July 2025 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] dma-buf: insert memory barrier before updating num_fences
by Bowen You 04 Jul '25

04 Jul '25

From: Hyejeong Choi <hjeong.choi(a)samsung.com> mainline inclusion from mainline-v6.12-rc1 commit 72c7d62583ebce7baeb61acce6057c361f73be4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJTDA CVE: CVE-2025-38095 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reordered. Signed-off-by: Hyejeong Choi <hjeong.choi(a)samsung.com> Fixes: a590d0fdbaa5 ("dma-buf: Update reservation shared_count after adding the new fence") CC: stable(a)vger.kernel.org Reviewed-by: Christian König <christian.koenig(a)amd.com> Link: https://lore.kernel.org/r/20250513020638.GA2329653@au1-maretx-p37.eng.sarc.… Signed-off-by: Christian König <christian.koenig(a)amd.com> Conflicts: drivers/dma-buf/dma-resv.c [Context conflict] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/dma-buf/dma-resv.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/dma-buf/dma-resv.c b/drivers/dma-buf/dma-resv.c index eb8b733065b2..9093f751f133 100644 --- a/drivers/dma-buf/dma-resv.c +++ b/drivers/dma-buf/dma-resv.c @@ -313,8 +313,9 @@ void dma_resv_add_fence(struct dma_resv *obj, struct dma_fence *fence, count++; dma_resv_list_set(fobj, i, fence, usage); - /* pointer update must be visible before we extend the num_fences */ - smp_store_mb(fobj->num_fences, count); + /* fence update must be visible before we extend the num_fences */ + smp_wmb(); + fobj->num_fences = count; } EXPORT_SYMBOL(dma_resv_add_fence); -- 2.34.1

2 1

[openeuler:OLK-5.10 3011/3011] kernel/sched/soft_domain.c:186:24: error: implicit declaration of function 'cpu_util_cfs'; did you mean 'cpu_util_irq'?
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 41b7827f33a9fc1fe425b85029312de34b0f0abe commit: dd6655291bf7230ef984e1d283a5ec05821f996f [3011/3011] sched: Attach task group to soft domain config: arm64-randconfig-001-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041857.BTkVYp1k-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041857.BTkVYp1k-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041857.BTkVYp1k-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/soft_domain.c: In function 'sum_util': >> kernel/sched/soft_domain.c:186:24: error: implicit declaration of function 'cpu_util_cfs'; did you mean 'cpu_util_irq'? [-Werror=implicit-function-declaration] 186 | sum += cpu_util_cfs(cpu_rq(cpu)); | ^~~~~~~~~~~~ | cpu_util_irq kernel/sched/soft_domain.c: In function '__sched_group_set_soft_domain': kernel/sched/soft_domain.c:269:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 269 | int cpu; | ^~~ cc1: some warnings being treated as errors vim +186 kernel/sched/soft_domain.c 179 180 static unsigned long sum_util(struct cpumask *mask) 181 { 182 unsigned long sum = 0; 183 int cpu; 184 185 for_each_cpu(cpu, mask) > 186 sum += cpu_util_cfs(cpu_rq(cpu)); 187 188 return sum; 189 } 190 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
by Wang Hai 04 Jul '25

04 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.256 commit 5aa558232edc30468d1f35108826dd5b3ffe978f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGA8V CVE: CVE-2022-50087 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 689640efc0a2c4e07e6f88affe6d42cd40cc3f85 upstream. When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the probe succeeds. If it is not taken care, then it could result use-after-free as the value is exported via get_scpi_ops() and could refer to a memory allocated via devm_kzalloc() but freed when the probe fails. Link: https://lore.kernel.org/r/20220701160310.148344-1-sudeep.holla@arm.com Cc: stable(a)vger.kernel.org # 4.19+ Reported-by: huhai <huhai(a)kylinos.cn> Reviewed-by: Jackie Liu <liuyun01(a)kylinos.cn> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/firmware/arm_scpi.c | 61 +++++++++++++++++++++---------------- 1 file changed, 35 insertions(+), 26 deletions(-) diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c index e3fff7b29045..2745a596e1d1 100644 --- a/drivers/firmware/arm_scpi.c +++ b/drivers/firmware/arm_scpi.c @@ -827,11 +827,11 @@ static int scpi_init_versions(struct scpi_drvinfo *info) if (!ret) { info->protocol_version = le32_to_cpu(caps.protocol_version); info->firmware_version = le32_to_cpu(caps.platform_version); } /* Ignore error if not implemented */ - if (scpi_info->is_legacy && ret == -EOPNOTSUPP) + if (info->is_legacy && ret == -EOPNOTSUPP) return 0; return ret; } @@ -917,37 +917,38 @@ static int scpi_probe(struct platform_device *pdev) { int count, idx, ret; struct resource res; struct device *dev = &pdev->dev; struct device_node *np = dev->of_node; + struct scpi_drvinfo *scpi_drvinfo; - scpi_info = devm_kzalloc(dev, sizeof(*scpi_info), GFP_KERNEL); - if (!scpi_info) + scpi_drvinfo = devm_kzalloc(dev, sizeof(*scpi_drvinfo), GFP_KERNEL); + if (!scpi_drvinfo) return -ENOMEM; if (of_match_device(legacy_scpi_of_match, &pdev->dev)) - scpi_info->is_legacy = true; + scpi_drvinfo->is_legacy = true; count = of_count_phandle_with_args(np, "mboxes", "#mbox-cells"); if (count < 0) { dev_err(dev, "no mboxes property in '%pOF'\n", np); return -ENODEV; } - scpi_info->channels = devm_kcalloc(dev, count, sizeof(struct scpi_chan), - GFP_KERNEL); - if (!scpi_info->channels) + scpi_drvinfo->channels = + devm_kcalloc(dev, count, sizeof(struct scpi_chan), GFP_KERNEL); + if (!scpi_drvinfo->channels) return -ENOMEM; - ret = devm_add_action(dev, scpi_free_channels, scpi_info); + ret = devm_add_action(dev, scpi_free_channels, scpi_drvinfo); if (ret) return ret; - for (; scpi_info->num_chans < count; scpi_info->num_chans++) { + for (; scpi_drvinfo->num_chans < count; scpi_drvinfo->num_chans++) { resource_size_t size; - int idx = scpi_info->num_chans; - struct scpi_chan *pchan = scpi_info->channels + idx; + int idx = scpi_drvinfo->num_chans; + struct scpi_chan *pchan = scpi_drvinfo->channels + idx; struct mbox_client *cl = &pchan->cl; struct device_node *shmem = of_parse_phandle(np, "shmem", idx); ret = of_address_to_resource(shmem, 0, &res); of_node_put(shmem); @@ -987,53 +988,61 @@ static int scpi_probe(struct platform_device *pdev) idx, ret); } return ret; } - scpi_info->commands = scpi_std_commands; + scpi_drvinfo->commands = scpi_std_commands; - platform_set_drvdata(pdev, scpi_info); + platform_set_drvdata(pdev, scpi_drvinfo); - if (scpi_info->is_legacy) { + if (scpi_drvinfo->is_legacy) { /* Replace with legacy variants */ scpi_ops.clk_set_val = legacy_scpi_clk_set_val; - scpi_info->commands = scpi_legacy_commands; + scpi_drvinfo->commands = scpi_legacy_commands; /* Fill priority bitmap */ for (idx = 0; idx < ARRAY_SIZE(legacy_hpriority_cmds); idx++) set_bit(legacy_hpriority_cmds[idx], - scpi_info->cmd_priority); + scpi_drvinfo->cmd_priority); } - ret = scpi_init_versions(scpi_info); + scpi_info = scpi_drvinfo; + + ret = scpi_init_versions(scpi_drvinfo); if (ret) { dev_err(dev, "incorrect or no SCP firmware found\n"); + scpi_info = NULL; return ret; } - if (scpi_info->is_legacy && !scpi_info->protocol_version && - !scpi_info->firmware_version) + if (scpi_drvinfo->is_legacy && !scpi_drvinfo->protocol_version && + !scpi_drvinfo->firmware_version) dev_info(dev, "SCP Protocol legacy pre-1.0 firmware\n"); else dev_info(dev, "SCP Protocol %lu.%lu Firmware %lu.%lu.%lu version\n", FIELD_GET(PROTO_REV_MAJOR_MASK, - scpi_info->protocol_version), + scpi_drvinfo->protocol_version), FIELD_GET(PROTO_REV_MINOR_MASK, - scpi_info->protocol_version), + scpi_drvinfo->protocol_version), FIELD_GET(FW_REV_MAJOR_MASK, - scpi_info->firmware_version), + scpi_drvinfo->firmware_version), FIELD_GET(FW_REV_MINOR_MASK, - scpi_info->firmware_version), + scpi_drvinfo->firmware_version), FIELD_GET(FW_REV_PATCH_MASK, - scpi_info->firmware_version)); - scpi_info->scpi_ops = &scpi_ops; + scpi_drvinfo->firmware_version)); ret = devm_device_add_groups(dev, versions_groups); if (ret) dev_err(dev, "unable to create sysfs version group\n"); - return devm_of_platform_populate(dev); + scpi_drvinfo->scpi_ops = &scpi_ops; + + ret = devm_of_platform_populate(dev); + if (ret) + scpi_info = NULL; + + return ret; } static const struct of_device_id scpi_of_match[] = { {.compatible = "arm,scpi"}, {.compatible = "arm,scpi-pre-1.0"}, -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49871
by Zhang Changzhong 04 Jul '25

04 Jul '25

Eric Dumazet (1): net: tun: call napi_schedule_prep() to ensure we own a napi Wang Yufen (1): net: tun: Fix memory leaks of napi_get_frags drivers/net/tun.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) -- 2.9.5

2 3

[PATCH openEuler-1.0-LTS] wifi: cfg80211: fix memory leak in query_regdb_file()
by Zhang Changzhong 04 Jul '25

04 Jul '25

From: Arend van Spriel <arend.vanspriel(a)broadcom.com> stable inclusion from stable-v4.19.267 commit 219446396786330937bcd382a7bc4ccd767383bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BSR CVE: CVE-2022-49881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 57b962e627ec0ae53d4d16d7bd1033e27e67677a ] In the function query_regdb_file() the alpha2 parameter is duplicated using kmemdup() and subsequently freed in regdb_fw_cb(). However, request_firmware_nowait() can fail without calling regdb_fw_cb() and thus leak memory. Fixes: 007f6c5e6eb4 ("cfg80211: support loading regulatory database as firmware file") Signed-off-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/wireless/reg.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/wireless/reg.c b/net/wireless/reg.c index 6484123..d2bf20017 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -1050,6 +1050,8 @@ static void regdb_fw_cb(const struct firmware *fw, void *context) static int query_regdb_file(const char *alpha2) { + int err; + ASSERT_RTNL(); if (regdb) @@ -1059,9 +1061,13 @@ static int query_regdb_file(const char *alpha2) if (!alpha2) return -ENOMEM; - return request_firmware_nowait(THIS_MODULE, true, "regulatory.db", - &reg_pdev->dev, GFP_KERNEL, - (void *)alpha2, regdb_fw_cb); + err = request_firmware_nowait(THIS_MODULE, true, "regulatory.db", + &reg_pdev->dev, GFP_KERNEL, + (void *)alpha2, regdb_fw_cb); + if (err) + kfree(alpha2); + + return err; } int reg_reload_regdb(void) -- 2.9.5

2 1

[openeuler:OLK-6.6 2459/2459] mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover'
by kernel test robot 04 Jul '25

04 Jul '25

Hi Weilong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 673b27ee13cb811b3f418669e6826b95459c32f4 commit: b498d9f1bacd40d583c0970cab02ad522127a7e7 [2459/2459] arm64/ascend: Add new enable_oom_killer interface for oom contrl config: arm64-randconfig-004-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041600.4d0iiWmN-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041600.4d0iiWmN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041600.4d0iiWmN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memcontrol.c:3147:6: warning: no previous prototype for 'hisi_oom_recover' [-Wmissing-prototypes] 3147 | void hisi_oom_recover(struct obj_cgroup *objcg) | ^~~~~~~~~~~~~~~~ vim +/hisi_oom_recover +3147 mm/memcontrol.c 3145 3146 #ifdef CONFIG_ASCEND_OOM > 3147 void hisi_oom_recover(struct obj_cgroup *objcg) 3148 { 3149 struct mem_cgroup *memcg; 3150 3151 memcg = get_mem_cgroup_from_objcg(objcg); 3152 if (!mem_cgroup_is_root(memcg)) 3153 memcg_oom_recover(memcg); 3154 css_put(&memcg->css); 3155 } 3156 #else 3157 static inline void hisi_oom_recover(struct obj_cgroup *objcg) { } 3158 #endif 3159 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH 1/7] arm64/sysreg: Update ID_AA64MMFR1_EL1 register
by Qi Xi 04 Jul '25

04 Jul '25

From: Yicong Yang <yangyicong(a)hisilicon.com> mainline inclusion from mainline-v6.13-rc1 commit aa47dcda2708e571695dae2e3f9537d9a8eb804c category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IB4YD4 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- Update ID_AA64MMFR1_EL1 register fields definition per DDI0601 (ID092424) 2024-09. ID_AA64MMFR1_EL1.ETS adds definition for FEAT_ETS2 and FEAT_ETS3. ID_AA64MMFR1_EL1.HAFDBS adds definition for FEAT_HAFT and FEAT_HDBSS. Reviewed-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Link: https://lore.kernel.org/r/20241102104235.62560-2-yangyicong@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: JiangShui Yang <yangjiangshui(a)h-partners.com> --- arch/arm64/include/asm/sysreg.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index 8609fa094bc4..d728408df058 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -1073,6 +1073,12 @@ #define ID_PFR1_SECURITY_SHIFT 4 #define ID_PFR1_PROGMOD_SHIFT 0 +#define ID_AA64MMFR1_EL1_ETS_ETS2 UL(0b0010) +#define ID_AA64MMFR1_EL1_ETS_ETS3 UL(0b0011) + +#define ID_AA64MMFR1_EL1_HAFDBS_HAFT UL(0b0011) +#define ID_AA64MMFR1_EL1_HAFDBS_HDBSS UL(0b0100) + #if defined(CONFIG_ARM64_4K_PAGES) #define ID_AA64MMFR0_TGRAN_SHIFT ID_AA64MMFR0_TGRAN4_SHIFT #define ID_AA64MMFR0_TGRAN_SUPPORTED_MIN ID_AA64MMFR0_TGRAN4_SUPPORTED_MIN -- 2.33.0

1 6

[PATCH openEuler-1.0-LTS] PCI/GPU: fix hard lockup in vga_arb_release
by Zhang Yuwei 04 Jul '25

04 Jul '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCT8Z -------------------------------- Commit deb2d2ecd43df ("PCI/GPU: implement VGA arbitration on Linux") In the vga_arb_release(), it iterates through the vga_arb_user_card array held by the user to release io_cnt and mem_cnt resources one by one. If the values of io_cnt or mem_cnt are excessively large, prolonged CPU occupation may occur, leading to hard lock. lock protection is only added when deleting entries from the list, also add cond_resched() during the release of io_cnt and mem_cnt. Fixes: 281327c99bca ("lib: make bitmap_parselist_user() a wrapper on bitmap_parselist()") Reviewed-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/vga/vgaarb.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index c61b04555779..db21ae342bd8 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1312,18 +1312,22 @@ static int vga_arb_release(struct inode *inode, struct file *file) spin_lock_irqsave(&vga_user_lock, flags); list_del(&priv->list); + spin_unlock_irqrestore(&vga_user_lock, flags); for (i = 0; i < MAX_USER_CARDS; i++) { uc = &priv->cards[i]; if (uc->pdev == NULL) continue; vgaarb_dbg(&uc->pdev->dev, "uc->io_cnt == %d, uc->mem_cnt == %d\n", uc->io_cnt, uc->mem_cnt); - while (uc->io_cnt--) + while (uc->io_cnt--) { vga_put(uc->pdev, VGA_RSRC_LEGACY_IO); - while (uc->mem_cnt--) + cond_resched(); + } + while (uc->mem_cnt--) { vga_put(uc->pdev, VGA_RSRC_LEGACY_MEM); + cond_resched(); + } } - spin_unlock_irqrestore(&vga_user_lock, flags); kfree(priv); -- 2.22.0

2 1

[openeuler:OLK-5.10 3011/3011] drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:1524:2: warning: 'strncpy' specified bound 100 equals destination size
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 41b7827f33a9fc1fe425b85029312de34b0f0abe commit: a0c5bfdbc099daf30cbadb9657803f0cb3f89d0b [3011/3011] drivers: support for rnpm drivers from Mucse Technology N10/N400 config: arm64-randconfig-004-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041638.fqBxner2-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041638.fqBxner2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041638.fqBxner2-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:5: warning: no previous prototype for 'rnpm_mbx_get_pn_sn' [-Wmissing-prototypes] 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c: In function '_switch_loopback': >> drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:1524:2: warning: 'strncpy' specified bound 100 equals destination size [-Wstringop-truncation] 1524 | strncpy(name, peer_eth, sizeof(name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/strncpy +1524 drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c 1515 1516 static ssize_t _switch_loopback(struct rnpm_adapter *adapter, 1517 const char *peer_eth, int en) 1518 { 1519 struct net_device *peer_netdev = NULL; 1520 struct rnpm_adapter *peer_adapter = NULL; 1521 int i; 1522 char name[100]; 1523 > 1524 strncpy(name, peer_eth, sizeof(name)); 1525 strim(name); 1526 1527 peer_netdev = dev_get_by_name(&init_net, name); 1528 if (!peer_netdev) { 1529 e_dev_info("canot' find [%s]\n", name); 1530 return -EINVAL; 1531 } 1532 peer_adapter = netdev_priv(peer_netdev); 1533 1534 // check if in same slot 1535 if (PCI_SLOT(peer_adapter->pdev->devfn) != 1536 PCI_SLOT(adapter->pdev->devfn)) { 1537 e_dev_info("%s %s not in same slot\n", 1538 netdev_name(adapter->netdev), 1539 netdev_name(peer_adapter->netdev)); 1540 dev_put(peer_netdev); 1541 return -EINVAL; 1542 } 1543 1544 e_dev_info("%s: %s(%d,%d) <-> %s(%d,%d) en:%d\n", __func__, 1545 netdev_name(adapter->netdev), adapter->lane, adapter->port, 1546 netdev_name(peer_adapter->netdev), peer_adapter->lane, 1547 peer_adapter->port, en); 1548 1549 /* clear pf0/pf1 input port policy eth reg */ 1550 for (i = 0; i < MAX_PORT_NUM; i++) { 1551 wr32(&adapter->hw, RNPM_ETH_INPORT_POLICY_REG(i), 0); 1552 wr32(&peer_adapter->hw, RNPM_ETH_INPORT_POLICY_REG(i), 0); 1553 } 1554 1555 wr32(&adapter->hw, RNPM_ETH_INPORT_POLICY_VAL, 0); 1556 wr32(&peer_adapter->hw, RNPM_ETH_INPORT_POLICY_VAL, 0); 1557 1558 do_switch_loopback_set(adapter, en, adapter->lane, 1559 to_switch_port(peer_adapter)); 1560 1561 do_switch_loopback_set(peer_adapter, en, peer_adapter->lane, 1562 to_switch_port(adapter)); 1563 1564 if (peer_netdev) 1565 dev_put(peer_netdev); 1566 1567 return 0; 1568 } 1569 static ssize_t switch_loopback_on_store(struct device *dev, 1570 struct device_attribute *attr, 1571 const char *buf, size_t count) 1572 { 1573 struct rnpm_adapter *adapter = netdev_priv(to_net_device(dev)); 1574 1575 return _switch_loopback(adapter, buf, 1) == 0 ? count : -EINVAL; 1576 } 1577 static DEVICE_ATTR_WO(switch_loopback_on); 1578 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] scsi: target: iscsi: Fix timeout on deleted connection
by Yifan Qiao 04 Jul '25

04 Jul '25

From: Dmitry Bogdanov <d.bogdanov(a)yadro.com> stable inclusion from stable-v6.6.93 commit fe8421e853ef289e1324fcda004751c89dd9c18a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEJ CVE: CVE-2025-38075 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7f533cc5ee4c4436cee51dc58e81dfd9c3384418 ] NOPIN response timer may expire on a deleted connection and crash with such logs: Did not receive response to NOPIN on CID: 0, failing connection for I_T Nexus (null),i,0x00023d000125,iqn.2017-01.com.iscsi.target,t,0x3d BUG: Kernel NULL pointer dereference on read at 0x00000000 NIP strlcpy+0x8/0xb0 LR iscsit_fill_cxn_timeout_err_stats+0x5c/0xc0 [iscsi_target_mod] Call Trace: iscsit_handle_nopin_response_timeout+0xfc/0x120 [iscsi_target_mod] call_timer_fn+0x58/0x1f0 run_timer_softirq+0x740/0x860 __do_softirq+0x16c/0x420 irq_exit+0x188/0x1c0 timer_interrupt+0x184/0x410 That is because nopin response timer may be re-started on nopin timer expiration. Stop nopin timer before stopping the nopin response timer to be sure that no one of them will be re-started. Signed-off-by: Dmitry Bogdanov <d.bogdanov(a)yadro.com> Link: https://lore.kernel.org/r/20241224101757.32300-1-d.bogdanov@yadro.com Reviewed-by: Maurizio Lombardi <mlombard(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/target/iscsi/iscsi_target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c index b516c2893420..b756d4cfecfe 100644 --- a/drivers/target/iscsi/iscsi_target.c +++ b/drivers/target/iscsi/iscsi_target.c @@ -4323,8 +4323,8 @@ int iscsit_close_connection( spin_unlock(&iscsit_global->ts_bitmap_lock); iscsit_stop_timers_for_cmds(conn); - iscsit_stop_nopin_response_timer(conn); iscsit_stop_nopin_timer(conn); + iscsit_stop_nopin_response_timer(conn); if (conn->conn_transport->iscsit_wait_conn) conn->conn_transport->iscsit_wait_conn(conn); -- 2.39.2

2 1

[PATCH OLK-6.6] f2fs: fix to do sanity check on sbi->total_valid_block_count
by Yifan Qiao 04 Jul '25

04 Jul '25

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.94 commit a39cc43efc1bca74ed9d6cf9e60b995071f7d178 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT6T CVE: CVE-2025-38163 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 05872a167c2cab80ef186ef23cc34a6776a1a30c ] syzbot reported a f2fs bug as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/f2fs.h:2521! RIP: 0010:dec_valid_block_count+0x3b2/0x3c0 fs/f2fs/f2fs.h:2521 Call Trace: f2fs_truncate_data_blocks_range+0xc8c/0x11a0 fs/f2fs/file.c:695 truncate_dnode+0x417/0x740 fs/f2fs/node.c:973 truncate_nodes+0x3ec/0xf50 fs/f2fs/node.c:1014 f2fs_truncate_inode_blocks+0x8e3/0x1370 fs/f2fs/node.c:1197 f2fs_do_truncate_blocks+0x840/0x12b0 fs/f2fs/file.c:810 f2fs_truncate_blocks+0x10d/0x300 fs/f2fs/file.c:838 f2fs_truncate+0x417/0x720 fs/f2fs/file.c:888 f2fs_setattr+0xc4f/0x12f0 fs/f2fs/file.c:1112 notify_change+0xbca/0xe90 fs/attr.c:552 do_truncate+0x222/0x310 fs/open.c:65 handle_truncate fs/namei.c:3466 [inline] do_open fs/namei.c:3849 [inline] path_openat+0x2e4f/0x35d0 fs/namei.c:4004 do_filp_open+0x284/0x4e0 fs/namei.c:4031 do_sys_openat2+0x12b/0x1d0 fs/open.c:1429 do_sys_open fs/open.c:1444 [inline] __do_sys_creat fs/open.c:1522 [inline] __se_sys_creat fs/open.c:1516 [inline] __x64_sys_creat+0x124/0x170 fs/open.c:1516 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/syscall_64.c:94 The reason is: in fuzzed image, sbi->total_valid_block_count is inconsistent w/ mapped blocks indexed by inode, so, we should not trigger panic for such case, instead, let's print log and set fsck flag. Fixes: 39a53e0ce0df ("f2fs: add superblock and major in-memory structure") Reported-by: syzbot+8b376a77b2f364097fbe(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/67f3c0b2.050a0220.396535.0547.GAE@… Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/f2fs/f2fs.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index c5297bb8968d..c47243818ef1 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -2445,8 +2445,14 @@ static inline void dec_valid_block_count(struct f2fs_sb_info *sbi, blkcnt_t sectors = count << F2FS_LOG_SECTORS_PER_BLOCK; spin_lock(&sbi->stat_lock); - f2fs_bug_on(sbi, sbi->total_valid_block_count < (block_t) count); - sbi->total_valid_block_count -= (block_t)count; + if (unlikely(sbi->total_valid_block_count < count)) { + f2fs_warn(sbi, "Inconsistent total_valid_block_count:%u, ino:%lu, count:%u", + sbi->total_valid_block_count, inode->i_ino, count); + sbi->total_valid_block_count = 0; + set_sbi_flag(sbi, SBI_NEED_FSCK); + } else { + sbi->total_valid_block_count -= count; + } if (sbi->reserved_blocks && sbi->current_reserved_blocks < sbi->reserved_blocks) sbi->current_reserved_blocks = min(sbi->reserved_blocks, -- 2.39.2

2 1

[PATCH v3 OLK-6.6] config: Enable CONFIG_VIRT_DRIVERS
by Cai Xinchen 04 Jul '25

04 Jul '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBWQ24 -------------------------------- To use tsm report for arm cca guest, enable CONFIG_VIRT_DRIVERS in openeuler_defconfig by default. ARM_CCA_GUEST and TSM_REPORTS will open as module by default. CONFIG_VMGENID will enable by default. Set VMGENID disable. All of CONFIG_NITRO_ENCLAVES dependencies are enable, but this patch only wants to enable CONFIG_ARM_CCA_GUEST, so set CONFIG_NITRO_ENCLAVES disable. Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index f048a1b098d1..4e1e6a5a62b8 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6491,7 +6491,9 @@ CONFIG_VFIO_PLATFORM=m # end of VFIO platform reset drivers # end of VFIO support for platform devices -# CONFIG_VIRT_DRIVERS is not set +CONFIG_VIRT_DRIVERS=y +# CONFIG_VMGENID is not set +# CONFIG_NITRO_ENCLAVES is not set CONFIG_VIRTIO_ANCHOR=y CONFIG_VIRTIO=m CONFIG_VIRTIO_PCI_LIB=m -- 2.18.0.huawei.25

2 1

[PATCH openEuler-1.0-LTS] dm raid: fix address sanitizer warning in raid_resume
by Wang ShaoBo 04 Jul '25

04 Jul '25

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.256 commit 3bfdc95466f5be4d8d95db5a5b470d61641a7c24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGA8J CVE: CVE-2022-50085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7dad24db59d2d2803576f2e3645728866a056dab upstream. There is a KASAN warning in raid_resume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev->raid_disks is greater than rs->raid_disks, so the loop touches one entry beyond the allocated length. Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index 9a5d65d2223b..49209dae7fdd 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3801,7 +3801,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs) memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices)); - for (i = 0; i < mddev->raid_disks; i++) { + for (i = 0; i < rs->raid_disks; i++) { r = &rs->dev[i].rdev; /* HM FIXME: enhance journal device recovery processing */ if (test_bit(Journal, &r->flags)) -- 2.25.1

2 1

[PATCH v2 OLK-6.6] config: Enable CONFIG_VIRT_DRIVERS
by Cai Xinchen 04 Jul '25

04 Jul '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8JVN0 -------------------------------- To use tsm report for arm cca guest, enable CONFIG_VIRT_DRIVERS in openeuler_defconfig by default. ARM_CCA_GUEST and TSM_REPORTS will open as module by default. CONFIG_VMGENID will enable by default. Set VMGENID disable. All of CONFIG_NITRO_ENCLAVES dependencies are enable, but this patch only wants to enable CONFIG_ARM_CCA_GUEST, so set CONFIG_NITRO_ENCLAVES disable. Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index f048a1b098d1..4e1e6a5a62b8 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6491,7 +6491,9 @@ CONFIG_VFIO_PLATFORM=m # end of VFIO platform reset drivers # end of VFIO support for platform devices -# CONFIG_VIRT_DRIVERS is not set +CONFIG_VIRT_DRIVERS=y +# CONFIG_VMGENID is not set +# CONFIG_NITRO_ENCLAVES is not set CONFIG_VIRTIO_ANCHOR=y CONFIG_VIRTIO=m CONFIG_VIRTIO_PCI_LIB=m -- 2.18.0.huawei.25

2 1

[PATCH openEuler-1.0-LTS] usb: host: ohci-ppc-of: Fix refcount leak bug
by Wang ShaoBo 04 Jul '25

04 Jul '25

From: Liang He <windhl(a)126.com> stable inclusion from stable-v4.19.256 commit ec583e300aee9f152a64911445092d18e1c36729 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG8ST CVE: CVE-2022-50033 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40a959d7042bb7711e404ad2318b30e9f92c6b9b ] In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Acked-by: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Liang He <windhl(a)126.com> Link: https://lore.kernel.org/r/20220617034637.4003115-1-windhl@126.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- drivers/usb/host/ohci-ppc-of.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c index 76a9b40b08f1..96c5c7655283 100644 --- a/drivers/usb/host/ohci-ppc-of.c +++ b/drivers/usb/host/ohci-ppc-of.c @@ -169,6 +169,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op) release_mem_region(res.start, 0x4); } else pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__); + of_node_put(np); } irq_dispose_mapping(irq); -- 2.25.1

2 1

[PATCH OLK-6.6] sched/fair: Avoid offline tasks starve to death for priority load balance
by Lu Jialin 04 Jul '25

04 Jul '25

From: Song Zhang <zhangsong34(a)huawei.com> euleros inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICIG0E CVE: NA -------------------- When priority load balance enabled for online/offline tasks co-location, offline tasks maybe starve to death by load balance detach_tasks() if env->loop exceed env->loop_max and can not be migrate to idle cpus. So we should set env->loop to 0 and detach offline tasks again. Fixes: 89bf80a4d6d5 ("sched: Introduce priority load balance for qos scheduler") Signed-off-by: Song Zhang <zhangsong34(a)huawei.com> Confict: kernel/sched/fair.c Patch adaptation due to context changes Signed-off-by: yangjiaqi <yangjiaqi16(a)huawei.com> --- kernel/sched/fair.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index c4c3afa6e7b4..ea3be1ff723e 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -11024,6 +11024,13 @@ static int detach_tasks(struct lb_env *env) #ifdef CONFIG_QOS_SCHED_PRIO_LB if (sysctl_sched_prio_load_balance_enabled && env->imbalance > 0) { + /* + * Avoid offline tasks starve to death if env->loop exceed + * env->loop_max, so we should set env->loop to 0 and detach + * offline tasks again. + */ + if (env->loop > env->loop_max) + env->loop = 0; loop++; if (loop == 1) { tasks = &env->src_rq->cfs_offline_tasks; -- 2.33.0

2 1

[PATCH OLK-6.6] wifi: ath9k_htc: Abort software beacon handling if disabled
by Yongjian Sun 04 Jul '25

04 Jul '25

From: Toke Høiland-Jørgensen <toke(a)toke.dk> mainline inclusion from mainline-v6.16-rc1 commit ac4e317a95a1092b5da5b9918b7118759342641c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJTGW CVE: CVE-2025-38157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A malicious USB device can send a WMI_SWBA_EVENTID event from an ath9k_htc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver, leading to either a crash or an out of bounds read. Prevent this by aborting the handling in ath9k_htc_swba() if beacons are not enabled. Reported-by: Robert Morris <rtm(a)csail.mit.edu> Closes: https://lore.kernel.org/r/88967.1743099372@localhost Fixes: 832f6a18fc2a ("ath9k_htc: Add beacon slots") Signed-off-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Link: https://patch.msgid.link/20250402112217.58533-1-toke@toke.dk Signed-off-by: Jeff Johnson <jeff.johnson(a)oss.qualcomm.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- drivers/net/wireless/ath/ath9k/htc_drv_beacon.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c index 533471e69400..18c7654bc539 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c @@ -290,6 +290,9 @@ void ath9k_htc_swba(struct ath9k_htc_priv *priv, struct ath_common *common = ath9k_hw_common(priv->ah); int slot; + if (!priv->cur_beacon_conf.enable_beacon) + return; + if (swba->beacon_pending != 0) { priv->beacon.bmisscnt++; if (priv->beacon.bmisscnt > BSTUCK_THRESHOLD) { -- 2.39.2

2 1

[PATCH OLK-5.10] media: uvcvideo: Remove dangling pointers
by Zhao Yipeng 04 Jul '25

04 Jul '25

From: Ricardo Ribalda <ribalda(a)chromium.org> mainline inclusion from mainline-v6.14-rc1 commit 221cd51efe4565501a3dbf04cc011b537dcce7fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8W CVE: CVE-2024-58002 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled. Cc: stable(a)vger.kernel.org Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Reviewed-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Link: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-3-26c867231118@chromium… Signed-off-by: Laurent Pinchart <laurent.pinchart(a)ideasonboard.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Conflicts: drivers/media/usb/uvc/uvc_ctrl.c drivers/media/usb/uvc/uvc_v4l2.c drivers/media/usb/uvc/uvcvideo.h [The guard() function is not introduced. 'for' loop initial declaration are only allowed in C99 or C11 mode. And other conflicts are contextual due to the commits d9fecd096f67 and 9e56380ae625 not being merged.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/media/usb/uvc/uvc_ctrl.c | 64 +++++++++++++++++++++++++++++++- drivers/media/usb/uvc/uvc_v4l2.c | 2 + drivers/media/usb/uvc/uvcvideo.h | 9 ++++- 3 files changed, 72 insertions(+), 3 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 5e0acabed37a..c29c2fd67523 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -1276,6 +1276,40 @@ static void uvc_ctrl_send_slave_event(struct uvc_video_chain *chain, uvc_ctrl_send_event(chain, handle, ctrl, mapping, val, changes); } +static void uvc_ctrl_set_handle(struct uvc_fh *handle, struct uvc_control *ctrl, + struct uvc_fh *new_handle) +{ + lockdep_assert_held(&handle->chain->ctrl_mutex); + + if (new_handle) { + if (ctrl->handle) + dev_warn_ratelimited(&handle->stream->dev->udev->dev, + "UVC non compliance: Setting an async control with a pending operation."); + + if (new_handle == ctrl->handle) + return; + + if (ctrl->handle) { + WARN_ON(!ctrl->handle->pending_async_ctrls); + if (ctrl->handle->pending_async_ctrls) + ctrl->handle->pending_async_ctrls--; + } + + ctrl->handle = new_handle; + handle->pending_async_ctrls++; + return; + } + + /* Cannot clear the handle for a control not owned by us.*/ + if (WARN_ON(ctrl->handle != handle)) + return; + + ctrl->handle = NULL; + if (WARN_ON(!handle->pending_async_ctrls)) + return; + handle->pending_async_ctrls--; +} + void uvc_ctrl_status_event(struct uvc_video_chain *chain, struct uvc_control *ctrl, const u8 *data) { @@ -1286,7 +1320,8 @@ void uvc_ctrl_status_event(struct uvc_video_chain *chain, mutex_lock(&chain->ctrl_mutex); handle = ctrl->handle; - ctrl->handle = NULL; + if (handle) + uvc_ctrl_set_handle(handle, ctrl, NULL); list_for_each_entry(mapping, &ctrl->info.mappings, list) { s32 value = __uvc_ctrl_get_value(mapping, data); @@ -1693,7 +1728,7 @@ int uvc_ctrl_set(struct uvc_fh *handle, uvc_ctrl_data(ctrl, UVC_CTRL_DATA_CURRENT)); if (ctrl->info.flags & UVC_CTRL_FLAG_ASYNCHRONOUS) - ctrl->handle = handle; + uvc_ctrl_set_handle(handle, ctrl, handle); ctrl->dirty = 1; ctrl->modified = 1; @@ -2337,6 +2372,31 @@ int uvc_ctrl_init_device(struct uvc_device *dev) return 0; } +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle) +{ + struct uvc_entity *entity; + + mutex_lock(&handle->chain->ctrl_mutex); + + if (!handle->pending_async_ctrls) { + mutex_unlock(&handle->chain->ctrl_mutex); + return; + } + + list_for_each_entry(entity, &handle->chain->dev->entities, list) { + unsigned int i; + + for (i = 0; i < entity->ncontrols; ++i) { + if (entity->controls[i].handle != handle) + continue; + uvc_ctrl_set_handle(handle, &entity->controls[i], NULL); + } + } + + WARN_ON(handle->pending_async_ctrls); + mutex_unlock(&handle->chain->ctrl_mutex); +} + /* * Cleanup device controls. */ diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index b40a2b904ace..7ad00ba0b99f 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -593,6 +593,8 @@ static int uvc_v4l2_release(struct file *file) uvc_trace(UVC_TRACE_CALLS, "uvc_v4l2_release\n"); + uvc_ctrl_cleanup_fh(handle); + /* Only free resources if this is a privileged handle. */ if (uvc_has_privileges(handle)) uvc_queue_release(&stream->queue); diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index c75990c0957e..3edf454c164f 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -448,7 +448,11 @@ struct uvc_video_chain { struct uvc_entity *processing; /* Processing unit */ struct uvc_entity *selector; /* Selector unit */ - struct mutex ctrl_mutex; /* Protects ctrl.info */ + struct mutex ctrl_mutex; /* + * Protects ctrl.info, + * ctrl.handle and + * uvc_fh.pending_async_ctrls + */ struct v4l2_prio_state prio; /* V4L2 priority state */ u32 caps; /* V4L2 chain-wide caps */ @@ -694,6 +698,7 @@ struct uvc_fh { struct uvc_video_chain *chain; struct uvc_streaming *stream; enum uvc_handle_state state; + unsigned int pending_async_ctrls; }; struct uvc_driver { @@ -866,6 +871,8 @@ int uvc_ctrl_set(struct uvc_fh *handle, struct v4l2_ext_control *xctrl); int uvc_xu_ctrl_query(struct uvc_video_chain *chain, struct uvc_xu_control_query *xqry); +void uvc_ctrl_cleanup_fh(struct uvc_fh *handle); + /* Utility functions */ void uvc_simplify_fraction(u32 *numerator, u32 *denominator, unsigned int n_terms, unsigned int threshold); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 04 Jul '25

04 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-49964 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[openeuler:OLK-5.10 3011/3011] arch/arm64/kernel/syscall.c:281:6: warning: no previous prototype for 'do_el0_xcall'
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d33d9222dd0abdddb305cbcd6dddf6763e0bcd5a commit: f22cbd7df3438fb008e74ddcbe6619c1a03c7955 [3011/3011] arm64: Faster SVC exception handler with xcall config: arm64-randconfig-001-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041422.jQntADhM-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041422.jQntADhM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041422.jQntADhM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/syscall.c:281:6: warning: no previous prototype for 'do_el0_xcall' [-Wmissing-prototypes] 281 | void do_el0_xcall(struct pt_regs *regs) | ^~~~~~~~~~~~ arch/arm64/kernel/syscall.c:297:6: warning: no previous prototype for 'do_el0_svc' [-Wmissing-prototypes] 297 | void do_el0_svc(struct pt_regs *regs) | ^~~~~~~~~~ arch/arm64/kernel/syscall.c:313:6: warning: no previous prototype for 'do_el0_svc_compat' [-Wmissing-prototypes] 313 | void do_el0_svc_compat(struct pt_regs *regs) | ^~~~~~~~~~~~~~~~~ vim +/do_el0_xcall +281 arch/arm64/kernel/syscall.c 279 280 #ifdef CONFIG_FAST_SYSCALL > 281 void do_el0_xcall(struct pt_regs *regs) 282 { 283 const syscall_fn_t *t = sys_call_table; 284 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] clk: bcm: rpi: Add NULL check in raspberrypi_clk_register()
by Wang Zhaolong 04 Jul '25

04 Jul '25

From: Henry Martin <bsdhenrymartin(a)gmail.com> stable inclusion from stable-v6.6.94 commit 3c1adc2f8c732ea09e8c4bce5941fec019c6205d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT6U CVE: CVE-2025-38160 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------- [ Upstream commit 73c46d9a93d071ca69858dea3f569111b03e549e ] devm_kasprintf() returns NULL when memory allocation fails. Currently, raspberrypi_clk_register() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue. Fixes: 93d2725affd6 ("clk: bcm: rpi: Discover the firmware clocks") Signed-off-by: Henry Martin <bsdhenrymartin(a)gmail.com> Reviewed-by: Dave Stevenson <dave.stevenson(a)raspberrypi.com> Link: https://lore.kernel.org/r/20250402020513.42628-1-bsdhenrymartin@gmail.com Reviewed-by: Stefan Wahren <wahrenst(a)gmx.net> Signed-off-by: Stephen Boyd <sboyd(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- drivers/clk/bcm/clk-raspberrypi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/bcm/clk-raspberrypi.c b/drivers/clk/bcm/clk-raspberrypi.c index 4d411408e4af..cc4ca336ac13 100644 --- a/drivers/clk/bcm/clk-raspberrypi.c +++ b/drivers/clk/bcm/clk-raspberrypi.c @@ -269,10 +269,12 @@ static struct clk_hw *raspberrypi_clk_register(struct raspberrypi_clk *rpi, data->variant = variant; init.name = devm_kasprintf(rpi->dev, GFP_KERNEL, "fw-clk-%s", rpi_firmware_clk_names[id]); + if (!init.name) + return ERR_PTR(-ENOMEM); init.ops = &raspberrypi_firmware_clk_ops; init.flags = CLK_GET_RATE_NOCACHE; data->hw.init = &init; -- 2.34.3

2 1

[PATCH OLK-6.6 1/7] arm64: enable Permission Indirection Extension (PIE)
by Qi Xi 04 Jul '25

04 Jul '25

From: Joey Gouly <joey.gouly(a)arm.com> Now that the necessary changes have been made, set the Permission Indirection registers and enable the Permission Indirection Extension. Signed-off-by: Joey Gouly <joey.gouly(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20230606145859.697944-17-joey.gouly@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/arm64/mm/proc.S | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S index 1a9684b11474..79e328a1c1ec 100644 --- a/arch/arm64/mm/proc.S +++ b/arch/arm64/mm/proc.S @@ -455,6 +455,21 @@ SYM_FUNC_START(__cpu_setup) #endif /* CONFIG_ARM64_HW_AFDBM */ msr mair_el1, mair msr tcr_el1, tcr + + mrs_s x1, SYS_ID_AA64MMFR3_EL1 + ubfx x1, x1, #ID_AA64MMFR3_EL1_S1PIE_SHIFT, #4 + cbz x1, .Lskip_indirection + + mov_q x0, PIE_E0 + msr REG_PIRE0_EL1, x0 + mov_q x0, PIE_E1 + msr REG_PIR_EL1, x0 + + mov x0, TCR2_EL1x_PIE + msr REG_TCR2_EL1, x0 + +.Lskip_indirection: + /* * Prepare SCTLR */ -- 2.33.0

2 7

[PATCH OLK-6.6 1/4] Revert "arm64: add HWCAP for FEAT_HBC (hinted conditional branches)"
by Qi Xi 04 Jul '25

04 Jul '25

This reverts commit a5eb84a142299b796c94b3d43c21409a22f18c4a. This reverts commit 1ade045233751daefb4f57ccd7ea2d2311c5ded0. Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/arm64/include/asm/hwcap.h | 1 - arch/arm64/include/asm/sysreg.h | 4 ---- arch/arm64/include/uapi/asm/hwcap.h | 1 - arch/arm64/kernel/cpufeature.c | 21 +-------------------- arch/arm64/kernel/cpuinfo.c | 1 - arch/arm64/tools/cpucaps | 1 - 6 files changed, 1 insertion(+), 28 deletions(-) diff --git a/arch/arm64/include/asm/hwcap.h b/arch/arm64/include/asm/hwcap.h index 2155094ef9f7..f68fbb207473 100644 --- a/arch/arm64/include/asm/hwcap.h +++ b/arch/arm64/include/asm/hwcap.h @@ -108,7 +108,6 @@ #define KERNEL_HWCAP_ECV __khwcap2_feature(ECV) #define KERNEL_HWCAP_AFP __khwcap2_feature(AFP) #define KERNEL_HWCAP_RPRES __khwcap2_feature(RPRES) -#define KERNEL_HWCAP_HBC __khwcap2_feature(HBC) /* * This yields a mask that user programs can use to figure out what diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h index b8d00be796cf..3cafd4ef0c74 100644 --- a/arch/arm64/include/asm/sysreg.h +++ b/arch/arm64/include/asm/sysreg.h @@ -907,7 +907,6 @@ /* id_aa64mmfr1 */ #define ID_AA64MMFR1_ECBHB_SHIFT 60 -#define ID_AA64MMFR1_TIDCP1_SHIFT 52 #define ID_AA64MMFR1_AFP_SHIFT 44 #define ID_AA64MMFR1_ETS_SHIFT 36 #define ID_AA64MMFR1_TWED_SHIFT 32 @@ -923,9 +922,6 @@ #define ID_AA64MMFR1_VMIDBITS_8 0 #define ID_AA64MMFR1_VMIDBITS_16 2 -#define ID_AA64MMFR1_TIDCP1_NI 0 -#define ID_AA64MMFR1_TIDCP1_IMP 1 - /* id_aa64mmfr2 */ #define ID_AA64MMFR2_E0PD_SHIFT 60 #define ID_AA64MMFR2_EVT_SHIFT 56 diff --git a/arch/arm64/include/uapi/asm/hwcap.h b/arch/arm64/include/uapi/asm/hwcap.h index 0a3df77b8b64..f03731847d9d 100644 --- a/arch/arm64/include/uapi/asm/hwcap.h +++ b/arch/arm64/include/uapi/asm/hwcap.h @@ -78,6 +78,5 @@ #define HWCAP2_ECV (1 << 19) #define HWCAP2_AFP (1 << 20) #define HWCAP2_RPRES (1 << 21) -#define HWCAP2_HBC (1UL << 22) #endif /* _UAPI__ASM_HWCAP_H */ diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index e0b79f932a5f..752e1001a5c7 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -232,7 +232,7 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = { }; static const struct arm64_ftr_bits ftr_id_aa64isar2[] = { - ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, ID_AA64ISAR2_CLEARBHB_SHIFT, 4, 0), + ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_HIGHER_SAFE, ID_AA64ISAR2_CLEARBHB_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64ISAR2_RPRES_SHIFT, 4, 0), ARM64_FTR_END, }; @@ -337,7 +337,6 @@ static const struct arm64_ftr_bits ftr_id_aa64mmfr0[] = { }; static const struct arm64_ftr_bits ftr_id_aa64mmfr1[] = { - ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_TIDCP1_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_AFP_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_ETS_SHIFT, 4, 0), ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_LOWER_SAFE, ID_AA64MMFR1_TWED_SHIFT, 4, 0), @@ -1944,11 +1943,6 @@ static bool is_kvm_protected_mode(const struct arm64_cpu_capabilities *entry, in } #endif /* CONFIG_KVM */ -static void cpu_trap_el0_impdef(const struct arm64_cpu_capabilities *__unused) -{ - sysreg_clear_set(sctlr_el1, 0, SCTLR_EL1_TIDCP); -} - /* Internal helper functions to match cpu capability type */ static bool cpucap_late_cpu_optional(const struct arm64_cpu_capabilities *cap) @@ -2391,18 +2385,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = { .matches = has_cpuid_feature, .min_field_value = 1, }, - { - .desc = "Trap EL0 IMPLEMENTATION DEFINED functionality", - .capability = ARM64_HAS_TIDCP1, - .type = ARM64_CPUCAP_SYSTEM_FEATURE, - .sys_reg = SYS_ID_AA64MMFR1_EL1, - .sign = FTR_UNSIGNED, - .field_pos = ID_AA64MMFR1_TIDCP1_SHIFT, - .field_width = 4, - .min_field_value = ID_AA64MMFR1_TIDCP1_IMP, - .matches = has_cpuid_feature, - .cpu_enable = cpu_trap_el0_impdef, - }, {}, }; @@ -2525,7 +2507,6 @@ static const struct arm64_cpu_capabilities arm64_elf_hwcaps[] = { HWCAP_CAP(SYS_ID_AA64MMFR0_EL1, ID_AA64MMFR0_ECV_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_ECV), HWCAP_CAP(SYS_ID_AA64MMFR1_EL1, ID_AA64MMFR1_AFP_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_AFP), HWCAP_CAP(SYS_ID_AA64ISAR2_EL1, ID_AA64ISAR2_RPRES_SHIFT, FTR_UNSIGNED, 1, CAP_HWCAP, KERNEL_HWCAP_RPRES), - HWCAP_CAP(ID_AA64ISAR2_EL1, BC, IMP, CAP_HWCAP, KERNEL_HWCAP_HBC), {}, }; diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c index 04a7d2a974ce..d72898af05b4 100644 --- a/arch/arm64/kernel/cpuinfo.c +++ b/arch/arm64/kernel/cpuinfo.c @@ -97,7 +97,6 @@ static const char *const hwcap_str[] = { [KERNEL_HWCAP_ECV] = "ecv", [KERNEL_HWCAP_AFP] = "afp", [KERNEL_HWCAP_RPRES] = "rpres", - [KERNEL_HWCAP_HBC] = "hbc", }; #ifdef CONFIG_COMPAT diff --git a/arch/arm64/tools/cpucaps b/arch/arm64/tools/cpucaps index c44cd3b076e9..a590cabe890c 100644 --- a/arch/arm64/tools/cpucaps +++ b/arch/arm64/tools/cpucaps @@ -34,7 +34,6 @@ HAS_RNG HAS_SB HAS_STAGE2_FWB HAS_SYSREG_GIC_CPUIF -HAS_TIDCP1 HAS_TLB_RANGE HAS_VIRT_HOST_EXTN HW_DBM -- 2.33.0

2 4

[openeuler:OLK-5.10 3011/3011] drivers/net/ethernet/mucse/rnp/rnp_sysfs.c:1958:2: warning: 'strncpy' specified bound 100 equals destination size
by kernel test robot 04 Jul '25

04 Jul '25

Hi Dong, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: d33d9222dd0abdddb305cbcd6dddf6763e0bcd5a commit: e53494b741272933726616122ea77143d9742631 [3011/3011] drivers: initial support for rnp drivers from Mucse Technology config: arm64-randconfig-004-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041337.WpaxtPMv-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041337.WpaxtPMv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041337.WpaxtPMv-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnp/rnp.h:21, from drivers/net/ethernet/mucse/rnp/rnp_sysfs.c:13: drivers/net/ethernet/mucse/rnp/rnp_common.h: In function '_rnp_skb_dump': drivers/net/ethernet/mucse/rnp/rnp_common.h:336:22: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 336 | &dev->features); | ^ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:16: warning: variable 'tailroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_common.h:299:6: warning: variable 'headroom' set but not used [-Wunused-but-set-variable] 299 | int headroom, tailroom; | ^~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:16: warning: variable 'has_trans' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_common.h:298:7: warning: variable 'has_mac' set but not used [-Wunused-but-set-variable] 298 | bool has_mac, has_trans; | ^~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_sysfs.c: At top level: drivers/net/ethernet/mucse/rnp/rnp_sysfs.c:1214:5: warning: no previous prototype for 'rnp_mbx_get_pn_sn' [-Wmissing-prototypes] 1214 | int rnp_mbx_get_pn_sn(struct rnp_hw *hw, char pn[33], char sn[33]) | ^~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnp/rnp_sysfs.c: In function '_switch_loopback': >> drivers/net/ethernet/mucse/rnp/rnp_sysfs.c:1958:2: warning: 'strncpy' specified bound 100 equals destination size [-Wstringop-truncation] 1958 | strncpy(name, peer_eth, sizeof(name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/strncpy +1958 drivers/net/ethernet/mucse/rnp/rnp_sysfs.c 1950 1951 static ssize_t _switch_loopback(struct rnp_adapter *adapter, 1952 const char *peer_eth, int en) 1953 { 1954 struct net_device *peer_netdev = NULL; 1955 struct rnp_adapter *peer_adapter = NULL; 1956 char name[100]; 1957 > 1958 strncpy(name, peer_eth, sizeof(name)); 1959 strim(name); 1960 1961 pr_info("%s: nr_lane:%d peer_lane:%s en:%d\n", __func__, 0, 1962 peer_eth, en); 1963 1964 peer_netdev = dev_get_by_name(&init_net, name); 1965 if (!peer_netdev) { 1966 e_err(drv, "canot' find %s\n", name); 1967 return -EINVAL; 1968 } 1969 peer_adapter = netdev_priv(peer_netdev); 1970 1971 if (PCI_SLOT(peer_adapter->pdev->devfn) != 1972 PCI_SLOT(adapter->pdev->devfn)) { 1973 e_err(drv, "%s %s not in same slot\n", 1974 netdev_name(adapter->netdev), 1975 netdev_name(peer_adapter->netdev)); 1976 dev_put(peer_netdev); 1977 return -EINVAL; 1978 } 1979 1980 1981 do_switch_loopback_set(adapter, en, 0, 1982 rnp_is_pf1(&peer_adapter->hw) ? 4 : 0); 1983 do_switch_loopback_set(peer_adapter, en, 0, 1984 rnp_is_pf1(&adapter->hw) ? 4 : 0); 1985 1986 if (peer_netdev) 1987 dev_put(peer_netdev); 1988 1989 return 0; 1990 } 1991 static ssize_t switch_loopback_on_store(struct device *dev, 1992 struct device_attribute *attr, 1993 const char *buf, size_t count) 1994 { 1995 struct rnp_adapter *adapter = netdev_priv(to_net_device(dev)); 1996 1997 return _switch_loopback(adapter, buf, 1) == 0 ? count : -EINVAL; 1998 } 1999 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2455/2455] ERROR: modpost: "fg_console" [drivers/video/fbdev/ls2k500sfb.ko] undefined!
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 673b27ee13cb811b3f418669e6826b95459c32f4 commit: 8248d42b7c5f4338a54f26d8efebec8614b43466 [2455/2455] fbdev: add ls2k500sfb driver for ls2k500 bmc. config: arm64-randconfig-001-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041220.xQnKLHix-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041220.xQnKLHix-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041220.xQnKLHix-lkp@intel.com/ All errors (new ones prefixed by >>, old ones prefixed by <<): WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/block/xen-blkback/xen-blkback.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mfd/pcf50633-gpio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mfd/qcom-pm8008.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/host/nvme.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/host/nvme-tcp.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mtd/chips/cfi_util.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mtd/chips/cfi_cmdset_0020.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/mdio/mdio-aspeed.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ath/wcn36xx/wcn36xx.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/brcmfmac-wcc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/brcmfmac-cyw.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/brcmfmac-bca.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wlcore/wlcore.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wlcore/wlcore_spi.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wlcore/wlcore_sdio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wl12xx/wl12xx.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wl1251/wl1251_spi.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wl1251/wl1251_sdio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/arcnet.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/rfc1201.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/arc-rawmode.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/capmode.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/com90io.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/ppp/ppp_generic.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/ppp/ppp_async.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/ppp/bsd_comp.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/atm/iphase.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/atm/eni.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firewire/firewire-uapi-test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/host/ohci-exynos.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/serial/usb_debug.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/serial/mxuport.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/gadget/function/usb_f_uvc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/mon/usbmon.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/class/usbtmc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/chipidea/ci_hdrc_msm.o WARNING: modpost: drivers/rtc/rtc-at91rm9200: section mismatch in reference: at91_rtc_driver+0x8 (section: .data) -> at91_rtc_remove (section: .exit.text) WARNING: modpost: drivers/rtc/rtc-mv: section mismatch in reference: mv_rtc_driver+0x8 (section: .data) -> mv_rtc_remove (section: .exit.text) WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/rtc/rtc-omap.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/rtc/rtc-rc5t583.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/i2c/busses/i2c-pxa.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/tuners/tda9887.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/common/videobuf2/videobuf2-dvb.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/common/uvc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/pci/ttpci/budget-core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/dvb-frontends/au8522_decoder.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/v4l2-core/v4l2-async.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/v4l2-core/v4l2-fwnode.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/host/of_mmc_spi.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/host/tmio_mmc_core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/host/renesas_sdhi_core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/core/mmc_core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/core/pwrseq_simple.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/core/pwrseq_sd8787.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/core/sdio_uart.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/leds/flash/leds-rt4505.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firmware/google/coreboot_table.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firmware/google/cbmem.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firmware/google/vpd-sysfs.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/crypto/xilinx/zynqmp-aes-gcm.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/crypto/intel/keembay/keembay-ocs-hcu.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/crypto/atmel-sha204a.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/wlan-ng/prism2_usb.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/rtl8192e/rtllib.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/rtl8192e/rtllib_crypt_ccmp.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/rtl8192e/rtllib_crypt_tkip.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/fbtft/fbtft.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/devfreq/governor_simpleondemand.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/perf/marvell_cn10k_ddr_pmu.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hwtracing/intel_th/intel_th_msu_sink.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvmem/nvmem_u-boot-env.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/siox/siox-bus-gpio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/interconnect/imx/imx8mn-interconnect.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/iio/adc/ingenic-adc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/iio/adc/xilinx-ams.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/iio/buffer/kfifo_buf.o WARNING: modpost: drivers/hwtracing/coresight/coresight-etm4x: section mismatch in reference: etm4x_amba_driver+0x98 (section: .data) -> etm4_remove_amba (section: .exit.text) WARNING: modpost: drivers/hwtracing/coresight/coresight-etm4x: section mismatch in reference: etm4_platform_driver+0x8 (section: .data) -> etm4_remove_platform_dev (section: .exit.text) WARNING: modpost: missing MODULE_DESCRIPTION() in net/core/dev_addr_lists_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/netfilter/nft_fib.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv4/netfilter/iptable_raw.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv4/ipip.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv4/udp_diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv4/raw_diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/xfrm/xfrm_user.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/unix/unix_diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv6/netfilter/nf_reject_ipv6.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv6/ah6.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv6/esp6.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv6/mip6.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/bridge/netfilter/ebtables.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/bridge/netfilter/ebtable_broute.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/bridge/netfilter/ebtable_filter.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/bridge/netfilter/ebtable_nat.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/atm/lec.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/tipc/diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/xdp/xsk_diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/6lowpan/6lowpan.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/nfc/nfc_digital.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/hsr/hsr.o >> ERROR: modpost: "fg_console" [drivers/video/fbdev/ls2k500sfb.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0