- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] fs/smb: Fix inconsistent refcnt update
by Yifan Qiao 04 Nov '25

04 Nov '25

From: Shuhao Fu <sfual(a)cse.ust.hk> mainline inclusion from mainline-v6.17-rc4 commit ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICYBJ5 CVE: CVE-2025-39819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label "out" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label "finished" and "out" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of "-ENOMEM" is not recoverable. Therefore, the replay logic also gets ignored. Signed-off-by: Shuhao Fu <sfual(a)cse.ust.hk> Acked-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Cc: stable(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2inode.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c index e1078a1decdf..0cc80f472432 100644 --- a/fs/smb/client/smb2inode.c +++ b/fs/smb/client/smb2inode.c @@ -206,8 +206,10 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, server = cifs_pick_channel(ses); vars = kzalloc(sizeof(*vars), GFP_ATOMIC); - if (vars == NULL) - return -ENOMEM; + if (vars == NULL) { + rc = -ENOMEM; + goto out; + } rqst = &vars->rqst[0]; rsp_iov = &vars->rsp_iov[0]; @@ -828,6 +830,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, smb2_should_replay(tcon, &retries, &cur_sleep)) goto replay_again; +out: if (cfile) cifsFileInfo_put(cfile); -- 2.39.2

2 1

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:24:35: warning: no previous prototype for 'bpf_task_active_pid_ns'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: ef015dbb4151c10d0415045f9d0fcf3dc85063d7 [3098/3098] bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511042031.XJbcBnUd-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511042031.XJbcBnUd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511042031.XJbcBnUd-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:15:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 15 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:24:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 24 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:29:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 29 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:43:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 43 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ vim +/bpf_task_active_pid_ns +24 kernel/bpf-rvi/common_kfuncs.c 19 20 /* 21 * Loadavg related kfuncs 22 */ 23 > 24 __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) 25 { 26 return task_active_pid_ns(task); 27 } 28 > 29 __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) 30 { 31 struct pid_iter iter = {}; 32 u32 nr_running = 0, nr_threads = 0; 33 34 for_each_task_in_pidns(iter, ns) { 35 nr_threads++; 36 if (task_is_running(iter.task)) 37 nr_running++; 38 } 39 40 return (u64)nr_running << 32 | nr_threads; 41 } 42 > 43 __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) 44 { 45 return idr_get_cursor(&ns->idr) - 1; 46 } 47 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] block/bpf-rvi.c:36:28: error: implicit declaration of function 'css_to_blkcg'; did you mean 'pd_to_blkg'?
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: 89fa7dcff5e533bd14396601f40c388cfb6c1e59 [3098/3098] bpf-rvi: block: Add diskstats iterator target config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511041808.gFZ75q5u-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511041808.gFZ75q5u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511041808.gFZ75q5u-lkp@intel.com/ All errors (new ones prefixed by >>): block/bpf-rvi.c: In function 'bpf_disk_seqf_start': >> block/bpf-rvi.c:36:28: error: implicit declaration of function 'css_to_blkcg'; did you mean 'pd_to_blkg'? [-Wimplicit-function-declaration] 36 | priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); | ^~~~~~~~~~~~ | pd_to_blkg >> block/bpf-rvi.c:36:69: error: 'io_cgrp_id' undeclared (first use in this function); did you mean 'cpu_cgrp_id'? 36 | priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); | ^~~~~~~~~~ | cpu_cgrp_id block/bpf-rvi.c:36:69: note: each undeclared identifier is reported only once for each function it appears in vim +36 block/bpf-rvi.c 20 21 /* 22 * Basically the same with disk_seqf_start() but without allocating iter and 23 * then overwriting seqf->private, which points to priv_data->target_private 24 * in bpf_iter case (see prepare_seq_file()), and is needed to retrieve 25 * struct bpf_iter_priv_data. Here we allocate iter via setting 26 * .seq_priv_size and turning priv_data->target_private into iter. 27 */ 28 static void *bpf_disk_seqf_start(struct seq_file *seqf, loff_t *pos) 29 { 30 loff_t skip = *pos; 31 struct diskstats_seq_priv *priv = seqf->private; 32 struct class_dev_iter *iter; 33 struct device *dev; 34 struct task_struct *reaper = get_current_level1_reaper(); 35 > 36 priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); 37 if (reaper) 38 put_task_struct(reaper); 39 40 iter = &priv->iter; 41 class_dev_iter_init(iter, &block_class, NULL, &disk_type); 42 do { 43 dev = class_dev_iter_next(iter); 44 if (!dev) 45 return NULL; 46 } while (skip--); 47 48 return dev_to_disk(dev); 49 } 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] arm64/mpam: Add quirk to retrigger L3 CSU monitor
by Zeng Heng 04 Nov '25

04 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4UC2 -------------------------------- Due to the inaccurate L2 CSU sampling on the specified platform, the L3 cache capacity statistics accumulate error. To avoid this, perform a full re-scan instead of incremental counting. Each time when read the L3 CSU monitor, we forcibly reconfigure it so that the hardware rescans the L3 cache capacity. Note that the first read of the L3 CSU usually returns EBUSY, so a second read is required. On the second attempt, skip forcibly reconfigure the monitor, preventing another EBUSY and ensuring the correct result. Fixes: bb66b4d115e5 ("arm_mpam: Add mpam_msmon_read() to read monitor value") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 30e4ce54a3c4..ebc8887d8267 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -909,6 +909,27 @@ static void read_msmon_ctl_flt_vals(struct mon_read *m, u32 *ctl_val, } } +static bool mpam_csu_hisi_need_retrigger(struct mpam_msc_ris *ris, + bool read_again) +{ + static const struct midr_range cpus[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_HIP12), + { /* sentinel */ } + }; + + if (ris->comp->class->type != MPAM_CLASS_CACHE || + ris->comp->class->level != 3) + return false; + + if (!is_midr_in_range_list(cpus)) + return false; + + if (read_again) + return false; + + return true; +} + static void write_msmon_ctl_flt_vals(struct mon_read *m, u32 ctl_val, u32 flt_val) { @@ -1047,7 +1068,8 @@ static void __ris_msmon_read(void *arg) config_mismatch = cur_flt != flt_val || cur_ctl != (ctl_val | MSMON_CFG_x_CTL_EN); - if (config_mismatch || reset_on_next_read) { + if (config_mismatch || reset_on_next_read || + mpam_csu_hisi_need_retrigger(ris, m->err == -EBUSY)) { write_msmon_ctl_flt_vals(m, ctl_val, flt_val); if (mbwu_state) { mbwu_state->prev_val = 0; @@ -1190,6 +1212,7 @@ int mpam_msmon_read(struct mpam_component *comp, struct mon_cfg *ctx, arg.ctx = ctx; arg.type = type; arg.val = val; + arg.err = 0; *val = 0; return _msmon_read(comp, &arg); @@ -1448,7 +1471,7 @@ static int mpam_reprogram_ris(void *_arg) static int mpam_restore_mbwu_state(void *_ris) { int i; - struct mon_read mwbu_arg; + struct mon_read mwbu_arg = {}; struct mpam_msc_ris *ris = _ris; for (i = 0; i < ris->props.num_mbwu_mon; i++) { -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
by Chen Jinghuang 04 Nov '25

04 Nov '25

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.111 commit 3d3abf3f7e8b1abb082070a343de82d7efc80523 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3VRJ CVE: CVE-2025-40026 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e750f85391286a4c8100275516973324b621a269 upstream. When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Reported-by: syzbot+cc2032ba16cc2018ca25(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68790db4.a00a0220.3af5df.0020.GAE@google.com Fixes: 8a76d7f25f8f ("KVM: x86: Add x86 callback for intercept check") Cc: stable(a)vger.kernel.org Cc: Jim Mattson <jmattson(a)google.com> Link: https://lore.kernel.org/r/20250715190638.1899116-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- arch/x86/kvm/emulate.c | 9 ++++----- arch/x86/kvm/kvm_emulate.h | 3 +-- arch/x86/kvm/x86.c | 15 ++++++++------- 3 files changed, 13 insertions(+), 14 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 296e289472a2..5a49156c9540 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -5140,12 +5140,11 @@ void init_decode_cache(struct x86_emulate_ctxt *ctxt) ctxt->mem_read.end = 0; } -int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) +int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts) { const struct x86_emulate_ops *ops = ctxt->ops; int rc = X86EMUL_CONTINUE; int saved_dst_type = ctxt->dst.type; - bool is_guest_mode = ctxt->ops->is_guest_mode(ctxt); ctxt->mem_read.pos = 0; @@ -5193,7 +5192,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) fetch_possible_mmx_operand(&ctxt->dst); } - if (unlikely(is_guest_mode) && ctxt->intercept) { + if (unlikely(check_intercepts) && ctxt->intercept) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_PRE_EXCEPT); if (rc != X86EMUL_CONTINUE) @@ -5222,7 +5221,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) goto done; } - if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { + if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_POST_EXCEPT); if (rc != X86EMUL_CONTINUE) @@ -5276,7 +5275,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) special_insn: - if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { + if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_POST_MEMACCESS); if (rc != X86EMUL_CONTINUE) diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h index c224cf4126f2..c74d20a14246 100644 --- a/arch/x86/kvm/kvm_emulate.h +++ b/arch/x86/kvm/kvm_emulate.h @@ -228,7 +228,6 @@ struct x86_emulate_ops { void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); bool (*is_smm)(struct x86_emulate_ctxt *ctxt); - bool (*is_guest_mode)(struct x86_emulate_ctxt *ctxt); int (*leave_smm)(struct x86_emulate_ctxt *ctxt); void (*triple_fault)(struct x86_emulate_ctxt *ctxt); int (*set_xcr)(struct x86_emulate_ctxt *ctxt, u32 index, u64 xcr); @@ -512,7 +511,7 @@ bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt); #define EMULATION_RESTART 1 #define EMULATION_INTERCEPTED 2 void init_decode_cache(struct x86_emulate_ctxt *ctxt); -int x86_emulate_insn(struct x86_emulate_ctxt *ctxt); +int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts); int emulator_task_switch(struct x86_emulate_ctxt *ctxt, u16 tss_selector, int idt_index, int reason, bool has_error_code, u32 error_code); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index c30e3e9d60f7..7a98760a4c03 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -8454,11 +8454,6 @@ static bool emulator_is_smm(struct x86_emulate_ctxt *ctxt) return is_smm(emul_to_vcpu(ctxt)); } -static bool emulator_is_guest_mode(struct x86_emulate_ctxt *ctxt) -{ - return is_guest_mode(emul_to_vcpu(ctxt)); -} - #ifndef CONFIG_KVM_SMM static int emulator_leave_smm(struct x86_emulate_ctxt *ctxt) { @@ -8540,7 +8535,6 @@ static const struct x86_emulate_ops emulate_ops = { .guest_has_rdpid = emulator_guest_has_rdpid, .set_nmi_mask = emulator_set_nmi_mask, .is_smm = emulator_is_smm, - .is_guest_mode = emulator_is_guest_mode, .leave_smm = emulator_leave_smm, .triple_fault = emulator_triple_fault, .set_xcr = emulator_set_xcr, @@ -9160,7 +9154,14 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, ctxt->exception.address = 0; } - r = x86_emulate_insn(ctxt); + /* + * Check L1's instruction intercepts when emulating instructions for + * L2, unless KVM is re-emulating a previously decoded instruction, + * e.g. to complete userspace I/O, in which case KVM has already + * checked the intercepts. + */ + r = x86_emulate_insn(ctxt, is_guest_mode(vcpu) && + !(emulation_type & EMULTYPE_NO_DECODE)); if (r == EMULATION_INTERCEPTED) return 1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] *** fix CVE-2023-53454 ***
by Lin Ruifeng 04 Nov '25

04 Nov '25

*** fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH OLK-5.10 0/3] CVE-2025-22121
by Yongjian Sun 04 Nov '25

04 Nov '25

Ye Bin (2): ext4: introduce ITAIL helper ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() Yongjian Sun (1): ext4: Restore the deleted check paths of the xattr. fs/ext4/inode.c | 5 +++++ fs/ext4/xattr.c | 15 ++++++--------- fs/ext4/xattr.h | 10 ++++++++++ 3 files changed, 21 insertions(+), 9 deletions(-) -- 2.39.2

2 4

[PATCH 0/2] EEVDF null pointer
by Zicheng Qu 04 Nov '25

04 Nov '25

Zicheng Qu (2): EEVDF null pointer reproduction zero_vruntime kernel/sched/debug.c | 8 +- kernel/sched/fair.c | 170 +++++++++++++++++----------- kernel/sched/sched.h | 2 +- null_reproduction_test/Makefile | 9 ++ null_reproduction_test/fullcpu.c | 12 ++ null_reproduction_test/make.sh | 17 +++ null_reproduction_test/test.sh | 34 ++++++ null_reproduction_test/test_sched.c | 141 +++++++++++++++++++++++ 8 files changed, 325 insertions(+), 68 deletions(-) create mode 100644 null_reproduction_test/Makefile create mode 100644 null_reproduction_test/fullcpu.c create mode 100755 null_reproduction_test/make.sh create mode 100755 null_reproduction_test/test.sh create mode 100644 null_reproduction_test/test_sched.c -- 2.34.1

1 2

[openeuler:OLK-6.6 3098/3098] kernel/sched/cpuacct.c:412:18: warning: no previous prototype for 'bpf_cpuacct_kcpustat_cpu_fetch'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9b7e6f8aa58e8c131766ecd2c6eb9bd1dce85ca7 commit: 6ed308fc1d6f486c9e3c171b6b80c1c5f0f57df6 [3098/3098] bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511041308.wdMKtoD8-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511041308.wdMKtoD8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511041308.wdMKtoD8-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:61: >> kernel/sched/cpuacct.c:412:18: warning: no previous prototype for 'bpf_cpuacct_kcpustat_cpu_fetch' [-Wmissing-prototypes] 412 | __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:73: kernel/sched/debug.c:102:12: warning: no previous prototype for 'is_prefer_numa' [-Wmissing-prototypes] 102 | int __weak is_prefer_numa(void) | ^~~~~~~~~~~~~~ vim +/bpf_cpuacct_kcpustat_cpu_fetch +412 kernel/sched/cpuacct.c 410 411 #ifdef CONFIG_BPF_RVI > 412 __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, 413 struct cpuacct *ca, int cpu) 414 { 415 memcpy(dst, per_cpu_ptr(ca->cpustat, cpu), sizeof(struct kernel_cpustat)); 416 } 417 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
by Quanmin Yan 04 Nov '25

04 Nov '25

From: ruanjinjie <ruanjinjie(a)huawei.com> stable inclusion from stable-v4.19.270 commit 1695b1adcc3a7d985cd22fa3b55761edf3fab50d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBXA CVE: CVE-2022-50349 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fd2c930cf6a5b9176382c15f9acb1996e76e25ad ] If device_register() returns error in tifm_7xx1_switch_media(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked. Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. Fixes: 2428a8fe2261 ("tifm: move common device management tasks from tifm_7xx1 to tifm_core") Signed-off-by: ruanjinjie <ruanjinjie(a)huawei.com> Link: https://lore.kernel.org/r/20221117064725.3478402-1-ruanjinjie@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- drivers/misc/tifm_7xx1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c index 9ac95b48ef92..1d33c4facd44 100644 --- a/drivers/misc/tifm_7xx1.c +++ b/drivers/misc/tifm_7xx1.c @@ -194,7 +194,7 @@ static void tifm_7xx1_switch_media(struct work_struct *work) spin_unlock_irqrestore(&fm->lock, flags); } if (sock) - tifm_free_device(&sock->dev); + put_device(&sock->dev); } spin_lock_irqsave(&fm->lock, flags); } -- 2.43.0

2 1