From: kernel test robot <lkp@intel.com>
To: cros-kernel-buildreports@googlegroups.com
Cc: oe-kbuild-all@lists.linux.dev
Subject: [android-common:android12-5.10-2025-12 0/1] kernel/sched/psi.c:1147:6: warning: no previous prototype for 'psi_trigger_destroy'
Date: Wed, 08 Apr 2026 21:04:18 +0800 [thread overview]
Message-ID: <202604082001.sdkFC8LG-lkp@intel.com> (raw)
Hi Suren,
FYI, the error/warning still remains.
tree: https://android.googlesource.com/kernel/common android12-5.10-2025-12
head: 730d06ec05ff5dc34389ff99ea4009411efba5e6
commit: d4e4e61d4a5b87bfc9953c306a11d35d869417fd [0/1] psi: Fix uaf issue when psi trigger is destroyed while being polled
config: i386-buildonly-randconfig-003-20260408 (https://download.01.org/0day-ci/archive/20260408/202604082001.sdkFC8LG-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260408/202604082001.sdkFC8LG-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604082001.sdkFC8LG-lkp@intel.com/
All warnings (new ones prefixed by >>):
kernel/sched/psi.c:1077:21: warning: no previous prototype for 'psi_trigger_create' [-Wmissing-prototypes]
1077 | struct psi_trigger *psi_trigger_create(struct psi_group *group,
| ^~~~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1147:6: warning: no previous prototype for 'psi_trigger_destroy' [-Wmissing-prototypes]
1147 | void psi_trigger_destroy(struct psi_trigger *t)
| ^~~~~~~~~~~~~~~~~~~
kernel/sched/psi.c:1214:10: warning: no previous prototype for 'psi_trigger_poll' [-Wmissing-prototypes]
1214 | __poll_t psi_trigger_poll(void **trigger_ptr,
| ^~~~~~~~~~~~~~~~
kernel/sched/psi.c:1329:30: warning: 'psi_cpu_proc_ops' defined but not used [-Wunused-const-variable=]
1329 | static const struct proc_ops psi_cpu_proc_ops = {
| ^~~~~~~~~~~~~~~~
kernel/sched/psi.c:1320:30: warning: 'psi_memory_proc_ops' defined but not used [-Wunused-const-variable=]
1320 | static const struct proc_ops psi_memory_proc_ops = {
| ^~~~~~~~~~~~~~~~~~~
kernel/sched/psi.c:1311:30: warning: 'psi_io_proc_ops' defined but not used [-Wunused-const-variable=]
1311 | static const struct proc_ops psi_io_proc_ops = {
| ^~~~~~~~~~~~~~~
vim +/psi_trigger_destroy +1147 kernel/sched/psi.c
1146
> 1147 void psi_trigger_destroy(struct psi_trigger *t)
1148 {
1149 struct psi_group *group;
1150 struct task_struct *task_to_destroy = NULL;
1151
1152 /*
1153 * We do not check psi_disabled since it might have been disabled after
1154 * the trigger got created.
1155 */
1156 if (!t)
1157 return;
1158
1159 group = t->group;
1160 /*
1161 * Wakeup waiters to stop polling. Can happen if cgroup is deleted
1162 * from under a polling process.
1163 */
1164 wake_up_interruptible(&t->event_wait);
1165
1166 mutex_lock(&group->trigger_lock);
1167
1168 if (!list_empty(&t->node)) {
1169 struct psi_trigger *tmp;
1170 u64 period = ULLONG_MAX;
1171
1172 list_del(&t->node);
1173 group->nr_triggers[t->state]--;
1174 if (!group->nr_triggers[t->state])
1175 group->poll_states &= ~(1 << t->state);
1176 /* reset min update period for the remaining triggers */
1177 list_for_each_entry(tmp, &group->triggers, node)
1178 period = min(period, div_u64(tmp->win.size,
1179 UPDATES_PER_WINDOW));
1180 group->poll_min_period = period;
1181 /* Destroy poll_task when the last trigger is destroyed */
1182 if (group->poll_states == 0) {
1183 group->polling_until = 0;
1184 task_to_destroy = rcu_dereference_protected(
1185 group->poll_task,
1186 lockdep_is_held(&group->trigger_lock));
1187 rcu_assign_pointer(group->poll_task, NULL);
1188 del_timer(&group->poll_timer);
1189 }
1190 }
1191
1192 mutex_unlock(&group->trigger_lock);
1193
1194 /*
1195 * Wait for psi_schedule_poll_work RCU to complete its read-side
1196 * critical section before destroying the trigger and optionally the
1197 * poll_task.
1198 */
1199 synchronize_rcu();
1200 /*
1201 * Stop kthread 'psimon' after releasing trigger_lock to prevent a
1202 * deadlock while waiting for psi_poll_work to acquire trigger_lock
1203 */
1204 if (task_to_destroy) {
1205 /*
1206 * After the RCU grace period has expired, the worker
1207 * can no longer be found through group->poll_task.
1208 */
1209 kthread_stop(task_to_destroy);
1210 }
1211 kfree(t);
1212 }
1213
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-04-08 13:05 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202604082001.sdkFC8LG-lkp@intel.com \
--to=lkp@intel.com \
--cc=cros-kernel-buildreports@googlegroups.com \
--cc=oe-kbuild-all@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.