- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2304/2304] mm/page_cache_limit.c:35:5: warning: no previous prototype for 'cache_reclaim_enable_handler'
by kernel test robot 27 May '25

27 May '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c81824893b87edffa39389711d160c2dd5a03e1e commit: 621647ce254f1d347ae9bc3d328c09cbb2732487 [2304/2304] mm: support periodical memory reclaim config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250527/202505272226.RcAmWtpx-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250527/202505272226.RcAmWtpx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505272226.RcAmWtpx-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/page_cache_limit.c:35:5: warning: no previous prototype for 'cache_reclaim_enable_handler' [-Wmissing-prototypes] 35 | int cache_reclaim_enable_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> mm/page_cache_limit.c:51:5: warning: no previous prototype for 'cache_reclaim_sysctl_handler' [-Wmissing-prototypes] 51 | int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/cache_reclaim_enable_handler +35 mm/page_cache_limit.c 34 > 35 int cache_reclaim_enable_handler(struct ctl_table *table, int write, 36 void *buffer, size_t *length, loff_t *ppos) 37 { 38 int ret; 39 40 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 41 if (ret || !write) 42 return ret; 43 44 if (should_periodical_reclaim()) 45 schedule_delayed_work(&shepherd, round_jiffies_relative( 46 (unsigned long)vm_cache_reclaim_s * HZ)); 47 48 return 0; 49 } 50 > 51 int cache_reclaim_sysctl_handler(struct ctl_table *table, int write, 52 void *buffer, size_t *length, loff_t *ppos) 53 { 54 int ret; 55 56 ret = proc_dointvec_minmax(table, write, buffer, length, ppos); 57 if (ret || !write) 58 return ret; 59 60 if (should_periodical_reclaim()) 61 mod_delayed_work(system_unbound_wq, &shepherd, 62 round_jiffies_relative( 63 (unsigned long)vm_cache_reclaim_s * HZ)); 64 65 return ret; 66 } 67 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2304/2304] mm/share_pool.c:68: warning: expecting prototype for mp_sp_group_id_by_pid(). Prototype was for mg_sp_group_id_by_pid() instead
by kernel test robot 27 May '25

27 May '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c81824893b87edffa39389711d160c2dd5a03e1e commit: fb31808921b891789a2f6cbfc7e277fd0918144a [2304/2304] mm/sharepool: Add base framework for share_pool config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250527/202505272259.OmUgrWdN-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250527/202505272259.OmUgrWdN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505272259.OmUgrWdN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/share_pool.c:68: warning: expecting prototype for mp_sp_group_id_by_pid(). Prototype was for mg_sp_group_id_by_pid() instead >> mm/share_pool.c:176: warning: duplicate section name 'Return' >> mm/share_pool.c:211: warning: Function parameter or member 'spg_id' not described in 'mg_sp_unshare' vim +68 mm/share_pool.c 54 55 /** 56 * mp_sp_group_id_by_pid() - Get the sp_group ID array of a process. 57 * @tgid: tgid of target process. 58 * @spg_ids: point to an array to save the group ids the process belongs to 59 * @num: input the spg_ids array size; output the spg number of the process 60 * 61 * Return: 62 * >0 - the sp_group ID. 63 * -ENODEV - target process doesn't belong to any sp_group. 64 * -EINVAL - spg_ids or num is NULL. 65 * -E2BIG - the num of groups process belongs to is larger than *num 66 */ 67 int mg_sp_group_id_by_pid(int tgid, int *spg_ids, int *num) > 68 { 69 return -EOPNOTSUPP; 70 } 71 EXPORT_SYMBOL_GPL(mg_sp_group_id_by_pid); 72 73 /** 74 * mg_sp_group_add_task() - Add a process to an share group (sp_group). 75 * @tgid: the tgid of the task to be added. 76 * @prot: the prot of task for this spg. 77 * @spg_id: the ID of the sp_group. 78 * 79 * Return: A postive group number for success, -errno on failure. 80 * 81 * Valid @spg_id: 82 * [SPG_ID_MIN, SPG_ID_MAX]: 83 * the task would be added to the group with @spg_id, if the 84 * group doesn't exist, just create it. 85 * [SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX]: 86 * the task would be added to the group with @spg_id, if it 87 * doesn't exist ,return failed. 88 * SPG_ID_AUTO: 89 * the task would be added into a new group with a new id in range 90 * [SPG_ID_AUTO_MIN, SPG_ID_AUTO_MAX]. 91 * 92 * This function can be taken into four parts: 93 * 1. Check and initlize the task specified by @tgid properly. 94 * 2. Create or get the spg specified by @spg_id. 95 * 3. Check the spg and task together and link the task into the spg if 96 * everything looks good. 97 * 4. Map the existing sp_area from the spg into the new task. 98 */ 99 int mg_sp_group_add_task(int tgid, unsigned long prot, int spg_id) 100 { 101 return -EOPNOTSUPP; 102 } 103 EXPORT_SYMBOL_GPL(mg_sp_group_add_task); 104 105 int mg_sp_id_of_current(void) 106 { 107 return -EOPNOTSUPP; 108 } 109 EXPORT_SYMBOL_GPL(mg_sp_id_of_current); 110 111 /** 112 * mg_sp_free() - Free the memory allocated by mg_sp_alloc() or 113 * mg_sp_alloc_nodemask(). 114 * 115 * @addr: the starting VA of the memory. 116 * @id: Address space identifier, which is used to distinguish the addr. 117 * 118 * Return: 119 * * 0 - success. 120 * * -EINVAL - the memory can't be found or was not allocated by share pool. 121 * * -EPERM - the caller has no permision to free the memory. 122 */ 123 int mg_sp_free(unsigned long addr, int id) 124 { 125 return -EOPNOTSUPP; 126 } 127 EXPORT_SYMBOL_GPL(mg_sp_free); 128 129 static void __init proc_sharepool_init(void) 130 { 131 if (!proc_mkdir("sharepool", NULL)) 132 return; 133 } 134 135 void *mg_sp_alloc_nodemask(unsigned long size, unsigned long sp_flags, int spg_id, 136 nodemask_t nodemask) 137 { 138 return ERR_PTR(-EOPNOTSUPP); 139 } 140 EXPORT_SYMBOL_GPL(mg_sp_alloc_nodemask); 141 142 /** 143 * mg_sp_alloc() - Allocate shared memory for all the processes in a sp_group. 144 * @size: the size of memory to allocate. 145 * @sp_flags: how to allocate the memory. 146 * @spg_id: the share group that the memory is allocated to. 147 * 148 * Use pass through allocation if spg_id == SPG_ID_DEFAULT in multi-group mode. 149 * 150 * Return: 151 * * if succeed, return the starting address of the shared memory. 152 * * if fail, return the pointer of -errno. 153 */ 154 void *mg_sp_alloc(unsigned long size, unsigned long sp_flags, int spg_id) 155 { 156 return ERR_PTR(-EOPNOTSUPP); 157 } 158 EXPORT_SYMBOL_GPL(mg_sp_alloc); 159 160 /** 161 * mg_sp_make_share_k2u() - Share kernel memory to current process or an sp_group. 162 * @kva: the VA of shared kernel memory. 163 * @size: the size of shared kernel memory. 164 * @sp_flags: how to allocate the memory. We only support SP_DVPP. 165 * @tgid: the tgid of the specified process (Not currently in use). 166 * @spg_id: the share group that the memory is shared to. 167 * 168 * Return: the shared target user address to start at 169 * 170 * Share kernel memory to current task if spg_id == SPG_ID_NONE 171 * or SPG_ID_DEFAULT in multi-group mode. 172 * 173 * Return: 174 * * if succeed, return the shared user address to start at. 175 * * if fail, return the pointer of -errno. > 176 */ 177 void *mg_sp_make_share_k2u(unsigned long kva, unsigned long size, 178 unsigned long sp_flags, int tgid, int spg_id) 179 { 180 return ERR_PTR(-EOPNOTSUPP); 181 } 182 EXPORT_SYMBOL_GPL(mg_sp_make_share_k2u); 183 184 /** 185 * mg_sp_make_share_u2k() - Share user memory of a specified process to kernel. 186 * @uva: the VA of shared user memory 187 * @size: the size of shared user memory 188 * @tgid: the tgid of the specified process(Not currently in use) 189 * 190 * Return: 191 * * if success, return the starting kernel address of the shared memory. 192 * * if failed, return the pointer of -errno. 193 */ 194 void *mg_sp_make_share_u2k(unsigned long uva, unsigned long size, int tgid) 195 { 196 return ERR_PTR(-EOPNOTSUPP); 197 } 198 EXPORT_SYMBOL_GPL(mg_sp_make_share_u2k); 199 200 /** 201 * mg_sp_unshare() - Unshare the kernel or user memory which shared by calling 202 * sp_make_share_{k2u,u2k}(). 203 * @va: the specified virtual address of memory 204 * @size: the size of unshared memory 205 * 206 * Use spg_id of current thread if spg_id == SPG_ID_DEFAULT. 207 * 208 * Return: 0 for success, -errno on failure. 209 */ 210 int mg_sp_unshare(unsigned long va, unsigned long size, int spg_id) > 211 { 212 return -EOPNOTSUPP; 213 } 214 EXPORT_SYMBOL_GPL(mg_sp_unshare); 215 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2304/2304] mm/vmalloc.c:4443: warning: Function parameter or member 'pgoff' not described in 'remap_vmalloc_hugepage_range_partial'
by kernel test robot 27 May '25

27 May '25

Hi Wang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c81824893b87edffa39389711d160c2dd5a03e1e commit: 9b1283f2bec2134030e1e099b900579f1f03840e [2304/2304] mm/vmalloc: Extend vmalloc usage about hugepage config: x86_64-buildonly-randconfig-005-20250527 (https://download.01.org/0day-ci/archive/20250527/202505272122.LGw8kmAU-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250527/202505272122.LGw8kmAU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505272122.LGw8kmAU-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/vmalloc.c:4443: warning: Function parameter or member 'pgoff' not described in 'remap_vmalloc_hugepage_range_partial' vim +4443 mm/vmalloc.c 4423 4424 /** 4425 * remap_vmalloc_hugepage_range_partial - map vmalloc hugepages 4426 * to userspace 4427 * @vma: vma to cover 4428 * @uaddr: target user address to start at 4429 * @kaddr: virtual address of vmalloc hugepage kernel memory 4430 * @size: size of map area 4431 * 4432 * Returns: 0 for success, -Exxx on failure 4433 * 4434 * This function checks that @kaddr is a valid vmalloc'ed area, 4435 * and that it is big enough to cover the range starting at 4436 * @uaddr in @vma. Will return failure if that criteria isn't 4437 * met. 4438 * 4439 * Similar to remap_pfn_range() (see mm/memory.c) 4440 */ 4441 int remap_vmalloc_hugepage_range_partial(struct vm_area_struct *vma, unsigned long uaddr, 4442 void *kaddr, unsigned long pgoff, unsigned long size) > 4443 { 4444 struct vm_struct *area; 4445 unsigned long off; 4446 unsigned long end_index; 4447 4448 if (check_shl_overflow(pgoff, PMD_SHIFT, &off)) 4449 return -EINVAL; 4450 4451 size = ALIGN(size, PMD_SIZE); 4452 4453 if (!IS_ALIGNED(uaddr, PMD_SIZE) || !IS_ALIGNED((unsigned long)kaddr, PMD_SIZE)) 4454 return -EINVAL; 4455 4456 area = find_vm_area(kaddr); 4457 if (!area) 4458 return -EINVAL; 4459 4460 if (!(area->flags & VM_USERMAP)) 4461 return -EINVAL; 4462 4463 if (check_add_overflow(size, off, &end_index) || 4464 end_index > get_vm_area_size(area)) 4465 return -EINVAL; 4466 kaddr += off; 4467 4468 do { 4469 struct page *page = vmalloc_to_page(kaddr); 4470 int ret; 4471 4472 ret = hugetlb_insert_hugepage_pte_by_pa(vma->vm_mm, uaddr, 4473 vma->vm_page_prot, page_to_phys(page)); 4474 if (ret) 4475 return ret; 4476 4477 uaddr += PMD_SIZE; 4478 kaddr += PMD_SIZE; 4479 size -= PMD_SIZE; 4480 } while (size > 0); 4481 4482 vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP); 4483 4484 return 0; 4485 } 4486 EXPORT_SYMBOL(remap_vmalloc_hugepage_range_partial); 4487 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v10 00/11] High Performance Container Resource View Isolation
by GONG Ruiqi 27 May '25

27 May '25

v10: - Move all bpf progs to samples/bpf/ v9: - Fix the missing of sourcing kernel/bpf-rvi/Kconfig in an existing Kconfig v8: - Move generic_single_iter.c to kernel/bpf-rvi/ - Refine the decompling with CONFIG_PROC_FS v7: - Add bpf_arch_flags to let cpuinfo_x86 get flags from kernel - Decomple CONFIG_BPF_RVI with CONFIG_PROC_FS - Move {bpf,get}_current_level1_reaper() from kernel/pid_namespace.c to kernel/pid.c, as it doesn't depends on CONFIG_PID_NS - Add 'depends on CONFIG_CPUSETS' to CONFIG_BPF_RVI, as we need task_cs(). v6: Don't remove uncompilable bpf progs in selftests, as demanded v5: Merge only cpuinfo_x86 and cpu_online for stage 1 v4: Fix valid checkpatch warnings v3: Add commit message for all commits v2: Add config control for all code --- Common supports: bpf: Add CONFIG_BPF_RVI bpf: Add generic_single_iter bpf: cpuset: Add bpf_cpuset_from_task() kfunc cpuset: Add task_effective_cpumask() bpf: Add bpf_cpumask_weight() kfunc bpf: pidns: Add {bpf,get}_current_level1_reaper() Cpuinfo_x86: selftests/bpf: Avoid building x86 cpuinfo prog for other arch bpf: Add cpuinfo_x86 iterator target bpf: Add bpf_arch_flags kunc for x86 selftests/bpf: Add iterator program for cpuinfo_x86 Cpu_online: selftests/bpf: Add iterator program for cpu_online --- GONG Ruiqi (11): bpf: Add CONFIG_BPF_RVI bpf: Add generic_single_iter bpf: cpuset: Add bpf_cpuset_from_task() kfunc cpuset: Add task_effective_cpumask() bpf: Add bpf_cpumask_weight() kfunc bpf: pidns: Add {bpf,get}_current_level1_reaper() bpf: Add cpuinfo_x86 iterator target bpf: Add bpf_arch_flags kunc for x86 samples/bpf: Add iterator program for cpuinfo_x86 samples/bpf: Add iterator program for cpu_online config: Turn on CONFIG_BPF_RVI for openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/bpf-rvi.c | 159 +++++++++++++++++++++++ arch/x86/kernel/cpu/proc.c | 2 +- include/linux/cpuset.h | 11 ++ include/linux/pid_namespace.h | 4 + init/Kconfig | 1 + kernel/Makefile | 2 + kernel/bpf-rvi/Kconfig | 19 +++ kernel/bpf-rvi/Makefile | 4 + kernel/bpf-rvi/generic_single_iter.c | 72 +++++++++++ kernel/bpf/helpers.c | 29 +++++ kernel/cgroup/cpuset.c | 50 ++++++++ kernel/pid.c | 25 ++++ samples/bpf/Makefile | 4 + samples/bpf/bpf_rvi_cpu_online.bpf.c | 55 ++++++++ samples/bpf/bpf_rvi_cpuinfo_x86.bpf.c | 169 +++++++++++++++++++++++++ 18 files changed, 608 insertions(+), 1 deletion(-) create mode 100644 arch/x86/kernel/cpu/bpf-rvi.c create mode 100644 kernel/bpf-rvi/Kconfig create mode 100644 kernel/bpf-rvi/Makefile create mode 100644 kernel/bpf-rvi/generic_single_iter.c create mode 100644 samples/bpf/bpf_rvi_cpu_online.bpf.c create mode 100644 samples/bpf/bpf_rvi_cpuinfo_x86.bpf.c -- 2.25.1

2 12

[PATCH OLK-6.6 v4 00/14] Cgroup-Based Interference Statistics
by Pu Lehui 27 May '25

27 May '25

Pu Lehui (6): interference: Add CGROUP_IFS config interference: Add CGROUP_IFS_DEFAULT_ENABLED config cgroup: Export cgroup_init_cftypes as internal interface cgroup: Export cgroup_addrm_files as internal interface interference: Add cgroup v1 support for CGROUP_IFS openeuler_defconfig: Disable CGROUP_IFS config by default Tengda Wu (5): interference: Add sched rundelay interference track support interference: Add sched sleep interference track support interference: Add sched throttle interference track support interference: Exclude throttle time from rundelay interference: Add sched wakelat interference track support Xu Kuohai (3): interference: Add cgroup-based inteference statistics framework interference: Add smt interference track support interference: Add irq interference track support arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/kernel/smpboot.c | 5 +- drivers/base/arch_topology.c | 4 + include/linux/cgroup-defs.h | 4 + include/linux/cgroup.h | 189 ++++++++++++++ include/linux/sched.h | 9 + init/Kconfig | 23 ++ kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup-internal.h | 20 ++ kernel/cgroup/cgroup.c | 27 +- kernel/cgroup/ifs.c | 339 +++++++++++++++++++++++++ kernel/sched/core.c | 23 +- kernel/sched/cpuacct.c | 15 ++ kernel/sched/cputime.c | 8 +- kernel/sched/deadline.c | 4 +- kernel/sched/fair.c | 14 +- kernel/sched/rt.c | 4 +- kernel/sched/sched.h | 11 +- kernel/sched/stats.c | 2 + kernel/sched/stats.h | 54 +++- 21 files changed, 729 insertions(+), 29 deletions(-) create mode 100644 kernel/cgroup/ifs.c -- 2.34.1

2 15

[PATCH OLK-6.6 0/9] v5: ucounts: rlimit scalability issues
by Chen Ridong 27 May '25

27 May '25

v5: ucounts: rlimit scalability issues Chen Ridong (4): ucounts: add CONFIG_UCOUNTS_PERCPU_COUNTER ucounts: add input for inc_rlimit_[get_]ucounts_limit ucounts: reinplement rlimit with percpu_counter ucount: fix kabi for ucounts MengEn Sun (1): ucounts: move kfree() out of critical zone protected by ucounts_lock Sebastian Andrzej Siewior (4): rcu: provide a static initializer for hlist_nulls_head ucount: replace get_ucounts_or_wrap() with atomic_inc_not_zero() ucount: use RCU for ucounts lookups ucount: use rcuref_t for reference counting arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/list_nulls.h | 1 + include/linux/user_namespace.h | 44 +++- init/Kconfig | 9 + init/main.c | 1 + ipc/mqueue.c | 3 +- kernel/signal.c | 2 +- kernel/ucount.c | 268 +++++++++++++++++++------ mm/mlock.c | 2 +- 10 files changed, 268 insertions(+), 64 deletions(-) -- 2.34.1

2 10

[PATCH OLK-6.6 0/8] net: tcp: scale connect() under pressure
by Dong Chenchen 27 May '25

27 May '25

scale connect() under pressure. Eric Dumazet (6): tcp: use RCU in __inet{6}_check_established() tcp: optimize inet_use_bhash2_on_bind() tcp: add RCU management to inet_bind_bucket tcp: use RCU lookup in __inet_hash_connect() inet: change lport contribution to inet_ehashfn() and inet6_ehashfn() inet: call inet6_ehashfn() once from inet6_hash_connect() Kuniyuki Iwashima (2): tcp: Use bhash2 for v4-mapped-v6 non-wildcard address. tcp: Fix bind() regression for v6-only wildcard and v4-mapped-v6 non-wildcard addresses. include/net/inet_hashtables.h | 9 ++-- include/net/ip.h | 2 +- net/ipv4/inet_connection_sock.c | 20 +++++--- net/ipv4/inet_hashtables.c | 88 ++++++++++++++++++++++++--------- net/ipv4/inet_timewait_sock.c | 2 +- net/ipv6/inet6_hashtables.c | 40 +++++++++++---- 6 files changed, 118 insertions(+), 43 deletions(-) -- 2.25.1

2 9

[PATCH OLK-6.6 0/8] bugfix for hisilicon accelerator driver
by Weili Qian 27 May '25

27 May '25

Chenghai Huang (1): uacce: fix unsigned long print format Weili Qian (7): uacce: fix isolate sysfs check condition uacce: delete some redundant code crypto: hisilicon/qm - fix vfs_num error crypto: hisilicon/qm - alloc power of 2 interrupts crypto: hisilicon - enable error reporting again crypto: hisilicon/trng - use DEFINE_MUTEX() for mutex lock crypto: hisilicon/zip - do not expose hashagg algorithm when uacce mode is 2 drivers/crypto/hisilicon/hpre/hpre_main.c | 11 +++++ drivers/crypto/hisilicon/qm.c | 60 ++++++++++++++++------- drivers/crypto/hisilicon/sec2/sec_main.c | 11 +++++ drivers/crypto/hisilicon/trng/trng.c | 38 +++++++------- drivers/crypto/hisilicon/zip/dae_main.c | 10 +++- drivers/crypto/hisilicon/zip/zip_main.c | 11 +++++ drivers/misc/uacce/uacce.c | 10 ++-- 7 files changed, 107 insertions(+), 44 deletions(-) -- 2.33.0

2 9

[PATCH OLK-6.6 V1] wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
by Wang Tao 27 May '25

27 May '25

From: Manish Dharanenthiran <quic_mdharane(a)quicinc.com> stable inclusion from stable-v6.6.88 commit 7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC9HOO CVE: CVE-2025-37943 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9a0dddfb30f120db3851627935851d262e4e7acb ] In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields in the header within the ath12k_dp_rx_h_undecap_nwifi function for DP_RX_DECAP_TYPE_NATIVE_WIFI decap type and potentially resulting in invalid data access and memory corruption. Add a sanity check before processing the SKB to prevent invalid data access in the undecap native Wi-Fi function for the DP_RX_DECAP_TYPE_NATIVE_WIFI decap type. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Signed-off-by: Manish Dharanenthiran <quic_mdharane(a)quicinc.com> Signed-off-by: Tamizh Chelvam Raja <tamizh.raja(a)oss.qualcomm.com> Link: https://patch.msgid.link/20250211090302.4105141-1-tamizh.raja@oss.qualcomm.… Signed-off-by: Jeff Johnson <jeff.johnson(a)oss.qualcomm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/net/wireless/ath/ath12k/dp_rx.c | 42 +++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/dp_rx.c b/drivers/net/wireless/ath/ath12k/dp_rx.c index 70ad035acac7..8d9315038a75 100644 --- a/drivers/net/wireless/ath/ath12k/dp_rx.c +++ b/drivers/net/wireless/ath/ath12k/dp_rx.c @@ -2484,6 +2484,29 @@ static void ath12k_dp_rx_deliver_msdu(struct ath12k *ar, struct napi_struct *nap ieee80211_rx_napi(ar->hw, pubsta, msdu, napi); } +static bool ath12k_dp_rx_check_nwifi_hdr_len_valid(struct ath12k_base *ab, + struct hal_rx_desc *rx_desc, + struct sk_buff *msdu) +{ + struct ieee80211_hdr *hdr; + u8 decap_type; + u32 hdr_len; + + decap_type = ath12k_dp_rx_h_decap_type(ab, rx_desc); + if (decap_type != DP_RX_DECAP_TYPE_NATIVE_WIFI) + return true; + + hdr = (struct ieee80211_hdr *)msdu->data; + hdr_len = ieee80211_hdrlen(hdr->frame_control); + + if ((likely(hdr_len <= DP_MAX_NWIFI_HDR_LEN))) + return true; + + ab->soc_stats.invalid_rbm++; + WARN_ON_ONCE(1); + return false; +} + static int ath12k_dp_rx_process_msdu(struct ath12k *ar, struct sk_buff *msdu, struct sk_buff_head *msdu_list, @@ -2542,6 +2565,11 @@ static int ath12k_dp_rx_process_msdu(struct ath12k *ar, } } + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) { + ret = -EINVAL; + goto free_out; + } + ath12k_dp_rx_h_ppdu(ar, rx_desc, rx_status); ath12k_dp_rx_h_mpdu(ar, msdu, rx_desc, rx_status); @@ -2867,6 +2895,9 @@ static int ath12k_dp_rx_h_verify_tkip_mic(struct ath12k *ar, struct ath12k_peer RX_FLAG_IV_STRIPPED | RX_FLAG_DECRYPTED; skb_pull(msdu, hal_rx_desc_sz); + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, rx_desc, msdu))) + return -EINVAL; + ath12k_dp_rx_h_ppdu(ar, rx_desc, rxs); ath12k_dp_rx_h_undecap(ar, msdu, rx_desc, HAL_ENCRYPT_TYPE_TKIP_MIC, rxs, true); @@ -3590,6 +3621,9 @@ static int ath12k_dp_rx_h_null_q_desc(struct ath12k *ar, struct sk_buff *msdu, skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); } + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu))) + return -EINVAL; + ath12k_dp_rx_h_ppdu(ar, desc, status); ath12k_dp_rx_h_mpdu(ar, msdu, desc, status); @@ -3634,7 +3668,7 @@ static bool ath12k_dp_rx_h_reo_err(struct ath12k *ar, struct sk_buff *msdu, return drop; } -static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, +static bool ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, struct ieee80211_rx_status *status) { struct ath12k_base *ab = ar->ab; @@ -3652,6 +3686,9 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, skb_put(msdu, hal_rx_desc_sz + l3pad_bytes + msdu_len); skb_pull(msdu, hal_rx_desc_sz + l3pad_bytes); + if (unlikely(!ath12k_dp_rx_check_nwifi_hdr_len_valid(ab, desc, msdu))) + return true; + ath12k_dp_rx_h_ppdu(ar, desc, status); status->flag |= (RX_FLAG_MMIC_STRIPPED | RX_FLAG_MMIC_ERROR | @@ -3659,6 +3696,7 @@ static void ath12k_dp_rx_h_tkip_mic_err(struct ath12k *ar, struct sk_buff *msdu, ath12k_dp_rx_h_undecap(ar, msdu, desc, HAL_ENCRYPT_TYPE_TKIP_MIC, status, false); + return false; } static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu, @@ -3677,7 +3715,7 @@ static bool ath12k_dp_rx_h_rxdma_err(struct ath12k *ar, struct sk_buff *msdu, case HAL_REO_ENTR_RING_RXDMA_ECODE_TKIP_MIC_ERR: err_bitmap = ath12k_dp_rx_h_mpdu_err(ab, rx_desc); if (err_bitmap & HAL_RX_MPDU_ERR_TKIP_MIC) { - ath12k_dp_rx_h_tkip_mic_err(ar, msdu, status); + drop = ath12k_dp_rx_h_tkip_mic_err(ar, msdu, status); break; } fallthrough; -- 2.34.1

2 1

[PATCH OLK-6.6 V1] pds_core: make wait_context part of q_info
by Wang Tao 27 May '25

27 May '25

From: Shannon Nelson <shannon.nelson(a)amd.com> stable inclusion from stable-v6.6.89 commit 1d7c4b2b0bbfb09b55b2dc0e2355d7936bf89381 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6M6F CVE: CVE-2025-37886 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3f77c3dfffc7063428b100c4945ca2a7a8680380 ] Make the wait_context a full part of the q_info struct rather than a stack variable that goes away after pdsc_adminq_post() is done so that the context is still available after the wait loop has given up. There was a case where a slow development firmware caused the adminq request to time out, but then later the FW finally finished the request and sent the interrupt. The handler tried to complete_all() the completion context that had been created on the stack in pdsc_adminq_post() but no longer existed. This caused bad pointer usage, kernel crashes, and much wailing and gnashing of teeth. Fixes: 01ba61b55b20 ("pds_core: Add adminq processing and commands") Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: Shannon Nelson <shannon.nelson(a)amd.com> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Link: https://patch.msgid.link/20250421174606.3892-5-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/net/ethernet/amd/pds_core/adminq.c | 36 +++++++++------------- drivers/net/ethernet/amd/pds_core/core.c | 4 ++- drivers/net/ethernet/amd/pds_core/core.h | 2 +- 3 files changed, 18 insertions(+), 24 deletions(-) diff --git a/drivers/net/ethernet/amd/pds_core/adminq.c b/drivers/net/ethernet/amd/pds_core/adminq.c index ea773cfa0af6..733f133d69e7 100644 --- a/drivers/net/ethernet/amd/pds_core/adminq.c +++ b/drivers/net/ethernet/amd/pds_core/adminq.c @@ -5,11 +5,6 @@ #include "core.h" -struct pdsc_wait_context { - struct pdsc_qcq *qcq; - struct completion wait_completion; -}; - static int pdsc_process_notifyq(struct pdsc_qcq *qcq) { union pds_core_notifyq_comp *comp; @@ -110,10 +105,10 @@ void pdsc_process_adminq(struct pdsc_qcq *qcq) q_info = &q->info[q->tail_idx]; q->tail_idx = (q->tail_idx + 1) & (q->num_descs - 1); - /* Copy out the completion data */ - memcpy(q_info->dest, comp, sizeof(*comp)); - - complete_all(&q_info->wc->wait_completion); + if (!completion_done(&q_info->completion)) { + memcpy(q_info->dest, comp, sizeof(*comp)); + complete(&q_info->completion); + } if (cq->tail_idx == cq->num_descs - 1) cq->done_color = !cq->done_color; @@ -166,8 +161,7 @@ irqreturn_t pdsc_adminq_isr(int irq, void *data) static int __pdsc_adminq_post(struct pdsc *pdsc, struct pdsc_qcq *qcq, union pds_core_adminq_cmd *cmd, - union pds_core_adminq_comp *comp, - struct pdsc_wait_context *wc) + union pds_core_adminq_comp *comp) { struct pdsc_queue *q = &qcq->q; struct pdsc_q_info *q_info; @@ -209,9 +203,9 @@ static int __pdsc_adminq_post(struct pdsc *pdsc, /* Post the request */ index = q->head_idx; q_info = &q->info[index]; - q_info->wc = wc; q_info->dest = comp; memcpy(q_info->desc, cmd, sizeof(*cmd)); + reinit_completion(&q_info->completion); dev_dbg(pdsc->dev, "head_idx %d tail_idx %d\n", q->head_idx, q->tail_idx); @@ -235,16 +229,13 @@ int pdsc_adminq_post(struct pdsc *pdsc, union pds_core_adminq_comp *comp, bool fast_poll) { - struct pdsc_wait_context wc = { - .wait_completion = - COMPLETION_INITIALIZER_ONSTACK(wc.wait_completion), - }; unsigned long poll_interval = 1; unsigned long poll_jiffies; unsigned long time_limit; unsigned long time_start; unsigned long time_done; unsigned long remaining; + struct completion *wc; int err = 0; int index; @@ -254,20 +245,19 @@ int pdsc_adminq_post(struct pdsc *pdsc, return -ENXIO; } - wc.qcq = &pdsc->adminqcq; - index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp, &wc); + index = __pdsc_adminq_post(pdsc, &pdsc->adminqcq, cmd, comp); if (index < 0) { err = index; goto err_out; } + wc = &pdsc->adminqcq.q.info[index].completion; time_start = jiffies; time_limit = time_start + HZ * pdsc->devcmd_timeout; do { /* Timeslice the actual wait to catch IO errors etc early */ poll_jiffies = msecs_to_jiffies(poll_interval); - remaining = wait_for_completion_timeout(&wc.wait_completion, - poll_jiffies); + remaining = wait_for_completion_timeout(wc, poll_jiffies); if (remaining) break; @@ -296,9 +286,11 @@ int pdsc_adminq_post(struct pdsc *pdsc, dev_dbg(pdsc->dev, "%s: elapsed %d msecs\n", __func__, jiffies_to_msecs(time_done - time_start)); - /* Check the results */ - if (time_after_eq(time_done, time_limit)) + /* Check the results and clear an un-completed timeout */ + if (time_after_eq(time_done, time_limit) && !completion_done(wc)) { err = -ETIMEDOUT; + complete(wc); + } dev_dbg(pdsc->dev, "read admin queue completion idx %d:\n", index); dynamic_hex_dump("comp ", DUMP_PREFIX_OFFSET, 16, 1, diff --git a/drivers/net/ethernet/amd/pds_core/core.c b/drivers/net/ethernet/amd/pds_core/core.c index eb73c921dc1e..b3fa867c8ccd 100644 --- a/drivers/net/ethernet/amd/pds_core/core.c +++ b/drivers/net/ethernet/amd/pds_core/core.c @@ -169,8 +169,10 @@ static void pdsc_q_map(struct pdsc_queue *q, void *base, dma_addr_t base_pa) q->base = base; q->base_pa = base_pa; - for (i = 0, cur = q->info; i < q->num_descs; i++, cur++) + for (i = 0, cur = q->info; i < q->num_descs; i++, cur++) { cur->desc = base + (i * q->desc_size); + init_completion(&cur->completion); + } } static void pdsc_cq_map(struct pdsc_cq *cq, void *base, dma_addr_t base_pa) diff --git a/drivers/net/ethernet/amd/pds_core/core.h b/drivers/net/ethernet/amd/pds_core/core.h index f410f7d13205..858bebf79776 100644 --- a/drivers/net/ethernet/amd/pds_core/core.h +++ b/drivers/net/ethernet/amd/pds_core/core.h @@ -96,7 +96,7 @@ struct pdsc_q_info { unsigned int bytes; unsigned int nbufs; struct pdsc_buf_info bufs[PDS_CORE_MAX_FRAGS]; - struct pdsc_wait_context *wc; + struct completion completion; void *dest; }; -- 2.34.1

2 1