Re: [PATCH v3 1/1] psi: Fix uaf issue when psi trigger is destroyed while being polled
by kernel test robot
Hi Suren,
I love your patch! Perhaps something to improve:
[auto build test WARNING on linux/master]
[also build test WARNING on tj-cgroup/for-next linus/master v5.16 next-20220112]
[cannot apply to tip/sched/core]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Suren-Baghdasaryan/psi-Fix-uaf-i...
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fe8152b38d3a994c4c6fdbc0cd6551d569a5715a
config: s390-randconfig-r011-20220112 (https://download.01.org/0day-ci/archive/20220113/202201130006.50syZ3rt-lk...)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 244dd2913a43a200f5a6544d424cdc37b771028b)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install s390 cross compiling tool for clang build
# apt-get install binutils-s390x-linux-gnu
# https://github.com/0day-ci/linux/commit/81c75158e8d3b743a8bdc51cec94b938c...
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Suren-Baghdasaryan/psi-Fix-uaf-issue-when-psi-trigger-is-destroyed-while-being-polled/20220112-072341
git checkout 81c75158e8d3b743a8bdc51cec94b938c027286d
# save the config file to linux build tree
mkdir build_dir
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=s390 SHELL=/bin/bash kernel/sched/
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All warnings (new ones prefixed by >>):
In file included from kernel/sched/psi.c:146:
In file included from kernel/sched/sched.h:17:
In file included from include/linux/sched/isolation.h:6:
In file included from include/linux/tick.h:8:
In file included from include/linux/clockchips.h:14:
In file included from include/linux/clocksource.h:22:
In file included from arch/s390/include/asm/io.h:75:
include/asm-generic/io.h:464:31: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
val = __raw_readb(PCI_IOBASE + addr);
~~~~~~~~~~ ^
include/asm-generic/io.h:477:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
val = __le16_to_cpu((__le16 __force)__raw_readw(PCI_IOBASE + addr));
~~~~~~~~~~ ^
include/uapi/linux/byteorder/big_endian.h:37:59: note: expanded from macro '__le16_to_cpu'
#define __le16_to_cpu(x) __swab16((__force __u16)(__le16)(x))
^
include/uapi/linux/swab.h:102:54: note: expanded from macro '__swab16'
#define __swab16(x) (__u16)__builtin_bswap16((__u16)(x))
^
In file included from kernel/sched/psi.c:146:
In file included from kernel/sched/sched.h:17:
In file included from include/linux/sched/isolation.h:6:
In file included from include/linux/tick.h:8:
In file included from include/linux/clockchips.h:14:
In file included from include/linux/clocksource.h:22:
In file included from arch/s390/include/asm/io.h:75:
include/asm-generic/io.h:490:61: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
val = __le32_to_cpu((__le32 __force)__raw_readl(PCI_IOBASE + addr));
~~~~~~~~~~ ^
include/uapi/linux/byteorder/big_endian.h:35:59: note: expanded from macro '__le32_to_cpu'
#define __le32_to_cpu(x) __swab32((__force __u32)(__le32)(x))
^
include/uapi/linux/swab.h:115:54: note: expanded from macro '__swab32'
#define __swab32(x) (__u32)__builtin_bswap32((__u32)(x))
^
In file included from kernel/sched/psi.c:146:
In file included from kernel/sched/sched.h:17:
In file included from include/linux/sched/isolation.h:6:
In file included from include/linux/tick.h:8:
In file included from include/linux/clockchips.h:14:
In file included from include/linux/clocksource.h:22:
In file included from arch/s390/include/asm/io.h:75:
include/asm-generic/io.h:501:33: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
__raw_writeb(value, PCI_IOBASE + addr);
~~~~~~~~~~ ^
include/asm-generic/io.h:511:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
__raw_writew((u16 __force)cpu_to_le16(value), PCI_IOBASE + addr);
~~~~~~~~~~ ^
include/asm-generic/io.h:521:59: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
__raw_writel((u32 __force)cpu_to_le32(value), PCI_IOBASE + addr);
~~~~~~~~~~ ^
include/asm-generic/io.h:609:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
readsb(PCI_IOBASE + addr, buffer, count);
~~~~~~~~~~ ^
include/asm-generic/io.h:617:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
readsw(PCI_IOBASE + addr, buffer, count);
~~~~~~~~~~ ^
include/asm-generic/io.h:625:20: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
readsl(PCI_IOBASE + addr, buffer, count);
~~~~~~~~~~ ^
include/asm-generic/io.h:634:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
writesb(PCI_IOBASE + addr, buffer, count);
~~~~~~~~~~ ^
include/asm-generic/io.h:643:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
writesw(PCI_IOBASE + addr, buffer, count);
~~~~~~~~~~ ^
include/asm-generic/io.h:652:21: warning: performing pointer arithmetic on a null pointer has undefined behavior [-Wnull-pointer-arithmetic]
writesl(PCI_IOBASE + addr, buffer, count);
~~~~~~~~~~ ^
kernel/sched/psi.c:1112:21: warning: no previous prototype for function 'psi_trigger_create' [-Wmissing-prototypes]
struct psi_trigger *psi_trigger_create(struct psi_group *group,
^
kernel/sched/psi.c:1112:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
struct psi_trigger *psi_trigger_create(struct psi_group *group,
^
static
>> kernel/sched/psi.c:1182:6: warning: no previous prototype for function 'psi_trigger_destroy' [-Wmissing-prototypes]
void psi_trigger_destroy(struct psi_trigger *t)
^
kernel/sched/psi.c:1182:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
void psi_trigger_destroy(struct psi_trigger *t)
^
static
kernel/sched/psi.c:1249:10: warning: no previous prototype for function 'psi_trigger_poll' [-Wmissing-prototypes]
__poll_t psi_trigger_poll(void **trigger_ptr,
^
kernel/sched/psi.c:1249:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
__poll_t psi_trigger_poll(void **trigger_ptr,
^
static
15 warnings generated.
vim +/psi_trigger_destroy +1182 kernel/sched/psi.c
1181
> 1182 void psi_trigger_destroy(struct psi_trigger *t)
1183 {
1184 struct psi_group *group;
1185 struct task_struct *task_to_destroy = NULL;
1186
1187 /*
1188 * We do not check psi_disabled since it might have been disabled after
1189 * the trigger got created.
1190 */
1191 if (!t)
1192 return;
1193
1194 group = t->group;
1195 /*
1196 * Wakeup waiters to stop polling. Can happen if cgroup is deleted
1197 * from under a polling process.
1198 */
1199 wake_up_interruptible(&t->event_wait);
1200
1201 mutex_lock(&group->trigger_lock);
1202
1203 if (!list_empty(&t->node)) {
1204 struct psi_trigger *tmp;
1205 u64 period = ULLONG_MAX;
1206
1207 list_del(&t->node);
1208 group->nr_triggers[t->state]--;
1209 if (!group->nr_triggers[t->state])
1210 group->poll_states &= ~(1 << t->state);
1211 /* reset min update period for the remaining triggers */
1212 list_for_each_entry(tmp, &group->triggers, node)
1213 period = min(period, div_u64(tmp->win.size,
1214 UPDATES_PER_WINDOW));
1215 group->poll_min_period = period;
1216 /* Destroy poll_task when the last trigger is destroyed */
1217 if (group->poll_states == 0) {
1218 group->polling_until = 0;
1219 task_to_destroy = rcu_dereference_protected(
1220 group->poll_task,
1221 lockdep_is_held(&group->trigger_lock));
1222 rcu_assign_pointer(group->poll_task, NULL);
1223 del_timer(&group->poll_timer);
1224 }
1225 }
1226
1227 mutex_unlock(&group->trigger_lock);
1228
1229 /*
1230 * Wait for psi_schedule_poll_work RCU to complete its read-side
1231 * critical section before destroying the trigger and optionally the
1232 * poll_task.
1233 */
1234 synchronize_rcu();
1235 /*
1236 * Stop kthread 'psimon' after releasing trigger_lock to prevent a
1237 * deadlock while waiting for psi_poll_work to acquire trigger_lock
1238 */
1239 if (task_to_destroy) {
1240 /*
1241 * After the RCU grace period has expired, the worker
1242 * can no longer be found through group->poll_task.
1243 */
1244 kthread_stop(task_to_destroy);
1245 }
1246 kfree(t);
1247 }
1248
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
8 months, 1 week
Re: [PATCH v2 2/2] one-bit-adc-dac: Add initial version of one bit ADC-DAC
by kernel test robot
Hi Cristian,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on jic23-iio/togreg]
[also build test WARNING on next-20220112]
[cannot apply to v5.16]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Cristian-Pop/dt-bindings-iio-add...
base: https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio.git togreg
config: i386-allyesconfig (https://download.01.org/0day-ci/archive/20220113/202201130058.u8Hmc486-lk...)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce (this is a W=1 build):
# https://github.com/0day-ci/linux/commit/d68b55a2493d868d6464f86ba93ff0926...
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Cristian-Pop/dt-bindings-iio-addac-one-bit-adc-dac-yaml-documentation/20220111-194908
git checkout d68b55a2493d868d6464f86ba93ff092613cae76
# save the config file to linux build tree
mkdir build_dir
make W=1 O=build_dir ARCH=i386 SHELL=/bin/bash drivers/gpu/drm/vmwgfx/ drivers/iio/addac/
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All warnings (new ones prefixed by >>):
drivers/iio/addac/one-bit-adc-dac.c: In function 'one_bit_adc_dac_set_channel_label':
>> drivers/iio/addac/one-bit-adc-dac.c:115:24: warning: variable 'chan' set but not used [-Wunused-but-set-variable]
115 | struct iio_chan_spec *chan;
| ^~~~
vim +/chan +115 drivers/iio/addac/one-bit-adc-dac.c
106
107 static int one_bit_adc_dac_set_channel_label(struct iio_dev *indio_dev,
108 struct iio_chan_spec *channels,
109 int num_channels)
110 {
111 struct device *device = indio_dev->dev.parent;
112 struct one_bit_adc_dac_state *st = iio_priv(indio_dev);
113 struct fwnode_handle *fwnode;
114 struct fwnode_handle *child;
> 115 struct iio_chan_spec *chan;
116 const char *label;
117 int crt_ch = 0, child_num, i = 0;
118
119 fwnode = dev_fwnode(device);
120 child_num = device_get_child_node_count(device);
121
122 st->labels = devm_kzalloc(device, sizeof(*st->labels) * child_num, GFP_KERNEL);
123 if (!st->labels)
124 return -ENOMEM;
125
126 i = child_num;
127 fwnode_for_each_child_node(fwnode, child) {
128 if (fwnode_property_read_u32(child, "reg", &crt_ch))
129 continue;
130
131 if (crt_ch >= num_channels)
132 continue;
133
134 if (fwnode_property_read_string(child, "label", &label))
135 continue;
136
137 chan = &channels[crt_ch];
138 st->labels[--i] = label;
139 }
140
141 return 0;
142 }
143
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
8 months, 1 week
Re: [PATCH V4 3/5] tty: serial: meson: The UART baud rate
by kernel test robot
Hi Yu,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on tty/tty-testing]
[also build test ERROR on next-20220112]
[cannot apply to robh/for-next soc/for-next clk/clk-next v5.16]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Yu-Tu/the-UART-driver-compatible...
base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git tty-testing
config: m68k-randconfig-m031-20220112 (https://download.01.org/0day-ci/archive/20220113/202201130013.KVlPG5Gj-lk...)
compiler: m68k-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/6d55159e6626326d9001d4c8f20b914a6...
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Yu-Tu/the-UART-driver-compatible-with/20220110-170020
git checkout 6d55159e6626326d9001d4c8f20b914a69c2c40b
# save the config file to linux build tree
mkdir build_dir
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=m68k SHELL=/bin/bash
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All errors (new ones prefixed by >>):
m68k-linux-ld: arch/m68k/kernel/machine_kexec.o: in function `machine_kexec':
machine_kexec.c:(.text+0x6a): undefined reference to `m68k_mmutype'
m68k-linux-ld: machine_kexec.c:(.text+0x72): undefined reference to `m68k_cputype'
m68k-linux-ld: arch/m68k/kernel/relocate_kernel.o:(.m68k_fixup+0x0): undefined reference to `M68K_FIXUP_MEMOFFSET'
m68k-linux-ld: arch/m68k/kernel/relocate_kernel.o:(.m68k_fixup+0x8): undefined reference to `M68K_FIXUP_MEMOFFSET'
m68k-linux-ld: arch/m68k/kernel/uboot.o: in function `process_uboot_commandline':
uboot.c:(.init.text+0x32): undefined reference to `_init_sp'
m68k-linux-ld: drivers/tty/serial/meson_uart.o: in function `meson_uart_probe_clocks':
meson_uart.c:(.text+0x4de): undefined reference to `__clk_get_name'
>> m68k-linux-ld: meson_uart.c:(.text+0x53c): undefined reference to `__devm_clk_hw_register_divider'
>> m68k-linux-ld: meson_uart.c:(.text+0x5a8): undefined reference to `__devm_clk_hw_register_mux'
>> m68k-linux-ld: meson_uart.c:(.text+0x5c0): undefined reference to `clk_hw_get_rate'
>> m68k-linux-ld: meson_uart.c:(.text+0x5d2): undefined reference to `clk_hw_get_name'
m68k-linux-ld: meson_uart.c:(.text+0x622): undefined reference to `__devm_clk_hw_register_divider'
>> m68k-linux-ld: meson_uart.c:(.text+0x63c): undefined reference to `clk_hw_get_clk'
>> m68k-linux-ld: meson_uart.c:(.text+0x666): undefined reference to `__clk_get_name'
>> m68k-linux-ld: meson_uart.c:(.text+0x6ae): undefined reference to `devm_clk_hw_register_fixed_factor'
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
8 months, 1 week
Re: [PATCH] mm/vmstat: add event for ksm swapping in copy
by kernel test robot
Hi,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on hnaz-mm/master]
url: https://github.com/0day-ci/linux/commits/cgel-zte-gmail-com/mm-vmstat-add...
base: https://github.com/hnaz/linux-mm master
config: alpha-buildonly-randconfig-r004-20220112 (https://download.01.org/0day-ci/archive/20220112/202201122306.EC6LSwot-lk...)
compiler: alpha-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/56a4520e557228d8383f27b6aef54b2f9...
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review cgel-zte-gmail-com/mm-vmstat-add-event-for-ksm-swapping-in-copy/20220112-195303
git checkout 56a4520e557228d8383f27b6aef54b2f931a0588
# save the config file to linux build tree
mkdir build_dir
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=alpha SHELL=/bin/bash
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All errors (new ones prefixed by >>):
mm/ksm.c: In function 'ksm_might_need_to_copy':
>> mm/ksm.c:2597:32: error: 'KSM_SWPIN_COPY' undeclared (first use in this function)
2597 | count_vm_event(KSM_SWPIN_COPY);
| ^~~~~~~~~~~~~~
mm/ksm.c:2597:32: note: each undeclared identifier is reported only once for each function it appears in
vim +/KSM_SWPIN_COPY +2597 mm/ksm.c
2565
2566 struct page *ksm_might_need_to_copy(struct page *page,
2567 struct vm_area_struct *vma, unsigned long address)
2568 {
2569 struct anon_vma *anon_vma = page_anon_vma(page);
2570 struct page *new_page;
2571
2572 if (PageKsm(page)) {
2573 if (page_stable_node(page) &&
2574 !(ksm_run & KSM_RUN_UNMERGE))
2575 return page; /* no need to copy it */
2576 } else if (!anon_vma) {
2577 return page; /* no need to copy it */
2578 } else if (anon_vma->root == vma->anon_vma->root &&
2579 page->index == linear_page_index(vma, address)) {
2580 return page; /* still no need to copy it */
2581 }
2582 if (!PageUptodate(page))
2583 return page; /* let do_swap_page report the error */
2584
2585 new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
2586 if (new_page &&
2587 mem_cgroup_charge(page_folio(new_page), vma->vm_mm, GFP_KERNEL)) {
2588 put_page(new_page);
2589 new_page = NULL;
2590 }
2591 if (new_page) {
2592 copy_user_highpage(new_page, page, address, vma);
2593
2594 SetPageDirty(new_page);
2595 __SetPageUptodate(new_page);
2596 __SetPageLocked(new_page);
> 2597 count_vm_event(KSM_SWPIN_COPY);
2598 }
2599
2600 return new_page;
2601 }
2602
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
8 months, 1 week
Re: [PATCH v4 05/10] usb: gadget: f_uac2: Support multiple sampling rates
by kernel test robot
Hi Pavel,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on usb/usb-testing]
[also build test WARNING on next-20220112]
[cannot apply to linus/master balbi-usb/testing/next peter-chen-usb/for-usb-next v5.16]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Pavel-Hofman/usb-gadget-audio-Mu...
base: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
config: i386-randconfig-s001 (https://download.01.org/0day-ci/archive/20220112/202201122317.eiQOLXzP-lk...)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce:
# apt-get install sparse
# sparse version: v0.6.4-dirty
# https://github.com/0day-ci/linux/commit/275344f5925d7804375e3572fd2fbd1fe...
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Pavel-Hofman/usb-gadget-audio-Multiple-rates-notify/20220110-154453
git checkout 275344f5925d7804375e3572fd2fbd1febb029a6
# save the config file to linux build tree
mkdir build_dir
make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' O=build_dir ARCH=i386 SHELL=/bin/bash drivers/usb/gadget/function/
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
sparse warnings: (new ones prefixed by >>)
>> drivers/usb/gadget/function/f_uac2.c:1553:33: sparse: sparse: restricted __le16 degrades to integer
>> drivers/usb/gadget/function/f_uac2.c:1553:33: sparse: sparse: restricted __le16 degrades to integer
>> drivers/usb/gadget/function/f_uac2.c:1553:33: sparse: sparse: restricted __le16 degrades to integer
>> drivers/usb/gadget/function/f_uac2.c:1553:33: sparse: sparse: restricted __le16 degrades to integer
>> drivers/usb/gadget/function/f_uac2.c:1553:33: sparse: sparse: restricted __le16 degrades to integer
>> drivers/usb/gadget/function/f_uac2.c:1553:33: sparse: sparse: restricted __le16 degrades to integer
drivers/usb/gadget/function/f_uac2.c:1625:15: sparse: sparse: cast to restricted __le32
vim +1553 drivers/usb/gadget/function/f_uac2.c
1511
1512 static int
1513 in_rq_range(struct usb_function *fn, const struct usb_ctrlrequest *cr)
1514 {
1515 struct usb_request *req = fn->config->cdev->req;
1516 struct g_audio *agdev = func_to_g_audio(fn);
1517 struct f_uac2_opts *opts = g_audio_to_uac2_opts(agdev);
1518 u16 w_length = le16_to_cpu(cr->wLength);
1519 u16 w_index = le16_to_cpu(cr->wIndex);
1520 u16 w_value = le16_to_cpu(cr->wValue);
1521 u8 entity_id = (w_index >> 8) & 0xff;
1522 u8 control_selector = w_value >> 8;
1523 int value = -EOPNOTSUPP;
1524
1525 if ((entity_id == USB_IN_CLK_ID) || (entity_id == USB_OUT_CLK_ID)) {
1526 if (control_selector == UAC2_CS_CONTROL_SAM_FREQ) {
1527 struct cntrl_ranges_lay3_srates rs;
1528 int i;
1529 int wNumSubRanges = 0;
1530 int srate;
1531 int *srates;
1532
1533 if (entity_id == USB_IN_CLK_ID)
1534 srates = opts->p_srates;
1535 else if (entity_id == USB_OUT_CLK_ID)
1536 srates = opts->c_srates;
1537 else
1538 return -EOPNOTSUPP;
1539 for (i = 0; i < UAC_MAX_RATES; i++) {
1540 srate = srates[i];
1541 if (srate == 0)
1542 break;
1543
1544 rs.r[wNumSubRanges].dMIN = cpu_to_le32(srate);
1545 rs.r[wNumSubRanges].dMAX = cpu_to_le32(srate);
1546 rs.r[wNumSubRanges].dRES = 0;
1547 wNumSubRanges++;
1548 dev_dbg(&agdev->gadget->dev,
1549 "%s(): clk %d: rate ID %d: %d\n",
1550 __func__, entity_id, wNumSubRanges, srate);
1551 }
1552 rs.wNumSubRanges = cpu_to_le16(wNumSubRanges);
> 1553 value = min_t(unsigned int, w_length, ranges_lay3_size(rs));
1554 dev_dbg(&agdev->gadget->dev, "%s(): sending %d rates, size %d\n",
1555 __func__, rs.wNumSubRanges, value);
1556 memcpy(req->buf, &rs, value);
1557 } else {
1558 dev_err(&agdev->gadget->dev,
1559 "%s:%d control_selector=%d TODO!\n",
1560 __func__, __LINE__, control_selector);
1561 }
1562 } else if ((FUIN_EN(opts) && (entity_id == USB_IN_FU_ID)) ||
1563 (FUOUT_EN(opts) && (entity_id == USB_OUT_FU_ID))) {
1564 unsigned int is_playback = 0;
1565
1566 if (FUIN_EN(opts) && (entity_id == USB_IN_FU_ID))
1567 is_playback = 1;
1568
1569 if (control_selector == UAC_FU_VOLUME) {
1570 struct cntrl_range_lay2 r;
1571 s16 max_db, min_db, res_db;
1572
1573 if (is_playback) {
1574 max_db = opts->p_volume_max;
1575 min_db = opts->p_volume_min;
1576 res_db = opts->p_volume_res;
1577 } else {
1578 max_db = opts->c_volume_max;
1579 min_db = opts->c_volume_min;
1580 res_db = opts->c_volume_res;
1581 }
1582
1583 r.wMAX = cpu_to_le16(max_db);
1584 r.wMIN = cpu_to_le16(min_db);
1585 r.wRES = cpu_to_le16(res_db);
1586 r.wNumSubRanges = cpu_to_le16(1);
1587
1588 value = min_t(unsigned int, w_length, sizeof(r));
1589 memcpy(req->buf, &r, value);
1590 } else {
1591 dev_err(&agdev->gadget->dev,
1592 "%s:%d control_selector=%d TODO!\n",
1593 __func__, __LINE__, control_selector);
1594 }
1595 } else {
1596 dev_err(&agdev->gadget->dev,
1597 "%s:%d entity_id=%d control_selector=%d TODO!\n",
1598 __func__, __LINE__, entity_id, control_selector);
1599 }
1600
1601 return value;
1602 }
1603
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
8 months, 1 week
drivers/regulator/max20086-regulator.c:288:34: warning: unused variable 'max20086_dt_ids'
by kernel test robot
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: daadb3bd0e8d3e317e36bc2c1542e86c528665e5
commit: bfff546aae50ae68ed395bf0e0848188d27b0ba3 regulator: Add MAX20086-MAX20089 driver
date: 5 days ago
config: mips-buildonly-randconfig-r004-20220112 (https://download.01.org/0day-ci/archive/20220112/202201122312.qsMgLJU3-lk...)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 244dd2913a43a200f5a6544d424cdc37b771028b)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install mips cross compiling tool for clang build
# apt-get install binutils-mips-linux-gnu
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit...
git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
git fetch --no-tags linus master
git checkout bfff546aae50ae68ed395bf0e0848188d27b0ba3
# save the config file to linux build tree
mkdir build_dir
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=mips SHELL=/bin/bash drivers/regulator/
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All warnings (new ones prefixed by >>):
>> drivers/regulator/max20086-regulator.c:288:34: warning: unused variable 'max20086_dt_ids' [-Wunused-const-variable]
static const struct of_device_id max20086_dt_ids[] = {
^
1 warning generated.
vim +/max20086_dt_ids +288 drivers/regulator/max20086-regulator.c
287
> 288 static const struct of_device_id max20086_dt_ids[] = {
289 {
290 .compatible = "maxim,max20086",
291 .data = &(const struct max20086_chip_info) {
292 .id = MAX20086_DEVICE_ID_MAX20086,
293 .num_outputs = 4,
294 }
295 }, {
296 .compatible = "maxim,max20087",
297 .data = &(const struct max20086_chip_info) {
298 .id = MAX20086_DEVICE_ID_MAX20087,
299 .num_outputs = 4,
300 }
301 }, {
302 .compatible = "maxim,max20088",
303 .data = &(const struct max20086_chip_info) {
304 .id = MAX20086_DEVICE_ID_MAX20088,
305 .num_outputs = 2,
306 }
307 }, {
308 .compatible = "maxim,max20089",
309 .data = &(const struct max20086_chip_info) {
310 .id = MAX20086_DEVICE_ID_MAX20089,
311 .num_outputs = 2,
312 }
313 },
314 { /* Sentinel */ },
315 };
316
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
8 months, 1 week
Re: [PATCH v3 1/1] psi: Fix uaf issue when psi trigger is destroyed while being polled
by kernel test robot
Hi Suren,
I love your patch! Perhaps something to improve:
[auto build test WARNING on linux/master]
[also build test WARNING on tj-cgroup/for-next linus/master v5.16 next-20220112]
[cannot apply to tip/sched/core]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/0day-ci/linux/commits/Suren-Baghdasaryan/psi-Fix-uaf-i...
base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fe8152b38d3a994c4c6fdbc0cd6551d569a5715a
config: arc-buildonly-randconfig-r003-20220112 (https://download.01.org/0day-ci/archive/20220112/202201122348.Ihz5vPcz-lk...)
compiler: arc-elf-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/81c75158e8d3b743a8bdc51cec94b938c...
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Suren-Baghdasaryan/psi-Fix-uaf-issue-when-psi-trigger-is-destroyed-while-being-polled/20220112-072341
git checkout 81c75158e8d3b743a8bdc51cec94b938c027286d
# save the config file to linux build tree
mkdir build_dir
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=arc SHELL=/bin/bash kernel/sched/
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp(a)intel.com>
All warnings (new ones prefixed by >>):
kernel/sched/psi.c:1112:21: warning: no previous prototype for 'psi_trigger_create' [-Wmissing-prototypes]
1112 | struct psi_trigger *psi_trigger_create(struct psi_group *group,
| ^~~~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1182:6: warning: no previous prototype for 'psi_trigger_destroy' [-Wmissing-prototypes]
1182 | void psi_trigger_destroy(struct psi_trigger *t)
| ^~~~~~~~~~~~~~~~~~~
kernel/sched/psi.c:1249:10: warning: no previous prototype for 'psi_trigger_poll' [-Wmissing-prototypes]
1249 | __poll_t psi_trigger_poll(void **trigger_ptr,
| ^~~~~~~~~~~~~~~~
kernel/sched/psi.c:1364:30: warning: 'psi_cpu_proc_ops' defined but not used [-Wunused-const-variable=]
1364 | static const struct proc_ops psi_cpu_proc_ops = {
| ^~~~~~~~~~~~~~~~
kernel/sched/psi.c:1355:30: warning: 'psi_memory_proc_ops' defined but not used [-Wunused-const-variable=]
1355 | static const struct proc_ops psi_memory_proc_ops = {
| ^~~~~~~~~~~~~~~~~~~
kernel/sched/psi.c:1346:30: warning: 'psi_io_proc_ops' defined but not used [-Wunused-const-variable=]
1346 | static const struct proc_ops psi_io_proc_ops = {
| ^~~~~~~~~~~~~~~
vim +/psi_trigger_destroy +1182 kernel/sched/psi.c
1181
> 1182 void psi_trigger_destroy(struct psi_trigger *t)
1183 {
1184 struct psi_group *group;
1185 struct task_struct *task_to_destroy = NULL;
1186
1187 /*
1188 * We do not check psi_disabled since it might have been disabled after
1189 * the trigger got created.
1190 */
1191 if (!t)
1192 return;
1193
1194 group = t->group;
1195 /*
1196 * Wakeup waiters to stop polling. Can happen if cgroup is deleted
1197 * from under a polling process.
1198 */
1199 wake_up_interruptible(&t->event_wait);
1200
1201 mutex_lock(&group->trigger_lock);
1202
1203 if (!list_empty(&t->node)) {
1204 struct psi_trigger *tmp;
1205 u64 period = ULLONG_MAX;
1206
1207 list_del(&t->node);
1208 group->nr_triggers[t->state]--;
1209 if (!group->nr_triggers[t->state])
1210 group->poll_states &= ~(1 << t->state);
1211 /* reset min update period for the remaining triggers */
1212 list_for_each_entry(tmp, &group->triggers, node)
1213 period = min(period, div_u64(tmp->win.size,
1214 UPDATES_PER_WINDOW));
1215 group->poll_min_period = period;
1216 /* Destroy poll_task when the last trigger is destroyed */
1217 if (group->poll_states == 0) {
1218 group->polling_until = 0;
1219 task_to_destroy = rcu_dereference_protected(
1220 group->poll_task,
1221 lockdep_is_held(&group->trigger_lock));
1222 rcu_assign_pointer(group->poll_task, NULL);
1223 del_timer(&group->poll_timer);
1224 }
1225 }
1226
1227 mutex_unlock(&group->trigger_lock);
1228
1229 /*
1230 * Wait for psi_schedule_poll_work RCU to complete its read-side
1231 * critical section before destroying the trigger and optionally the
1232 * poll_task.
1233 */
1234 synchronize_rcu();
1235 /*
1236 * Stop kthread 'psimon' after releasing trigger_lock to prevent a
1237 * deadlock while waiting for psi_poll_work to acquire trigger_lock
1238 */
1239 if (task_to_destroy) {
1240 /*
1241 * After the RCU grace period has expired, the worker
1242 * can no longer be found through group->poll_task.
1243 */
1244 kthread_stop(task_to_destroy);
1245 }
1246 kfree(t);
1247 }
1248
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
8 months, 1 week