July 2025 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 V1] libnvdimm/labels: Fix divide error in nd_label_data_init()
by Wang Tao 02 Jul '25

02 Jul '25

From: Robert Richter <rrichter(a)amd.com> stable inclusion from stable-v5.10.238 commit 396c46d3f59a18ebcc500640e749f16e197d472b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEE CVE: CVE-2025-38072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef1d3455bbc1922f94a91ed58d3d7db440652959 ] If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check. Signed-off-by: Robert Richter <rrichter(a)amd.com> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)amd.com> Reviewed-by: Ira Weiny <ira.weiny(a)intel.com> Link: https://patch.msgid.link/20250320112223.608320-1-rrichter@amd.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/nvdimm/label.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c index 9251441fd8a3..5251058adc4d 100644 --- a/drivers/nvdimm/label.c +++ b/drivers/nvdimm/label.c @@ -421,7 +421,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd) if (ndd->data) return 0; - if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) { + if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 || + ndd->nsarea.config_size == 0) { dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n", ndd->nsarea.max_xfer, ndd->nsarea.config_size); return -ENXIO; -- 2.34.1

2 1

[PATCH OLK-6.6 V1] libnvdimm/labels: Fix divide error in nd_label_data_init()
by Wang Tao 02 Jul '25

02 Jul '25

From: Robert Richter <rrichter(a)amd.com> stable inclusion from stable-v6.6.93 commit ea3d95e05e97ea20fd6513f647393add16fce3b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEE CVE: CVE-2025-38072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef1d3455bbc1922f94a91ed58d3d7db440652959 ] If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check. Signed-off-by: Robert Richter <rrichter(a)amd.com> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)amd.com> Reviewed-by: Ira Weiny <ira.weiny(a)intel.com> Link: https://patch.msgid.link/20250320112223.608320-1-rrichter@amd.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/nvdimm/label.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c index 082253a3a956..04f4a049599a 100644 --- a/drivers/nvdimm/label.c +++ b/drivers/nvdimm/label.c @@ -442,7 +442,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd) if (ndd->data) return 0; - if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) { + if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 || + ndd->nsarea.config_size == 0) { dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n", ndd->nsarea.max_xfer, ndd->nsarea.config_size); return -ENXIO; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] net/tipc/link.c:198: warning: Function parameter or member 'backlog.target_bskb' not described in 'tipc_link'
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: eb923245b9deef21ddd337c4e1e081c407a891fd [1605/1605] tipc: fix unlimited bundling of small messages config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507021034.5BJRugpy-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021034.5BJRugpy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021034.5BJRugpy-lkp@intel.com/ All warnings (new ones prefixed by >>): net/tipc/link.c:198: warning: Function parameter or member 'session' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'snd_nxt_state' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'rcv_nxt_state' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'in_session' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'active' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'if_name' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'rst_cnt' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'drop_point' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'failover_reasm_skb' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'transmq' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'backlog' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'backlog.len' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'backlog.limit' not described in 'tipc_link' >> net/tipc/link.c:198: warning: Function parameter or member 'backlog.target_bskb' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'snd_nxt' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'last_retransm' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'window' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'rcv_unacked' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'deferdq' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'bc_rcvlink' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'bc_sndlink' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'prev_retr' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'prev_from' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'prev_to' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'nack_state' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'bc_peer_is_up' not described in 'tipc_link' net/tipc/link.c:450: warning: Function parameter or member 'net' not described in 'tipc_link_create' net/tipc/link.c:450: warning: Function parameter or member 'self' not described in 'tipc_link_create' net/tipc/link.c:450: warning: Function parameter or member 'peer_id' not described in 'tipc_link_create' net/tipc/link.c:450: warning: Excess function parameter 'n' description in 'tipc_link_create' net/tipc/link.c:450: warning: Excess function parameter 'ownnode' description in 'tipc_link_create' net/tipc/link.c:519: warning: Function parameter or member 'net' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Function parameter or member 'ownnode' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Function parameter or member 'peer' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Function parameter or member 'peer_caps' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Function parameter or member 'bc_sndlink' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Excess function parameter 'n' description in 'tipc_link_bc_create' net/tipc/link.c:903: warning: Function parameter or member 'l' not described in 'tipc_link_xmit' net/tipc/link.c:903: warning: Excess function parameter 'link' description in 'tipc_link_xmit' vim +198 net/tipc/link.c 38206d59390684 Jon Paul Maloy 2015-11-19 78 38206d59390684 Jon Paul Maloy 2015-11-19 79 /** 38206d59390684 Jon Paul Maloy 2015-11-19 80 * struct tipc_link - TIPC link data structure 38206d59390684 Jon Paul Maloy 2015-11-19 81 * @addr: network address of link's peer node 38206d59390684 Jon Paul Maloy 2015-11-19 82 * @name: link name character string 38206d59390684 Jon Paul Maloy 2015-11-19 83 * @media_addr: media address to use when sending messages over link 38206d59390684 Jon Paul Maloy 2015-11-19 84 * @timer: link timer 38206d59390684 Jon Paul Maloy 2015-11-19 85 * @net: pointer to namespace struct 38206d59390684 Jon Paul Maloy 2015-11-19 86 * @refcnt: reference counter for permanent references (owner node & timer) 38206d59390684 Jon Paul Maloy 2015-11-19 87 * @peer_session: link session # being used by peer end of link 38206d59390684 Jon Paul Maloy 2015-11-19 88 * @peer_bearer_id: bearer id used by link's peer endpoint 38206d59390684 Jon Paul Maloy 2015-11-19 89 * @bearer_id: local bearer id used by link 38206d59390684 Jon Paul Maloy 2015-11-19 90 * @tolerance: minimum link continuity loss needed to reset link [in ms] 38206d59390684 Jon Paul Maloy 2015-11-19 91 * @abort_limit: # of unacknowledged continuity probes needed to reset link 38206d59390684 Jon Paul Maloy 2015-11-19 92 * @state: current state of link FSM 38206d59390684 Jon Paul Maloy 2015-11-19 93 * @peer_caps: bitmap describing capabilities of peer node 38206d59390684 Jon Paul Maloy 2015-11-19 94 * @silent_intv_cnt: # of timer intervals without any reception from peer 38206d59390684 Jon Paul Maloy 2015-11-19 95 * @proto_msg: template for control messages generated by link 38206d59390684 Jon Paul Maloy 2015-11-19 96 * @pmsg: convenience pointer to "proto_msg" field 38206d59390684 Jon Paul Maloy 2015-11-19 97 * @priority: current link priority 38206d59390684 Jon Paul Maloy 2015-11-19 98 * @net_plane: current link network plane ('A' through 'H') 35c55c9877f8de Jon Paul Maloy 2016-06-13 99 * @mon_state: cookie with information needed by link monitor 38206d59390684 Jon Paul Maloy 2015-11-19 100 * @backlog_limit: backlog queue congestion thresholds (indexed by importance) 38206d59390684 Jon Paul Maloy 2015-11-19 101 * @exp_msg_count: # of tunnelled messages expected during link changeover 38206d59390684 Jon Paul Maloy 2015-11-19 102 * @reset_rcv_checkpt: seq # of last acknowledged message at time of link reset 38206d59390684 Jon Paul Maloy 2015-11-19 103 * @mtu: current maximum packet size for this link 38206d59390684 Jon Paul Maloy 2015-11-19 104 * @advertised_mtu: advertised own mtu when link is being established 38206d59390684 Jon Paul Maloy 2015-11-19 105 * @transmitq: queue for sent, non-acked messages 38206d59390684 Jon Paul Maloy 2015-11-19 106 * @backlogq: queue for messages waiting to be sent 38206d59390684 Jon Paul Maloy 2015-11-19 107 * @snt_nxt: next sequence number to use for outbound messages 38206d59390684 Jon Paul Maloy 2015-11-19 108 * @last_retransmitted: sequence number of most recently retransmitted message a4dc70d46cf1a0 Jon Maloy 2018-07-06 109 * @stale_cnt: counter for number of identical retransmit attempts a4dc70d46cf1a0 Jon Maloy 2018-07-06 110 * @stale_limit: time when repeated identical retransmits must force link reset 38206d59390684 Jon Paul Maloy 2015-11-19 111 * @ackers: # of peers that needs to ack each packet before it can be released 38206d59390684 Jon Paul Maloy 2015-11-19 112 * @acked: # last packet acked by a certain peer. Used for broadcast. 38206d59390684 Jon Paul Maloy 2015-11-19 113 * @rcv_nxt: next sequence number to expect for inbound messages 38206d59390684 Jon Paul Maloy 2015-11-19 114 * @deferred_queue: deferred queue saved OOS b'cast message received from node 38206d59390684 Jon Paul Maloy 2015-11-19 115 * @unacked_window: # of inbound messages rx'd without ack'ing back to peer 38206d59390684 Jon Paul Maloy 2015-11-19 116 * @inputq: buffer queue for messages to be delivered upwards 38206d59390684 Jon Paul Maloy 2015-11-19 117 * @namedq: buffer queue for name table messages to be delivered upwards 38206d59390684 Jon Paul Maloy 2015-11-19 118 * @next_out: ptr to first unsent outbound message in queue 38206d59390684 Jon Paul Maloy 2015-11-19 119 * @wakeupq: linked list of wakeup msgs waiting for link congestion to abate 38206d59390684 Jon Paul Maloy 2015-11-19 120 * @long_msg_seq_no: next identifier to use for outbound fragmented messages 38206d59390684 Jon Paul Maloy 2015-11-19 121 * @reasm_buf: head of partially reassembled inbound message fragments 38206d59390684 Jon Paul Maloy 2015-11-19 122 * @bc_rcvr: marks that this is a broadcast receiver link 38206d59390684 Jon Paul Maloy 2015-11-19 123 * @stats: collects statistics regarding link activity 38206d59390684 Jon Paul Maloy 2015-11-19 124 */ 38206d59390684 Jon Paul Maloy 2015-11-19 125 struct tipc_link { 38206d59390684 Jon Paul Maloy 2015-11-19 126 u32 addr; 38206d59390684 Jon Paul Maloy 2015-11-19 127 char name[TIPC_MAX_LINK_NAME]; 38206d59390684 Jon Paul Maloy 2015-11-19 128 struct net *net; 38206d59390684 Jon Paul Maloy 2015-11-19 129 38206d59390684 Jon Paul Maloy 2015-11-19 130 /* Management and link supervision data */ 7ea817f4e8322f Jon Maloy 2018-07-10 131 u16 peer_session; 7ea817f4e8322f Jon Maloy 2018-07-10 132 u16 session; 9012de50895601 Jon Maloy 2018-07-10 133 u16 snd_nxt_state; 9012de50895601 Jon Maloy 2018-07-10 134 u16 rcv_nxt_state; 38206d59390684 Jon Paul Maloy 2015-11-19 135 u32 peer_bearer_id; 38206d59390684 Jon Paul Maloy 2015-11-19 136 u32 bearer_id; 38206d59390684 Jon Paul Maloy 2015-11-19 137 u32 tolerance; 38206d59390684 Jon Paul Maloy 2015-11-19 138 u32 abort_limit; 38206d59390684 Jon Paul Maloy 2015-11-19 139 u32 state; 38206d59390684 Jon Paul Maloy 2015-11-19 140 u16 peer_caps; 7ea817f4e8322f Jon Maloy 2018-07-10 141 bool in_session; 38206d59390684 Jon Paul Maloy 2015-11-19 142 bool active; 38206d59390684 Jon Paul Maloy 2015-11-19 143 u32 silent_intv_cnt; e74a386d70c793 Jon Paul Maloy 2016-03-03 144 char if_name[TIPC_MAX_IF_NAME]; 38206d59390684 Jon Paul Maloy 2015-11-19 145 u32 priority; 38206d59390684 Jon Paul Maloy 2015-11-19 146 char net_plane; 35c55c9877f8de Jon Paul Maloy 2016-06-13 147 struct tipc_mon_state mon_state; 88e8ac7000dc7c Jon Paul Maloy 2016-04-15 148 u16 rst_cnt; 38206d59390684 Jon Paul Maloy 2015-11-19 149 38206d59390684 Jon Paul Maloy 2015-11-19 150 /* Failover/synch */ 38206d59390684 Jon Paul Maloy 2015-11-19 151 u16 drop_point; 38206d59390684 Jon Paul Maloy 2015-11-19 152 struct sk_buff *failover_reasm_skb; 38206d59390684 Jon Paul Maloy 2015-11-19 153 38206d59390684 Jon Paul Maloy 2015-11-19 154 /* Max packet negotiation */ 38206d59390684 Jon Paul Maloy 2015-11-19 155 u16 mtu; 38206d59390684 Jon Paul Maloy 2015-11-19 156 u16 advertised_mtu; 38206d59390684 Jon Paul Maloy 2015-11-19 157 38206d59390684 Jon Paul Maloy 2015-11-19 158 /* Sending */ 38206d59390684 Jon Paul Maloy 2015-11-19 159 struct sk_buff_head transmq; 38206d59390684 Jon Paul Maloy 2015-11-19 160 struct sk_buff_head backlogq; 38206d59390684 Jon Paul Maloy 2015-11-19 161 struct { 38206d59390684 Jon Paul Maloy 2015-11-19 162 u16 len; 38206d59390684 Jon Paul Maloy 2015-11-19 163 u16 limit; eb923245b9deef Tuong Lien 2019-10-10 164 struct sk_buff *target_bskb; 38206d59390684 Jon Paul Maloy 2015-11-19 165 } backlog[5]; 38206d59390684 Jon Paul Maloy 2015-11-19 166 u16 snd_nxt; 38206d59390684 Jon Paul Maloy 2015-11-19 167 u16 last_retransm; 38206d59390684 Jon Paul Maloy 2015-11-19 168 u16 window; a4dc70d46cf1a0 Jon Maloy 2018-07-06 169 u16 stale_cnt; a4dc70d46cf1a0 Jon Maloy 2018-07-06 170 unsigned long stale_limit; 38206d59390684 Jon Paul Maloy 2015-11-19 171 38206d59390684 Jon Paul Maloy 2015-11-19 172 /* Reception */ 38206d59390684 Jon Paul Maloy 2015-11-19 173 u16 rcv_nxt; 38206d59390684 Jon Paul Maloy 2015-11-19 174 u32 rcv_unacked; 38206d59390684 Jon Paul Maloy 2015-11-19 175 struct sk_buff_head deferdq; 38206d59390684 Jon Paul Maloy 2015-11-19 176 struct sk_buff_head *inputq; 38206d59390684 Jon Paul Maloy 2015-11-19 177 struct sk_buff_head *namedq; 38206d59390684 Jon Paul Maloy 2015-11-19 178 38206d59390684 Jon Paul Maloy 2015-11-19 179 /* Congestion handling */ 38206d59390684 Jon Paul Maloy 2015-11-19 180 struct sk_buff_head wakeupq; 38206d59390684 Jon Paul Maloy 2015-11-19 181 38206d59390684 Jon Paul Maloy 2015-11-19 182 /* Fragmentation/reassembly */ 38206d59390684 Jon Paul Maloy 2015-11-19 183 struct sk_buff *reasm_buf; 38206d59390684 Jon Paul Maloy 2015-11-19 184 38206d59390684 Jon Paul Maloy 2015-11-19 185 /* Broadcast */ 38206d59390684 Jon Paul Maloy 2015-11-19 186 u16 ackers; 38206d59390684 Jon Paul Maloy 2015-11-19 187 u16 acked; 38206d59390684 Jon Paul Maloy 2015-11-19 188 struct tipc_link *bc_rcvlink; 38206d59390684 Jon Paul Maloy 2015-11-19 189 struct tipc_link *bc_sndlink; 7c4a54b963b68e Jon Paul Maloy 2016-09-01 190 unsigned long prev_retr; 7c4a54b963b68e Jon Paul Maloy 2016-09-01 191 u16 prev_from; 7c4a54b963b68e Jon Paul Maloy 2016-09-01 192 u16 prev_to; 7c4a54b963b68e Jon Paul Maloy 2016-09-01 193 u8 nack_state; 38206d59390684 Jon Paul Maloy 2015-11-19 194 bool bc_peer_is_up; 38206d59390684 Jon Paul Maloy 2015-11-19 195 38206d59390684 Jon Paul Maloy 2015-11-19 196 /* Statistics */ 38206d59390684 Jon Paul Maloy 2015-11-19 197 struct tipc_stats stats; 38206d59390684 Jon Paul Maloy 2015-11-19 @198 }; 38206d59390684 Jon Paul Maloy 2015-11-19 199 :::::: The code at line 198 was first introduced by commit :::::: 38206d5939068415c413ac253be6f364d06e672f tipc: narrow down interface towards struct tipc_link :::::: TO: Jon Paul Maloy <jon.maloy(a)ericsson.com> :::::: CC: David S. Miller <davem(a)davemloft.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] mm/hugetlb.c:2216:9: warning: variable 'gfp' set but not used
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fdf755b0cabc80fc65da83c9da27ec2cee144dc commit: 27a782f719fdab073c5b0e19764fad1f93cddd00 [2882/2882] mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507020936.wpYnAMsn-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507020936.wpYnAMsn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507020936.wpYnAMsn-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:2216:9: warning: variable 'gfp' set but not used [-Wunused-but-set-variable] 2216 | gfp_t gfp = gfp_mask | __GFP_NOWARN; | ^ 1 warning generated. vim +/gfp +2216 mm/hugetlb.c 2200 2201 /* 2202 * Use the VMA's mpolicy to allocate a huge page from the buddy. 2203 */ 2204 static 2205 struct page *alloc_buddy_huge_page_with_mpol(struct hstate *h, 2206 struct vm_area_struct *vma, unsigned long addr) 2207 { 2208 struct page *page = NULL; 2209 struct mempolicy *mpol; 2210 gfp_t gfp_mask = htlb_alloc_mask(h); 2211 int nid; 2212 nodemask_t *nodemask; 2213 2214 nid = huge_node(vma, addr, gfp_mask, &mpol, &nodemask); 2215 if (mpol_is_preferred_many(mpol)) { > 2216 gfp_t gfp = gfp_mask | __GFP_NOWARN; 2217 2218 gfp &= ~(__GFP_DIRECT_RECLAIM | __GFP_NOFAIL); 2219 page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); 2220 2221 /* Fallback to all nodes if page==NULL */ 2222 nodemask = NULL; 2223 } 2224 2225 if (!page) 2226 page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); 2227 mpol_cond_put(mpol); 2228 return page; 2229 } 2230 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] net/9p/client.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: a6fb923f7803f40a567445dfe1ff3a539c8adc1f [1605/1605] 9p: Use a slab for allocating requests config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507020802.Dmvtg8wR-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507020802.Dmvtg8wR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507020802.Dmvtg8wR-lkp@intel.com/ All warnings (new ones prefixed by >>): net/9p/client.c:376: warning: Function parameter or member 'c' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'req' not described in 'p9_client_cb' net/9p/client.c:376: warning: Function parameter or member 'status' not described in 'p9_client_cb' net/9p/client.c:523: warning: Function parameter or member 'uidata' not described in 'p9_check_zc_errors' net/9p/client.c:774: warning: Function parameter or member 'in_hdrlen' not described in 'p9_client_zc_rpc' net/9p/client.c:774: warning: Excess function parameter 'hdrlen' description in 'p9_client_zc_rpc' >> net/9p/client.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/3] CVE-2025-37784
by GONG Ruiqi 02 Jul '25

02 Jul '25

Fixing CVE-2025-37784. Meghana Malladi (3): net: ti: icss-iep: Add pwidth configuration for perout signal net: ti: icss-iep: Add phase offset configuration for perout signal net: ti: icss-iep: Fix possible NULL pointer dereference for perout request drivers/net/ethernet/ti/icssg/icss_iep.c | 154 +++++++++++++++-------- 1 file changed, 102 insertions(+), 52 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] drm/v3d: Add job to pending list if the reset was skipped
by GONG Ruiqi 02 Jul '25

02 Jul '25

From: Maíra Canal <mcanal(a)igalia.com> stable inclusion from stable-v6.6.91 commit 12125f7d9c15e6d8ac91d10373b2db2f17dcf767 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC9933 CVE: CVE-2025-37951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 35e4079bf1a2570abffce6ababa631afcf8ea0e5 upstream. When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardware, we skip the reset and let the timer get rearmed. This gives long-running jobs a chance to complete. However, when `timedout_job()` is called, the job in question is removed from the pending list, which means it won't be automatically freed through `free_job()`. Consequently, when we skip the reset and keep the job running, the job won't be freed when it finally completes. This situation leads to a memory leak, as exposed in [1] and [2]. Similarly to commit 704d3d60fec4 ("drm/etnaviv: don't block scheduler when GPU is still active"), this patch ensures the job is put back on the pending list when extending the timeout. Cc: stable(a)vger.kernel.org # 6.0 Reported-by: Daivik Bhatia <dtgs1208(a)gmail.com> Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/12227 [1] Closes: https://github.com/raspberrypi/linux/issues/6817 [2] Reviewed-by: Iago Toral Quiroga <itoral(a)igalia.com> Acked-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> Link: https://lore.kernel.org/r/20250430210643.57924-1-mcanal@igalia.com Signed-off-by: Maíra Canal <mcanal(a)igalia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- drivers/gpu/drm/v3d/v3d_sched.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c index 06238e6d7f5c..aa862a1b7fd2 100644 --- a/drivers/gpu/drm/v3d/v3d_sched.c +++ b/drivers/gpu/drm/v3d/v3d_sched.c @@ -282,11 +282,16 @@ v3d_gpu_reset_for_timeout(struct v3d_dev *v3d, struct drm_sched_job *sched_job) return DRM_GPU_SCHED_STAT_NOMINAL; } -/* If the current address or return address have changed, then the GPU - * has probably made progress and we should delay the reset. This - * could fail if the GPU got in an infinite loop in the CL, but that - * is pretty unlikely outside of an i-g-t testcase. - */ +static void +v3d_sched_skip_reset(struct drm_sched_job *sched_job) +{ + struct drm_gpu_scheduler *sched = sched_job->sched; + + spin_lock(&sched->job_list_lock); + list_add(&sched_job->list, &sched->pending_list); + spin_unlock(&sched->job_list_lock); +} + static enum drm_gpu_sched_stat v3d_cl_job_timedout(struct drm_sched_job *sched_job, enum v3d_queue q, u32 *timedout_ctca, u32 *timedout_ctra) @@ -296,9 +301,16 @@ v3d_cl_job_timedout(struct drm_sched_job *sched_job, enum v3d_queue q, u32 ctca = V3D_CORE_READ(0, V3D_CLE_CTNCA(q)); u32 ctra = V3D_CORE_READ(0, V3D_CLE_CTNRA(q)); + /* If the current address or return address have changed, then the GPU + * has probably made progress and we should delay the reset. This + * could fail if the GPU got in an infinite loop in the CL, but that + * is pretty unlikely outside of an i-g-t testcase. + */ if (*timedout_ctca != ctca || *timedout_ctra != ctra) { *timedout_ctca = ctca; *timedout_ctra = ctra; + + v3d_sched_skip_reset(sched_job); return DRM_GPU_SCHED_STAT_NOMINAL; } @@ -338,11 +350,13 @@ v3d_csd_job_timedout(struct drm_sched_job *sched_job) struct v3d_dev *v3d = job->base.v3d; u32 batches = V3D_CORE_READ(0, V3D_CSD_CURRENT_CFG4); - /* If we've made progress, skip reset and let the timer get - * rearmed. + /* If we've made progress, skip reset, add the job to the pending + * list, and let the timer get rearmed. */ if (job->timedout_batches != batches) { job->timedout_batches = batches; + + v3d_sched_skip_reset(sched_job); return DRM_GPU_SCHED_STAT_NOMINAL; } -- 2.25.1

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] net/tipc/topsrv.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 02 Jul '25

02 Jul '25

Hi Junwei, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: e373fab80587f72c98463df1f4511d06011f915c [1605/1605] tipc: fix modprobe tipc failed after switch order of device registration config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507020608.4lfjVJFL-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507020608.4lfjVJFL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507020608.4lfjVJFL-lkp@intel.com/ All warnings (new ones prefixed by >>): net/tipc/topsrv.c:82: warning: Function parameter or member 'awork' not described in 'tipc_topsrv' net/tipc/topsrv.c:82: warning: Function parameter or member 'listener' not described in 'tipc_topsrv' >> net/tipc/topsrv.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] arch/x86/events/amd/core.c:716:24: warning: variable 'hwc' set but not used
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4fdf755b0cabc80fc65da83c9da27ec2cee144dc commit: f760d3d70f9029c226c09529168977f860e83950 [2882/2882] perf/x86/amd: Add AMD Fam19h Branch Sampling support config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507020623.TJsJ79Ng-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507020623.TJsJ79Ng-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507020623.TJsJ79Ng-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/events/amd/core.c:716:24: warning: variable 'hwc' set but not used [-Wunused-but-set-variable] 716 | struct hw_perf_event *hwc; | ^ 1 warning generated. vim +/hwc +716 arch/x86/events/amd/core.c 712 713 static void amd_pmu_enable_all(int added) 714 { 715 struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); > 716 struct hw_perf_event *hwc; 717 int idx; 718 719 amd_brs_enable_all(); 720 721 for (idx = 0; idx < x86_pmu.num_counters; idx++) { 722 hwc = &cpuc->events[idx]->hw; 723 724 /* only activate events which are marked as active */ 725 if (!test_bit(idx, cpuc->active_mask)) 726 continue; 727 728 amd_pmu_enable_event(cpuc->events[idx]); 729 } 730 } 731 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2439/2439] kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5cdbc324acd417828860d3425c4f769518485c7c commit: 6df2e969a6de3481167ace4fe42f69812a6c7fc8 [2439/2439] arm64: add config for cpuidle-haltpoll config: arm64-kismet-CONFIG_HALTPOLL_CPUIDLE-CONFIG_ARM64-0-0 (https://download.01.org/0day-ci/archive/20250702/202507021253.zjMMyzmu-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250702/202507021253.zjMMyzmu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021253.zjMMyzmu-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE when selected by ARM64 WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] WARNING: unmet direct dependencies detected for RESCTRL_FS Depends on [n]: MISC_FILESYSTEMS [=n] && ARCH_HAS_CPU_RESCTRL [=y] Selected by [y]: - ARM64_MPAM [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0