July 2025 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 05 Jul '25

05 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9EE CVE: CVE-2022-49964 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
by Dong Chenchen 05 Jul '25

05 Jul '25

From: Jianglei Nie <niejianglei2021(a)163.com> stable inclusion from stable-v4.19.256 commit 90ef48a718f88935d4af53d7dadd1ceafe103ce6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9VM CVE: CVE-2022-50134 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aa2a1df3a2c85f855af7d54466ac10bd48645d63 ] setup_base_ctxt() allocates a memory chunk for uctxt->groups with hfi1_alloc_ctxt_rcv_groups(). When init_user_ctxt() fails, uctxt->groups is not released, which will lead to a memory leak. We should release the uctxt->groups with hfi1_free_ctxt_rcv_groups() when init_user_ctxt() fails. Fixes: e87473bc1b6c ("IB/hfi1: Only set fd pointer when base context is completely initialized") Link: https://lore.kernel.org/r/20220711070718.2318320-1-niejianglei2021@163.com Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> Acked-by: Dennis Dalessandro <dennis.dalessandro(a)cornelisnetworks.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/infiniband/hw/hfi1/file_ops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c index da8d871fe334..5121b1f44700 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1211,8 +1211,10 @@ static int setup_base_ctxt(struct hfi1_filedata *fd, goto done; ret = init_user_ctxt(fd, uctxt); - if (ret) + if (ret) { + hfi1_free_ctxt_rcv_groups(uctxt); goto done; + } user_init(uctxt); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usbnet: Fix linkwatch use-after-free on disconnect
by Dong Chenchen 05 Jul '25

05 Jul '25

From: Lukas Wunner <lukas(a)wunner.de> stable inclusion from stable-v4.19.256 commit 7f77dcbc030c2faa6d8e8a594985eeb34018409e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9RB CVE: CVE-2022-50220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a69e617e533edddf3fa3123149900f36e0a6dc74 upstream. usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock": https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c and smsc75xx.c: * If the drivers receive a link change interrupt immediately before disconnect, they raise EVENT_LINK_RESET in their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent(). * usbnet_deferred_kevent() invokes the driver's ->link_reset() callback, which calls netif_carrier_{on,off}(). * That in turn schedules the work linkwatch_event(). Because usbnet_deferred_kevent() is awaited after unregister_netdev(), netif_carrier_{on,off}() may operate on an unregistered netdev and linkwatch_event() may run after free_netdev(), causing a use-after-free. In 2010, usbnet was changed to only wait for a single instance of usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf ("drivers/net: don't use flush_scheduled_work()"). Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last. Reported-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/netdev/CAG48ez0MHBbENX5gCdHAUXZ7h7s20LnepBF-pa5M=7B… Reported-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://lore.kernel.org/netdev/20220315113841.GA22337@pengutronix.de/ Signed-off-by: Lukas Wunner <lukas(a)wunner.de> Cc: stable(a)vger.kernel.org Acked-by: Oliver Neukum <oneukum(a)suse.com> Link: https://lore.kernel.org/r/d1c87ebe9fc502bffcd1576e238d685ad08321e4.16559878… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/usb/usbnet.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index e5c7a5c05109..1316f5b0c0d7 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -845,13 +845,11 @@ int usbnet_stop (struct net_device *net) mpn = !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags); - /* deferred work (task, timer, softirq) must also stop. - * can't flush_scheduled_work() until we drop rtnl (later), - * else workers could deadlock; so make workers a NOP. - */ + /* deferred work (timer, softirq, task) must also stop */ dev->flags = 0; del_timer_sync (&dev->delay); tasklet_kill (&dev->bh); + cancel_work_sync(&dev->kevent); if (!pm) usb_autopm_put_interface(dev->intf); @@ -1614,8 +1612,6 @@ void usbnet_disconnect (struct usb_interface *intf) net = dev->net; unregister_netdev (net); - cancel_work_sync(&dev->kevent); - usb_scuttle_anchored_urbs(&dev->deferred); if (dev->driver_info->unbind) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
by Dong Chenchen 05 Jul '25

05 Jul '25

From: Cong Wang <xiyou.wangcong(a)gmail.com> mainline inclusion from mainline-v6.15-rc6 commit 3f981138109f63232a5fb7165938d4c945cc1b9d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICDGN6 CVE: CVE-2025-38000 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When enqueuing the first packet to an HFSC class, hfsc_enqueue() calls the child qdisc's peek() operation before incrementing sch->q.qlen and sch->qstats.backlog. If the child qdisc uses qdisc_peek_dequeued(), this may trigger an immediate dequeue and potential packet drop. In such cases, qdisc_tree_reduce_backlog() is called, but the HFSC qdisc's qlen and backlog have not yet been updated, leading to inconsistent queue accounting. This can leave an empty HFSC class in the active list, causing further consequences like use-after-free. This patch fixes the bug by moving the increment of sch->q.qlen and sch->qstats.backlog before the call to the child qdisc's peek() operation. This ensures that queue length and backlog are always accurate when packet drops or dequeues are triggered during the peek. Fixes: 12d0ad3be9c3 ("net/sched/sch_hfsc.c: handle corner cases where head may change invalidating calculated deadline") Reported-by: Mingi Cho <mincho(a)theori.io> Signed-off-by: Cong Wang <xiyou.wangcong(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20250518222038.58538-2-xiyou.wangcong@gmail.com Reviewed-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/sched/sch_hfsc.c [commit 141d34391abb and 37d9cf1a3ce3 are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_hfsc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c index bb9b42002708..d75964c3f150 100644 --- a/net/sched/sch_hfsc.c +++ b/net/sched/sch_hfsc.c @@ -1574,6 +1574,9 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) return err; } + sch->qstats.backlog += len; + sch->q.qlen++; + if (cl->qdisc->q.qlen == 1) { if (cl->cl_flags & HFSC_RSC) init_ed(cl, len); @@ -1589,9 +1592,6 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) } - sch->qstats.backlog += len; - sch->q.qlen++; - return NET_XMIT_SUCCESS; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug
by Dong Chenchen 05 Jul '25

05 Jul '25

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> mainline inclusion from mainline-v6.15-rc7 commit f81b33582f9339d2dc17c69b92040d3650bb4bae category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAO5 CVE: CVE-2025-38024 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7d/0xa0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcf/0x610 mm/kasan/report.c:489 kasan_report+0xb5/0xe0 mm/kasan/report.c:602 rxe_queue_cleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxe_queue.c:195 rxe_cq_cleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxe_cq.c:132 __rxe_cleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxe_pool.c:232 rxe_create_cq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxe_verbs.c:1109 create_cq+0x658/0xb90 drivers/infiniband/core/uverbs_cmd.c:1052 ib_uverbs_create_cq+0xc7/0x120 drivers/infiniband/core/uverbs_cmd.c:1095 ib_uverbs_write+0x969/0xc90 drivers/infiniband/core/uverbs_main.c:679 vfs_write fs/read_write.c:677 [inline] vfs_write+0x26a/0xcc0 fs/read_write.c:659 ksys_write+0x1b8/0x200 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xaa/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f In the function rxe_create_cq, when rxe_cq_from_init fails, the function rxe_cleanup will be called to handle the allocated resources. In fact, some memory resources have already been freed in the function rxe_cq_from_init. Thus, this problem will occur. The solution is to let rxe_cleanup do all the work. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://paste.ubuntu.com/p/tJgC42wDf6/ Tested-by: liuyi <liuy22(a)mails.tsinghua.edu.cn> Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Link: https://patch.msgid.link/20250412075714.3257358-1-yanjun.zhu@linux.dev Reviewed-by: Daisuke Matsuda <matsuda-daisuke(a)fujitsu.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/sw/rxe/rxe_cq.c [commit ff23dfa13457 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_cq.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c index 2ee4b08b00ea..6ed943f1b8af 100644 --- a/drivers/infiniband/sw/rxe/rxe_cq.c +++ b/drivers/infiniband/sw/rxe/rxe_cq.c @@ -96,11 +96,8 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, context, cq->queue->buf, cq->queue->buf_size, &cq->queue->ip); - if (err) { - kvfree(cq->queue->buf); - kfree(cq->queue); + if (err) return err; - } if (uresp) cq->is_user = 1; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] RDMA/rxe: Fix error unwind in rxe_create_qp()
by Dong Chenchen 05 Jul '25

05 Jul '25

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> stable inclusion from stable-v4.19.256 commit 1a63f24e724f677db1ab21251f4d0011ae0bb5b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9UC CVE: CVE-2022-50127 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fd5382c5805c4bcb50fd25b7246247d3f7114733 ] In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like the spin locks are not setup until rxe_qp_init_req(). If an error occures before this point then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which will oops when trying to access the uninitialized spinlock. Move the spinlock initializations earlier before any failures. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20220731063621.298405-1-yanjun.zhu@linux.dev Reported-by: syzbot+833061116fa28df97f3b(a)syzkaller.appspotmail.com Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_qp.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c index 4c0caca6da50..21c28317fc8f 100644 --- a/drivers/infiniband/sw/rxe/rxe_qp.c +++ b/drivers/infiniband/sw/rxe/rxe_qp.c @@ -210,6 +210,14 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp, spin_lock_init(&qp->grp_lock); spin_lock_init(&qp->state_lock); + spin_lock_init(&qp->req.task.state_lock); + spin_lock_init(&qp->resp.task.state_lock); + spin_lock_init(&qp->comp.task.state_lock); + + spin_lock_init(&qp->sq.sq_lock); + spin_lock_init(&qp->rq.producer_lock); + spin_lock_init(&qp->rq.consumer_lock); + atomic_set(&qp->ssn, 0); atomic_set(&qp->skb_out, 0); } @@ -258,7 +266,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, qp->req.opcode = -1; qp->comp.opcode = -1; - spin_lock_init(&qp->sq.sq_lock); skb_queue_head_init(&qp->req_pkts); rxe_init_task(rxe, &qp->req.task, qp, @@ -308,9 +315,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, } } - spin_lock_init(&qp->rq.producer_lock); - spin_lock_init(&qp->rq.consumer_lock); - skb_queue_head_init(&qp->resp_pkts); rxe_init_task(rxe, &qp->resp.task, qp, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] iavf: Fix reset error handling
by Dong Chenchen 05 Jul '25

05 Jul '25

From: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> mainline inclusion from mainline-v6.0-rc2 commit 31071173771e079f7bc08dacd61e0db913262fbf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGABK CVE: CVE-2022-50053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Do not call iavf_close in iavf_reset_task error handling. Doing so can lead to double call of napi_disable, which can lead to deadlock there. Removing VF would lead to iavf_remove task being stuck, because it requires crit_lock, which is held by iavf_close. Call iavf_disable_vf if reset fail, so that driver will clean up remaining invalid resources. During rapid VF resets, HW can fail to setup VF mailbox. Wrong error handling can lead to iavf_remove being stuck with: [ 5218.999087] iavf 0000:82:01.0: Failed to init adminq: -53 ... [ 5267.189211] INFO: task repro.sh:11219 blocked for more than 30 seconds. [ 5267.189520] Tainted: G S E 5.18.0-04958-ga54ce3703613-dirty #1 [ 5267.189764] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 5267.190062] task:repro.sh state:D stack: 0 pid:11219 ppid: 8162 flags:0x00000000 [ 5267.190347] Call Trace: [ 5267.190647] <TASK> [ 5267.190927] __schedule+0x460/0x9f0 [ 5267.191264] schedule+0x44/0xb0 [ 5267.191563] schedule_preempt_disabled+0x14/0x20 [ 5267.191890] __mutex_lock.isra.12+0x6e3/0xac0 [ 5267.192237] ? iavf_remove+0xf9/0x6c0 [iavf] [ 5267.192565] iavf_remove+0x12a/0x6c0 [iavf] [ 5267.192911] ? _raw_spin_unlock_irqrestore+0x1e/0x40 [ 5267.193285] pci_device_remove+0x36/0xb0 [ 5267.193619] device_release_driver_internal+0xc1/0x150 [ 5267.193974] pci_stop_bus_device+0x69/0x90 [ 5267.194361] pci_stop_and_remove_bus_device+0xe/0x20 [ 5267.194735] pci_iov_remove_virtfn+0xba/0x120 [ 5267.195130] sriov_disable+0x2f/0xe0 [ 5267.195506] ice_free_vfs+0x7d/0x2f0 [ice] [ 5267.196056] ? pci_get_device+0x4f/0x70 [ 5267.196496] ice_sriov_configure+0x78/0x1a0 [ice] [ 5267.196995] sriov_numvfs_store+0xfe/0x140 [ 5267.197466] kernfs_fop_write_iter+0x12e/0x1c0 [ 5267.197918] new_sync_write+0x10c/0x190 [ 5267.198404] vfs_write+0x24e/0x2d0 [ 5267.198886] ksys_write+0x5c/0xd0 [ 5267.199367] do_syscall_64+0x3a/0x80 [ 5267.199827] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [ 5267.200317] RIP: 0033:0x7f5b381205c8 [ 5267.200814] RSP: 002b:00007fff8c7e8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 5267.201981] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f5b381205c8 [ 5267.202620] RDX: 0000000000000002 RSI: 00005569420ee900 RDI: 0000000000000001 [ 5267.203426] RBP: 00005569420ee900 R08: 000000000000000a R09: 00007f5b38180820 [ 5267.204327] R10: 000000000000000a R11: 0000000000000246 R12: 00007f5b383c06e0 [ 5267.205193] R13: 0000000000000002 R14: 00007f5b383bb880 R15: 0000000000000002 [ 5267.206041] </TASK> [ 5267.206970] Kernel panic - not syncing: hung_task: blocked tasks [ 5267.207809] CPU: 48 PID: 551 Comm: khungtaskd Kdump: loaded Tainted: G S E 5.18.0-04958-ga54ce3703613-dirty #1 [ 5267.208726] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.11.0 11/02/2019 [ 5267.209623] Call Trace: [ 5267.210569] <TASK> [ 5267.211480] dump_stack_lvl+0x33/0x42 [ 5267.212472] panic+0x107/0x294 [ 5267.213467] watchdog.cold.8+0xc/0xbb [ 5267.214413] ? proc_dohung_task_timeout_secs+0x30/0x30 [ 5267.215511] kthread+0xf4/0x120 [ 5267.216459] ? kthread_complete_and_exit+0x20/0x20 [ 5267.217505] ret_from_fork+0x22/0x30 [ 5267.218459] </TASK> Fixes: f0db78928783 ("i40evf: use netdev variable in reset task") Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski(a)intel.com> Tested-by: Marek Szlosek <marek.szlosek(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/iavf/iavf_main.c drivers/net/ethernet/intel/i40evf/i40evf_main.c [commit 898ef1cb1cb2 and 5ac49f3c2702 are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c index 29d5f851f55e..e97b59828297 100644 --- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c +++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c @@ -2008,10 +2008,10 @@ static void i40evf_reset_task(struct work_struct *work) return; reset_err: + i40evf_disable_vf(adapter); clear_bit(__I40EVF_IN_CLIENT_TASK, &adapter->crit_section); clear_bit(__I40EVF_IN_CRITICAL_TASK, &adapter->crit_section); dev_err(&adapter->pdev->dev, "failed to allocate resources during reinit\n"); - i40evf_close(netdev); } /** -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] PCI/GPU: fix hard lockup in vga_arb_release
by Zhang Yuwei 05 Jul '25

05 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCT8Z CVE: NA -------------------------------- In the vga_arb_release(), it iterates through the vga_arb_user_card array held by the user to release io_cnt and mem_cnt resources one by one. If the values of io_cnt or mem_cnt are excessively large, prolonged CPU occupation may occur, leading to hard lock. lock protection is only added when deleting entries from the list, also add cond_resched() during the release of io_cnt and mem_cnt. Fixes: 9c7af565c58e ("centos 8.1: import linux-4.18.0-147.5.1.el8_1") Reviewed-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/vga/vgaarb.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index c61b04555779..db21ae342bd8 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1312,18 +1312,22 @@ static int vga_arb_release(struct inode *inode, struct file *file) spin_lock_irqsave(&vga_user_lock, flags); list_del(&priv->list); + spin_unlock_irqrestore(&vga_user_lock, flags); for (i = 0; i < MAX_USER_CARDS; i++) { uc = &priv->cards[i]; if (uc->pdev == NULL) continue; vgaarb_dbg(&uc->pdev->dev, "uc->io_cnt == %d, uc->mem_cnt == %d\n", uc->io_cnt, uc->mem_cnt); - while (uc->io_cnt--) + while (uc->io_cnt--) { vga_put(uc->pdev, VGA_RSRC_LEGACY_IO); - while (uc->mem_cnt--) + cond_resched(); + } + while (uc->mem_cnt--) { vga_put(uc->pdev, VGA_RSRC_LEGACY_MEM); + cond_resched(); + } } - spin_unlock_irqrestore(&vga_user_lock, flags); kfree(priv); -- 2.22.0

2 1

[openeuler:OLK-6.6 2464/2464] mm/share_pool.c:3305:12: warning: 'proc_usage_show' defined but not used
by kernel test robot 05 Jul '25

05 Jul '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 91eec2cd9a8fcf4a923543680deda4e604bc6943 commit: df165ba49e6e4ce8b4f6076aded3b92e19918b03 [2464/2464] mm/sharepool: Add proc interfaces to show sp info config: arm64-randconfig-r121-20250705 (https://download.01.org/0day-ci/archive/20250705/202507051355.RXfpqQVb-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250705/202507051355.RXfpqQVb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507051355.RXfpqQVb-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:2584:14: error: implicit declaration of function 'huge_ptep_get'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] pte_t pte = huge_ptep_get(ptep); ^~~~~~~~~~~~~ huge_pte_lock mm/share_pool.c:2584:14: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:2796:7: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] bool is_hugepage = true; ^~~~~~~~~~~ At top level: >> mm/share_pool.c:3305:12: warning: 'proc_usage_show' defined but not used [-Wunused-function] static int proc_usage_show(struct seq_file *seq, void *offset) ^~~~~~~~~~~~~~~ >> mm/share_pool.c:3285:12: warning: 'proc_group_usage_show' defined but not used [-Wunused-function] static int proc_group_usage_show(struct seq_file *seq, void *offset) ^~~~~~~~~~~~~~~~~~~~~ >> mm/share_pool.c:3234:12: warning: 'spa_stat_show' defined but not used [-Wunused-function] static int spa_stat_show(struct seq_file *seq, void *offset) ^~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +/proc_usage_show +3305 mm/share_pool.c 3233 > 3234 static int spa_stat_show(struct seq_file *seq, void *offset) 3235 { 3236 if (!should_show_statistics()) 3237 return -EPERM; 3238 3239 spg_overview_show(seq); 3240 spa_overview_show(seq); 3241 /* print the file header */ 3242 seq_printf(seq, "%-10s %-16s %-16s %-10s %-7s %-5s %-8s %-8s\n", 3243 "Group ID", "va_start", "va_end", "Size(KB)", "Type", "Huge", "PID", "Ref"); 3244 spa_ro_stat_show(seq); 3245 spa_normal_stat_show(seq); 3246 spa_dvpp_stat_show(seq); 3247 return 0; 3248 } 3249 3250 static int proc_usage_by_group(int id, void *p, void *data) 3251 { 3252 struct sp_group *spg = p; 3253 struct seq_file *seq = data; 3254 struct sp_group_node *spg_node; 3255 struct mm_struct *mm; 3256 struct sp_group_master *master; 3257 int tgid; 3258 unsigned long anon, file, shmem, total_rss; 3259 3260 down_read(&spg->rw_lock); 3261 list_for_each_entry(spg_node, &spg->proc_head, proc_node) { 3262 master = spg_node->master; 3263 mm = master->mm; 3264 tgid = master->tgid; 3265 3266 get_mm_rss_info(mm, &anon, &file, &shmem, &total_rss); 3267 3268 seq_printf(seq, "%-8d ", tgid); 3269 seq_printf(seq, "%-8d ", id); 3270 seq_printf(seq, "%-9ld %-9ld %-9ld %-8ld %-7ld %-7ld ", 3271 meminfo_alloc_sum_byKB(&spg_node->meminfo), 3272 meminfo_k2u_size(&spg_node->meminfo), 3273 meminfo_alloc_sum_byKB(&spg_node->spg->meminfo), 3274 page2kb(mm->total_vm), page2kb(total_rss), 3275 page2kb(shmem)); 3276 print_process_prot(seq, spg_node->prot); 3277 seq_putc(seq, '\n'); 3278 } 3279 up_read(&spg->rw_lock); 3280 cond_resched(); 3281 3282 return 0; 3283 } 3284 > 3285 static int proc_group_usage_show(struct seq_file *seq, void *offset) 3286 { 3287 if (!should_show_statistics()) 3288 return -EPERM; 3289 3290 spg_overview_show(seq); 3291 spa_overview_show(seq); 3292 3293 /* print the file header */ 3294 seq_printf(seq, "%-8s %-8s %-9s %-9s %-9s %-8s %-7s %-7s %-4s\n", 3295 "PID", "Group_ID", "SP_ALLOC", "SP_K2U", "SP_RES", 3296 "VIRT", "RES", "Shm", "PROT"); 3297 3298 down_read(&sp_global_sem); 3299 idr_for_each(&sp_group_idr, proc_usage_by_group, seq); 3300 up_read(&sp_global_sem); 3301 3302 return 0; 3303 } 3304 > 3305 static int proc_usage_show(struct seq_file *seq, void *offset) 3306 { 3307 struct sp_group_master *master = NULL; 3308 unsigned long anon, file, shmem, total_rss; 3309 long sp_res, sp_res_nsize, non_sp_res, non_sp_shm; 3310 struct sp_meminfo *meminfo; 3311 3312 if (!should_show_statistics()) 3313 return -EPERM; 3314 3315 seq_printf(seq, "%-8s %-16s %-9s %-9s %-9s %-10s %-10s %-8s\n", 3316 "PID", "COMM", "SP_ALLOC", "SP_K2U", "SP_RES", "Non-SP_RES", 3317 "Non-SP_Shm", "VIRT"); 3318 3319 down_read(&sp_global_sem); 3320 mutex_lock(&master_list_lock); 3321 list_for_each_entry(master, &master_list, list_node) { 3322 meminfo = &master->meminfo; 3323 get_mm_rss_info(master->mm, &anon, &file, &shmem, &total_rss); 3324 get_process_sp_res(master, &sp_res, &sp_res_nsize); 3325 get_process_non_sp_res(total_rss, shmem, sp_res_nsize, 3326 &non_sp_res, &non_sp_shm); 3327 seq_printf(seq, "%-8d %-16s %-9ld %-9ld %-9ld %-10ld %-10ld %-8ld\n", 3328 master->tgid, master->comm, 3329 meminfo_alloc_sum_byKB(meminfo), 3330 meminfo_k2u_size(meminfo), 3331 sp_res, non_sp_res, non_sp_shm, 3332 page2kb(master->mm->total_vm)); 3333 } 3334 mutex_unlock(&master_list_lock); 3335 up_read(&sp_global_sem); 3336 3337 return 0; 3338 } 3339 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1673/1673] drivers/nvme/host/fc.o: warning: objtool: nvme_fc_lport_put()+0xa6: unreachable instruction
by kernel test robot 05 Jul '25

05 Jul '25

Hi Daniel, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 44dfa3e24fdde8e95b4815dc4d365cb20755a5e4 commit: 7620e9fedb99dd396bc51e06c7571baa0b4adb40 [1673/1673] nvme-fc: do not wait in vain when unloading module config: x86_64-buildonly-randconfig-002-20250628 (https://download.01.org/0day-ci/archive/20250705/202507051224.xruPNJEF-lkp@…) compiler: clang version 20.1.7 (https://github.com/llvm/llvm-project 6146a88f60492b520a36f8f8f3231e15f3cc6082) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250705/202507051224.xruPNJEF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507051224.xruPNJEF-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/nvme/host/fc.c:335: warning: Function parameter or member 'portptr' not described in 'nvme_fc_register_localport' drivers/nvme/host/fc.c:335: warning: Excess function parameter 'lport_p' description in 'nvme_fc_register_localport' drivers/nvme/host/fc.c:439: warning: Function parameter or member 'portptr' not described in 'nvme_fc_unregister_localport' drivers/nvme/host/fc.c:439: warning: Excess function parameter 'localport' description in 'nvme_fc_unregister_localport' drivers/nvme/host/fc.c:649: warning: Function parameter or member 'portptr' not described in 'nvme_fc_register_remoteport' drivers/nvme/host/fc.c:649: warning: Excess function parameter 'rport_p' description in 'nvme_fc_register_remoteport' drivers/nvme/host/fc.c:821: warning: Function parameter or member 'portptr' not described in 'nvme_fc_unregister_remoteport' drivers/nvme/host/fc.c:821: warning: Excess function parameter 'remoteport' description in 'nvme_fc_unregister_remoteport' >> drivers/nvme/host/fc.o: warning: objtool: nvme_fc_lport_put()+0xa6: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0