutex *lock, struct rt_mutex_waiter *w) { /* @@ -1229,6 +1230,7 @@ static void rt_mutex_handle_deadlock(int res, int detect_deadlock, if (res != -EDEADLOCK || detect_deadlock) return; + raw_spin_unlock_irq(&lock->wait_lock); /* * Yell lowdly and stop the task right here. */ @@ -1284,7 +1286,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state, if (unlikely(ret)) { __set_current_state(TASK_RUNNING); remove_waiter(lock, &waiter); - rt_mutex_handle_deadlock(ret, chwalk, &waiter); + rt_mutex_handle_deadlock(ret, chwalk, lock, &waiter); } /* -- 2.20.1

2 1

[PATCH openEuler-22.03-LTS-SP1] rtmutex: Drop rt_mutex::wait_lock before scheduling
by Xiongfeng Wang 30 Sep '24

30 Sep '24

From: Roland Xu <mu001999(a)outlook.com> stable inclusion from stable-v5.10.226 commit 1401da1486dc1cdbef6025fd74a3977df3a3e5d0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9M4 CVE: CVE-2024-46829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d33d26036a0274b472299d7dcdaa5fb34329f91b upstream. rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop. [ tglx: Moved unlock before the WARN(), removed the pointless comment, massaged changelog, added Fixes tag ] Fixes: 3d5c9340d194 ("rtmutex: Handle deadlock detection smarter") Signed-off-by: Roland Xu <mu001999(a)outlook.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/ME0P300MB063599BEF0743B8FA339C2CECC802@ME0P300M… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- kernel/locking/rtmutex.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c index a82d1176e7c6a..7bce39e7fec0e 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c @@ -1184,6 +1184,7 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state, } static void rt_mutex_handle_deadlock(int res, int detect_deadlock, + struct rt_mutex *lock, struct rt_mutex_waiter *w) { /* @@ -1193,6 +1194,7 @@ static void rt_mutex_handle_deadlock(int res, int detect_deadlock, if (res != -EDEADLOCK || detect_deadlock) return; + raw_spin_unlock_irq(&lock->wait_lock); /* * Yell lowdly and stop the task right here. */ @@ -1248,7 +1250,7 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state, if (unlikely(ret)) { __set_current_state(TASK_RUNNING); remove_waiter(lock, &waiter); - rt_mutex_handle_deadlock(ret, chwalk, &waiter); + rt_mutex_handle_deadlock(ret, chwalk, lock, &waiter); } /* -- 2.20.1

2 1

[PATCH OLK-6.6] rtmutex: Drop rt_mutex::wait_lock before scheduling
by Xiongfeng Wang 30 Sep '24

30 Sep '24

From: Roland Xu <mu001999(a)outlook.com> stable inclusion from stable-v6.6.51 commit 85f03ca98e07cd0786738b56ae73740bce0ac27f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9M4 CVE: CVE-2024-46829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d33d26036a0274b472299d7dcdaa5fb34329f91b upstream. rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop. [ tglx: Moved unlock before the WARN(), removed the pointless comment, massaged changelog, added Fixes tag ] Fixes: 3d5c9340d194 ("rtmutex: Handle deadlock detection smarter") Signed-off-by: Roland Xu <mu001999(a)outlook.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/ME0P300MB063599BEF0743B8FA339C2CECC802@ME0P300M… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- kernel/locking/rtmutex.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c index 21db0df0eb00..bf3a28ee7d8f 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c @@ -1624,6 +1624,7 @@ static int __sched rt_mutex_slowlock_block(struct rt_mutex_base *lock, } static void __sched rt_mutex_handle_deadlock(int res, int detect_deadlock, + struct rt_mutex_base *lock, struct rt_mutex_waiter *w) { /* @@ -1636,10 +1637,10 @@ static void __sched rt_mutex_handle_deadlock(int res, int detect_deadlock, if (build_ww_mutex() && w->ww_ctx) return; - /* - * Yell loudly and stop the task right here. - */ + raw_spin_unlock_irq(&lock->wait_lock); + WARN(1, "rtmutex deadlock detected\n"); + while (1) { set_current_state(TASK_INTERRUPTIBLE); schedule(); @@ -1693,7 +1694,7 @@ static int __sched __rt_mutex_slowlock(struct rt_mutex_base *lock, } else { __set_current_state(TASK_RUNNING); remove_waiter(lock, waiter); - rt_mutex_handle_deadlock(ret, chwalk, waiter); + rt_mutex_handle_deadlock(ret, chwalk, lock, waiter); } /* -- 2.20.1

2 1

[PATCH OLK-6.6] dma-buf: heaps: Fix off-by-one in CMA heap fault handler
by Xiongfeng Wang 30 Sep '24

30 Sep '24

From: "T.J. Mercier" <tjmercier(a)google.com> mainline inclusion from mainline-v6.11 commit ea5ff5d351b520524019f7ff7f9ce418de2dad87 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9M8 CVE: CVE-2024-46852 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps: Don't track CMA dma-buf pages under RssFile") it was possible to obtain a mapping larger than the buffer size via mremap and bypass the overflow check in dma_buf_mmap_internal. When using such a mapping to attempt to fault past the end of the buffer, the CMA heap fault handler also checks the fault offset against the buffer size, but gets the boundary wrong by 1. Fix the boundary check so that we don't read off the end of the pages array and insert an arbitrary page in the mapping. Reported-by: Xingyu Jin <xingyuj(a)google.com> Fixes: a5d2d29e24be ("dma-buf: heaps: Move heap-helper logic into the cma_heap implementation") Cc: stable(a)vger.kernel.org # Applicable >= 5.10. Needs adjustments only for 5.10. Signed-off-by: T.J. Mercier <tjmercier(a)google.com> Acked-by: John Stultz <jstultz(a)google.com> Signed-off-by: Sumit Semwal <sumit.semwal(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20240830192627.2546033-1-tjme… Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/dma-buf/heaps/cma_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma-buf/heaps/cma_heap.c b/drivers/dma-buf/heaps/cma_heap.c index ee899f8e6721..bea7e574f916 100644 --- a/drivers/dma-buf/heaps/cma_heap.c +++ b/drivers/dma-buf/heaps/cma_heap.c @@ -165,7 +165,7 @@ static vm_fault_t cma_heap_vm_fault(struct vm_fault *vmf) struct vm_area_struct *vma = vmf->vma; struct cma_heap_buffer *buffer = vma->vm_private_data; - if (vmf->pgoff > buffer->pagecount) + if (vmf->pgoff >= buffer->pagecount) return VM_FAULT_SIGBUS; vmf->page = buffer->pages[vmf->pgoff]; -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2024-44958 for 4.19
by Zheng Zucheng 30 Sep '24

30 Sep '24

Yang Yingliang (2): sched/smt: Introduce sched_smt_present_inc/dec() helper sched/smt: Fix unbalance sched_smt_present dec/inc Zheng Zucheng (1): sched: Revert fix unbalance sched_smt_present dec/inc kernel/sched/core.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 4