- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] drm/vmwgfx: Fix Use-after-free in validation
by Lin Ruifeng 25 Nov '25

25 Nov '25

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v5.10.246 commit fb7165e5f3b3b10721ff70553583ad12e90e447a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6794 CVE: CVE-2025-40111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index e69bc373ae2e..535d1ab1a52f 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -342,8 +342,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, } } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { -- 2.43.0

2 1

[PATCH OLK-6.6] drm/vmwgfx: Fix Use-after-free in validation
by Lin Ruifeng 25 Nov '25

25 Nov '25

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v6.6.113 commit 867bda5d95d36f10da398fd4409e21c7002b2332 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6794 CVE: CVE-2025-40111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index aaacbdcbd742..a4a11e725d18 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { -- 2.43.0

2 1

[openeuler:OLK-6.6 3316/3316] crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets'
by kernel test robot 25 Nov '25

25 Nov '25

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: b78af6579e15dcdff86504da90af77f3e890270e [3316/3316] PGPLIB: Basic packet parser config: x86_64-buildonly-randconfig-002-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250630.aTlUN4lt-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250630.aTlUN4lt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250630.aTlUN4lt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'datalen' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_data' description in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_datalen' description in 'pgp_parse_packets' vim +189 crypto/asymmetric_keys/pgp_library.c 178 179 /** 180 * pgp_parse_packets - Parse a set of PGP packets 181 * @_data: Data to be parsed (updated) 182 * @_datalen: Amount of data (updated) 183 * @ctx: Parsing context 184 * 185 * Parse a set of PGP packets [RFC 4880: 4]. 186 */ 187 int pgp_parse_packets(const u8 *data, size_t datalen, 188 struct pgp_parse_context *ctx) > 189 { 190 enum pgp_packet_tag type; 191 ssize_t pktlen; 192 u8 headerlen; 193 int ret; 194 195 while (datalen > 2) { 196 pktlen = pgp_parse_packet_header(&data, &datalen, &type, 197 &headerlen); 198 if (pktlen < 0) 199 return pktlen; 200 201 if ((ctx->types_of_interest >> type) & 1) { 202 ret = ctx->process_packet(ctx, type, headerlen, 203 data, pktlen); 204 if (ret < 0) 205 return ret; 206 } 207 data += pktlen; 208 datalen -= pktlen; 209 } 210 211 if (datalen != 0) { 212 pr_debug("Excess octets in packet stream\n"); 213 return -EBADMSG; 214 } 215 216 return 0; 217 } 218 EXPORT_SYMBOL_GPL(pgp_parse_packets); 219 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3316/3316] kernel/xsched/cgroup.c:327:34: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: 43bbefc53356009d3603faa2c6e6a2858f724e4d [3316/3316] xsched: Add XCU control group implementation and its backend in xsched CFS config: x86_64-buildonly-randconfig-003-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250338.G8XPRtIi-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250338.G8XPRtIi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250338.G8XPRtIi-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/xsched/cgroup.c:21: include/linux/xsched.h:265:36: error: field 'css' has incomplete type 265 | struct cgroup_subsys_state css; | ^~~ In file included from include/linux/container_of.h:5, from include/linux/kernel.h:22, from arch/x86/include/asm/percpu.h:27, from arch/x86/include/asm/current.h:10, from include/linux/sched.h:12, from include/linux/cgroup.h:12, from kernel/xsched/cgroup.c:18: kernel/xsched/cgroup.c: In function 'xcu_cg_from_css': include/linux/compiler_types.h:411:27: error: expression in static assertion is not an integer 411 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:78:56: note: in definition of macro '__static_assert' 78 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg) | ^~~~ include/linux/container_of.h:20:9: note: in expansion of macro 'static_assert' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~~~ include/linux/container_of.h:20:23: note: in expansion of macro '__same_type' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~ kernel/xsched/cgroup.c:184:22: note: in expansion of macro 'container_of' 184 | return css ? container_of(css, struct xsched_group, css) : NULL; | ^~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_css_online': kernel/xsched/cgroup.c:254:53: error: invalid use of undefined type 'struct cgroup_subsys_state' 254 | struct cgroup_subsys_state *parent_css = css->parent; | ^~ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:327:34: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 327 | static int xcu_can_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_can_attach': kernel/xsched/cgroup.c:335:9: error: implicit declaration of function 'cgroup_taskset_for_each'; did you mean 'cgroup_task_frozen'? [-Wimplicit-function-declaration] 335 | cgroup_taskset_for_each(task, dst_css, tset) { | ^~~~~~~~~~~~~~~~~~~~~~~ | cgroup_task_frozen kernel/xsched/cgroup.c:335:53: error: expected ';' before '{' token 335 | cgroup_taskset_for_each(task, dst_css, tset) { | ^~ | ; >> kernel/xsched/cgroup.c:333:13: warning: unused variable 'ret' [-Wunused-variable] 333 | int ret = 0; | ^~~ >> kernel/xsched/cgroup.c:332:34: warning: unused variable 'entry' [-Wunused-variable] 332 | struct xcg_attach_entry *entry; | ^~~~~ >> kernel/xsched/cgroup.c:331:40: warning: unused variable 'dst_xcg' [-Wunused-variable] 331 | struct xsched_group *old_xcg, *dst_xcg; | ^~~~~~~ >> kernel/xsched/cgroup.c:331:30: warning: unused variable 'old_xcg' [-Wunused-variable] 331 | struct xsched_group *old_xcg, *dst_xcg; | ^~~~~~~ >> kernel/xsched/cgroup.c:330:47: warning: unused variable 'old_css' [-Wunused-variable] 330 | struct cgroup_subsys_state *dst_css, *old_css; | ^~~~~~~ >> kernel/xsched/cgroup.c:355:1: warning: no return statement in function returning non-void [-Wreturn-type] 355 | } | ^ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:357:38: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 357 | static void xcu_cancel_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:368:6: warning: no previous prototype for 'xcu_move_task' [-Wmissing-prototypes] 368 | void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:401:31: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 401 | static void xcu_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xsched_group_inherit': kernel/xsched/cgroup.c:432:15: error: implicit declaration of function 'task_get_css' [-Wimplicit-function-declaration] 432 | css = task_get_css(task, xcu_cgrp_id); | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:432:34: error: 'xcu_cgrp_id' undeclared (first use in this function) 432 | css = task_get_css(task, xcu_cgrp_id); | ^~~~~~~~~~~ kernel/xsched/cgroup.c:432:34: note: each undeclared identifier is reported only once for each function it appears in kernel/xsched/cgroup.c: In function 'xcu_sched_class_show': kernel/xsched/cgroup.c:440:43: error: implicit declaration of function 'seq_css' [-Wimplicit-function-declaration] 440 | struct cgroup_subsys_state *css = seq_css(sf); | ^~~~~~~ kernel/xsched/cgroup.c:440:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] kernel/xsched/cgroup.c: In function 'xcu_sched_class_write': kernel/xsched/cgroup.c:490:43: error: implicit declaration of function 'of_css' [-Wimplicit-function-declaration] 490 | struct cgroup_subsys_state *css = of_css(of); | ^~~~~~ kernel/xsched/cgroup.c:490:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] kernel/xsched/cgroup.c:508:29: error: invalid use of undefined type 'struct cgroup_subsys_state' 508 | if (!list_empty(&css->children)) | ^~ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:520:65: warning: 'struct cftype' declared inside parameter list will not be visible outside of this definition or declaration 520 | static s64 xcu_read_s64(struct cgroup_subsys_state *css, struct cftype *cft) | ^~~~~~ kernel/xsched/cgroup.c: In function 'xcu_read_s64': kernel/xsched/cgroup.c:525:20: error: invalid use of undefined type 'struct cftype' 525 | switch (cft->private) { | ^~ In file included from include/linux/kernel.h:31: kernel/xsched/cgroup.c:530:63: error: invalid use of undefined type 'struct cftype' 530 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~ include/linux/printk.h:427:33: note: in definition of macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ include/linux/printk.h:498:9: note: in expansion of macro 'printk' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~ include/linux/xsched.h:20:9: note: in expansion of macro 'pr_err' 20 | pr_err(pr_fmt(XSCHED_ERR_PREFIX fmt), ##__VA_ARGS__) | ^~~~~~ kernel/xsched/cgroup.c:530:17: note: in expansion of macro 'XSCHED_ERR' 530 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~~~~~~~~~ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:581:66: warning: 'struct cftype' declared inside parameter list will not be visible outside of this definition or declaration 581 | static int xcu_write_s64(struct cgroup_subsys_state *css, struct cftype *cft, | ^~~~~~ kernel/xsched/cgroup.c: In function 'xcu_write_s64': kernel/xsched/cgroup.c:587:20: error: invalid use of undefined type 'struct cftype' 587 | switch (cft->private) { | ^~ kernel/xsched/cgroup.c:597:63: error: invalid use of undefined type 'struct cftype' 597 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~ include/linux/printk.h:427:33: note: in definition of macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ include/linux/printk.h:498:9: note: in expansion of macro 'printk' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~ include/linux/xsched.h:20:9: note: in expansion of macro 'pr_err' 20 | pr_err(pr_fmt(XSCHED_ERR_PREFIX fmt), ##__VA_ARGS__) | ^~~~~~ kernel/xsched/cgroup.c:597:17: note: in expansion of macro 'XSCHED_ERR' 597 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_stat': kernel/xsched/cgroup.c:607:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 607 | struct cgroup_subsys_state *css = seq_css(sf); | ^~~~~~~ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:630:22: error: array type has incomplete element type 'struct cftype' 630 | static struct cftype xcu_cg_files[] = { | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:633:26: error: 'CFTYPE_NOT_ON_ROOT' undeclared here (not in a function) 633 | .flags = CFTYPE_NOT_ON_ROOT, | ^~~~~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:651:8: error: variable 'xcu_cgrp_subsys' has initializer but incomplete type 651 | struct cgroup_subsys xcu_cgrp_subsys = { | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:652:10: error: 'struct cgroup_subsys' has no member named 'css_alloc' 652 | .css_alloc = xcu_css_alloc, | ^~~~~~~~~ >> kernel/xsched/cgroup.c:652:22: warning: excess elements in struct initializer 652 | .css_alloc = xcu_css_alloc, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:652:22: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:653:10: error: 'struct cgroup_subsys' has no member named 'css_online' 653 | .css_online = xcu_css_online, | ^~~~~~~~~~ kernel/xsched/cgroup.c:653:23: warning: excess elements in struct initializer 653 | .css_online = xcu_css_online, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:653:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:654:10: error: 'struct cgroup_subsys' has no member named 'css_offline' 654 | .css_offline = xcu_css_offline, | ^~~~~~~~~~~ kernel/xsched/cgroup.c:654:24: warning: excess elements in struct initializer 654 | .css_offline = xcu_css_offline, | ^~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:654:24: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:655:10: error: 'struct cgroup_subsys' has no member named 'css_free' 655 | .css_free = xcu_css_free, | ^~~~~~~~ kernel/xsched/cgroup.c:655:21: warning: excess elements in struct initializer 655 | .css_free = xcu_css_free, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:655:21: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:656:10: error: 'struct cgroup_subsys' has no member named 'can_attach' 656 | .can_attach = xcu_can_attach, | ^~~~~~~~~~ kernel/xsched/cgroup.c:656:23: warning: excess elements in struct initializer 656 | .can_attach = xcu_can_attach, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:656:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:657:10: error: 'struct cgroup_subsys' has no member named 'cancel_attach' 657 | .cancel_attach = xcu_cancel_attach, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:657:26: warning: excess elements in struct initializer 657 | .cancel_attach = xcu_cancel_attach, | ^~~~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:657:26: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:658:10: error: 'struct cgroup_subsys' has no member named 'attach' 658 | .attach = xcu_attach, | ^~~~~~ kernel/xsched/cgroup.c:658:19: warning: excess elements in struct initializer 658 | .attach = xcu_attach, | ^~~~~~~~~~ kernel/xsched/cgroup.c:658:19: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:659:10: error: 'struct cgroup_subsys' has no member named 'dfl_cftypes' 659 | .dfl_cftypes = xcu_cg_files, | ^~~~~~~~~~~ kernel/xsched/cgroup.c:659:24: warning: excess elements in struct initializer 659 | .dfl_cftypes = xcu_cg_files, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:659:24: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:660:10: error: 'struct cgroup_subsys' has no member named 'legacy_cftypes' 660 | .legacy_cftypes = xcu_cg_files, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:660:27: warning: excess elements in struct initializer 660 | .legacy_cftypes = xcu_cg_files, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:660:27: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:661:10: error: 'struct cgroup_subsys' has no member named 'early_init' 661 | .early_init = false, | ^~~~~~~~~~ kernel/xsched/cgroup.c:661:23: warning: excess elements in struct initializer 661 | .early_init = false, | ^~~~~ kernel/xsched/cgroup.c:661:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:651:22: error: storage size of 'xcu_cgrp_subsys' isn't known 651 | struct cgroup_subsys xcu_cgrp_subsys = { | ^~~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_cg_from_css': >> kernel/xsched/cgroup.c:185:1: warning: control reaches end of non-void function [-Wreturn-type] 185 | } | ^ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:630:22: warning: 'xcu_cg_files' defined but not used [-Wunused-variable] 630 | static struct cftype xcu_cg_files[] = { | ^~~~~~~~~~~~ >> kernel/xsched/cgroup.c:309:12: warning: 'xcu_task_can_attach' defined but not used [-Wunused-function] 309 | static int xcu_task_can_attach(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] vim +327 kernel/xsched/cgroup.c 181 182 inline struct xsched_group *xcu_cg_from_css(struct cgroup_subsys_state *css) 183 { 184 return css ? container_of(css, struct xsched_group, css) : NULL; > 185 } 186 187 /* 188 * Determine whether the given css corresponds to root_xsched_group.css. 189 * 190 * Parameter only_css_self: 191 * - true : Only check whether the css pointer itself is NULL 192 * (i.e., the subsystem root). Do not dereference xg->parent. 193 * Used in the allocation path (css_alloc). 194 * - false : Further check whether the associated xsched_group 195 * has no parent (i.e., a normal root check). 196 */ 197 static inline bool xsched_group_css_is_root(struct cgroup_subsys_state *css, bool only_css_self) 198 { 199 struct xsched_group *xg; 200 201 /* NULL indicates the subsystem root */ 202 if (!css) 203 return true; 204 205 /* 206 * During the allocation phase, 207 * cannot find its parent xsched_group via xg->parent, 208 * so can only determine on the css itself. 209 */ 210 if (only_css_self) 211 return false; 212 213 xg = xcu_cg_from_css(css); 214 215 return xg && !xg->parent; 216 } 217 218 /** 219 * xcu_css_alloc() - Allocate and init xcu cgroup. 220 * @parent_css: css of parent xcu cgroup 221 * 222 * Called from kernel/cgroup.c with cgroup_lock() held. 223 * First called in subsys initialization to create root xcu cgroup, when 224 * XCUs haven't been initialized yet. Func used on every new cgroup creation, 225 * on second call to set root xsched_group runqueue. 226 * 227 * Return: pointer of new xcu cgroup css on success, -ENOMEM otherwise. 228 */ 229 static struct cgroup_subsys_state * 230 xcu_css_alloc(struct cgroup_subsys_state *parent_css) 231 { 232 struct xsched_group *xg; 233 234 if (xsched_group_css_is_root(parent_css, true)) 235 return &root_xsched_group.css; 236 237 xg = kmem_cache_alloc(xsched_group_cache, GFP_KERNEL | __GFP_ZERO); 238 if (!xg) 239 return ERR_PTR(-ENOMEM); 240 241 return &xg->css; 242 } 243 244 static void xcu_css_free(struct cgroup_subsys_state *css) 245 { 246 struct xsched_group *xcg = xcu_cg_from_css(css); 247 248 kmem_cache_free(xsched_group_cache, xcg); 249 } 250 251 static int xcu_css_online(struct cgroup_subsys_state *css) 252 { 253 struct xsched_group *xg = xcu_cg_from_css(css); 254 struct cgroup_subsys_state *parent_css = css->parent; 255 struct xsched_group *parent_xg; 256 int err; 257 258 if (!parent_css) 259 return 0; 260 261 parent_xg = xcu_cg_from_css(parent_css); 262 err = xcu_cg_init(xg, parent_xg); 263 if (err) { 264 kmem_cache_free(xsched_group_cache, xg); 265 XSCHED_ERR("Failed to initialize new xsched_group @ %s.\n", __func__); 266 return err; 267 } 268 269 return 0; 270 } 271 272 static void xcu_css_offline(struct cgroup_subsys_state *css) 273 { 274 struct xsched_group *xcg; 275 276 xcg = xcu_cg_from_css(css); 277 if (!xsched_group_css_is_root(css, false)) { 278 switch (xcg->sched_class) { 279 case XSCHED_TYPE_CFS: 280 xcu_cfs_cg_deinit(xcg); 281 break; 282 default: 283 XSCHED_INFO("xcu_cgroup: deinit RT group css=0x%lx\n", 284 (uintptr_t)&xcg->css); 285 break; 286 } 287 } 288 list_del(&xcg->group_node); 289 } 290 291 static void xsched_group_xse_attach(struct xsched_group *xg, 292 struct xsched_entity *xse) 293 { 294 spin_lock(&xg->lock); 295 list_add_tail(&xse->group_node, &xg->members); 296 spin_unlock(&xg->lock); 297 xse->parent_grp = xg; 298 } 299 300 void xsched_group_xse_detach(struct xsched_entity *xse) 301 { 302 struct xsched_group *xcg = xse->parent_grp; 303 304 spin_lock(&xcg->lock); 305 list_del(&xse->group_node); 306 spin_unlock(&xcg->lock); 307 } 308 > 309 static int xcu_task_can_attach(struct task_struct *task, 310 struct xsched_group *old) 311 { 312 struct xsched_entity *xse; 313 bool has_xse = false; 314 315 spin_lock(&old->lock); 316 list_for_each_entry(xse, &old->members, group_node) { 317 if (xse->owner_pid == task_pid_nr(task)) { 318 has_xse = true; 319 break; 320 } 321 } 322 spin_unlock(&old->lock); 323 324 return has_xse ? -EINVAL : 0; 325 } 326 > 327 static int xcu_can_attach(struct cgroup_taskset *tset) 328 { 329 struct task_struct *task; > 330 struct cgroup_subsys_state *dst_css, *old_css; > 331 struct xsched_group *old_xcg, *dst_xcg; > 332 struct xcg_attach_entry *entry; > 333 int ret = 0; 334 335 cgroup_taskset_for_each(task, dst_css, tset) { 336 rcu_read_lock(); 337 old_css = task_css(task, xcu_cgrp_id); 338 rcu_read_unlock(); 339 dst_xcg = xcu_cg_from_css(dst_css); 340 old_xcg = xcu_cg_from_css(old_css); 341 342 ret = xcu_task_can_attach(task, old_xcg); 343 if (ret) 344 break; 345 346 /* record entry for this task */ 347 entry = kmem_cache_alloc(xcg_attach_entry_cache, GFP_KERNEL | __GFP_ZERO); 348 entry->task = task; 349 entry->old_xcg = old_xcg; 350 entry->new_xcg = dst_xcg; 351 list_add_tail(&entry->node, &xcg_attach_list); 352 } 353 354 return ret; > 355 } 356 357 static void xcu_cancel_attach(struct cgroup_taskset *tset) 358 { 359 struct xcg_attach_entry *entry, *tmp; 360 361 /* error: clear all entries */ 362 list_for_each_entry_safe(entry, tmp, &xcg_attach_list, node) { 363 list_del(&entry->node); 364 kmem_cache_free(xcg_attach_entry_cache, entry); 365 } 366 } 367 368 void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, 369 struct xsched_group *new_xcg) 370 { 371 struct xsched_entity *xse, *tmp; 372 struct xsched_cu *xcu; 373 374 spin_lock(&old_xcg->lock); 375 list_for_each_entry_safe(xse, tmp, &old_xcg->members, group_node) { 376 if (xse->owner_pid != task_pid_nr(task)) 377 continue; 378 379 xcu = xse->xcu; 380 381 if (old_xcg != xse->parent_grp) { 382 WARN_ON(old_xcg != xse->parent_grp); 383 return; 384 } 385 386 /* delete from the old_xcg */ 387 list_del(&xse->group_node); 388 389 mutex_lock(&xcu->xcu_lock); 390 /* dequeue from the current runqueue */ 391 dequeue_ctx(xse, xcu); 392 /* attach to the new_xcg */ 393 xsched_group_xse_attach(new_xcg, xse); 394 /* enqueue to the runqueue in new_xcg */ 395 enqueue_ctx(xse, xcu); 396 mutex_unlock(&xcu->xcu_lock); 397 } 398 spin_unlock(&old_xcg->lock); 399 } 400 401 static void xcu_attach(struct cgroup_taskset *tset) 402 { 403 struct xcg_attach_entry *entry, *tmp; 404 405 list_for_each_entry(entry, &xcg_attach_list, node) { 406 xcu_move_task(entry->task, entry->old_xcg, entry->new_xcg); 407 } 408 409 /* cleanup */ 410 list_for_each_entry_safe(entry, tmp, &xcg_attach_list, node) { 411 list_del(&entry->node); 412 kmem_cache_free(xcg_attach_entry_cache, entry); 413 } 414 } 415 416 /** 417 * xsched_group_inherit() - Attach new entity to task's xsched_group. 418 * @task: task_struct 419 * @xse: xsched entity 420 * 421 * Called in xsched context initialization to attach xse to task's group 422 * and inherit its xse scheduling class and bandwidth control policy. 423 * 424 * Return: Zero on success. 425 */ 426 void xsched_group_inherit(struct task_struct *task, struct xsched_entity *xse) 427 { 428 struct cgroup_subsys_state *css; 429 struct xsched_group *xg; 430 431 xse->owner_pid = task_pid_nr(task); 432 css = task_get_css(task, xcu_cgrp_id); 433 xg = xcu_cg_from_css(css); 434 xsched_group_xse_attach(xg, xse); 435 css_put(css); 436 } 437 438 static int xcu_sched_class_show(struct seq_file *sf, void *v) 439 { 440 struct cgroup_subsys_state *css = seq_css(sf); 441 struct xsched_group *xg = xcu_cg_from_css(css); 442 443 seq_printf(sf, "%s\n", xcu_sched_name[xg->sched_class]); 444 return 0; 445 } 446 447 /** 448 * xcu_cg_set_sched_class() - Set scheduling type for group. 449 * @xg: xsched group 450 * @type: scheduler type 451 * 452 * Scheduler type can be changed if task is child of root group 453 * and haven't got scheduling entities. 454 * 455 * Return: Zero on success or -EINVAL 456 */ 457 static int xcu_cg_set_sched_class(struct xsched_group *xg, int type) 458 { 459 if (type == xg->sched_class) 460 return 0; 461 462 /* can't change scheduler when there are running members */ 463 if (!list_empty(&xg->members)) 464 return -EBUSY; 465 466 /* deinit old type if necessary */ 467 switch (xg->sched_class) { 468 case XSCHED_TYPE_CFS: 469 xcu_cfs_cg_deinit(xg); 470 break; 471 default: 472 break; 473 } 474 475 /* update type */ 476 xg->sched_class = type; 477 478 /* init new type if necessary */ 479 switch (type) { 480 case XSCHED_TYPE_CFS: 481 return xcu_cfs_cg_init(xg, xg->parent); 482 default: 483 return 0; 484 } 485 } 486 487 static ssize_t xcu_sched_class_write(struct kernfs_open_file *of, char *buf, 488 size_t nbytes, loff_t off) 489 { 490 struct cgroup_subsys_state *css = of_css(of); 491 struct xsched_group *xg = xcu_cg_from_css(css); 492 char type_name[4]; 493 int type = -1; 494 495 ssize_t ret = sscanf(buf, "%3s", type_name); 496 497 if (ret < 1) 498 return -EINVAL; 499 500 for (type = 0; type < XSCHED_TYPE_NUM; type++) { 501 if (!strcmp(type_name, xcu_sched_name[type])) 502 break; 503 } 504 505 if (type == XSCHED_TYPE_NUM) 506 return -EINVAL; 507 508 if (!list_empty(&css->children)) 509 return -EBUSY; 510 511 /* only root child can switch scheduler type */ 512 if (!xg->parent || !xsched_group_css_is_root(&xg->parent->css, false)) 513 return -EINVAL; 514 515 ret = xcu_cg_set_sched_class(xg, type); 516 517 return (ret) ? ret : nbytes; 518 } 519 > 520 static s64 xcu_read_s64(struct cgroup_subsys_state *css, struct cftype *cft) 521 { 522 s64 ret = 0; 523 struct xsched_group *xcucg = xcu_cg_from_css(css); 524 525 switch (cft->private) { 526 case XCU_FILE_SHARES: 527 ret = xcucg->shares_cfg; 528 break; 529 default: 530 XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); 531 break; 532 } 533 534 return ret; 535 } 536 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3316/3316] block/blk-io-hierarchy/iodump.c:188:22: error: 'struct bio' has no member named 'bi_blkg'
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: 1bf8f90fb90c600d9f372e6be4ef251cc8905f04 [3316/3316] block-io-hierarchy: core hierarchy stats and iodump implementation config: x86_64-buildonly-randconfig-001-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250327.zVFjEAbx-lkp@…) compiler: gcc-12 (Debian 12.4.0-5) 12.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250327.zVFjEAbx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250327.zVFjEAbx-lkp@intel.com/ All errors (new ones prefixed by >>): block/blk-io-hierarchy/iodump.c: In function '__hierarchy_show_bio': >> block/blk-io-hierarchy/iodump.c:188:22: error: 'struct bio' has no member named 'bi_blkg' 188 | blkg_path(bio->bi_blkg, path, PATH_LEN); | ^~ >> block/blk-io-hierarchy/iodump.c:188:9: error: too many arguments to function 'blkg_path' 188 | blkg_path(bio->bi_blkg, path, PATH_LEN); | ^~~~~~~~~ In file included from block/blk-io-hierarchy/iodump.c:21: block/blk-io-hierarchy/../blk-cgroup.h:535:21: note: declared here 535 | static inline char *blkg_path(struct blkcg_gq *blkg) { return NULL; } | ^~~~~~~~~ vim +188 block/blk-io-hierarchy/iodump.c 179 180 static void __hierarchy_show_bio(struct seq_file *m, struct bio *bio, 181 enum stage_group stage, u64 duration) 182 { 183 char rwbs[RWB_LEN]; 184 char path[PATH_LEN] = {0}; 185 struct task_struct *task = get_pid_task(bio->pid, PIDTYPE_PID); 186 187 blk_fill_rwbs(rwbs, bio->bi_opf); > 188 blkg_path(bio->bi_blkg, path, PATH_LEN); 189 190 seq_printf(m, "%s-%d %s stage %s bio %s %llu + %u cgroup %s started %llu ns ago\n", 191 task ? task->comm : "null", task ? task->pid : 0, 192 bio->bi_bdev->bd_disk->disk_name, 193 hierarchy_stage_name(stage), rwbs, bio->bi_iter.bi_sector, 194 bio_sectors(bio), path, duration); 195 196 if (task) 197 put_task_struct(task); 198 } 199 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3309/3309] drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'formats' is used uninitialized whenever switch case is taken
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 16b8586be5cdac465d2c81e7cdaffcc80384bfb7 commit: 80764bc784413eb604c7d472db55b1ca72d4bbc5 [3309/3309] drm/loongson: add kernel modesetting driver support for ls7a1000/ls7a2000 config: x86_64-buildonly-randconfig-001-20251124 (https://download.01.org/0day-ci/archive/20251125/202511250117.AjD77new-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9e9fe08b16ea2c4d9867fb4974edf2a3776d6ece) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250117.AjD77new-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250117.AjD77new-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'lo32_addr_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:114:33: note: uninitialized use occurs here 114 | writel(paddr, ldev->reg_base + lo32_addr_reg); | ^~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:77:19: note: initialize the variable 'lo32_addr_reg' to silence this warning 77 | u32 lo32_addr_reg; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'hi32_addr_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:115:48: note: uninitialized use occurs here 115 | writel((paddr >> 32) & 0xFF, ldev->reg_base + hi32_addr_reg); | ^~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:78:19: note: initialize the variable 'hi32_addr_reg' to silence this warning 78 | u32 hi32_addr_reg; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'val' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:120:9: note: uninitialized use occurs here 120 | writel(val | CFG_PAGE_FLIP_BIT, ldev->reg_base + cfg_reg); | ^~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:80:9: note: initialize the variable 'val' to silence this warning 80 | u32 val; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'cfg_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:120:51: note: uninitialized use occurs here 120 | writel(val | CFG_PAGE_FLIP_BIT, ldev->reg_base + cfg_reg); | ^~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:79:13: note: initialize the variable 'cfg_reg' to silence this warning 79 | u32 cfg_reg; | ^ | = 0 >> drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'formats' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:451:12: note: uninitialized use occurs here 451 | formats, format_count, | ^~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:429:20: note: initialize the variable 'formats' to silence this warning 429 | const u32 *formats; | ^ | = NULL drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'format_count' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:451:21: note: uninitialized use occurs here 451 | formats, format_count, | ^~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:428:27: note: initialize the variable 'format_count' to silence this warning 428 | unsigned int format_count; | ^ | = 0 >> drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'name' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:453:18: note: uninitialized use occurs here 453 | type, name, index); | ^~~~ drivers/gpu/drm/loongson/lsdc_plane.c:430:18: note: initialize the variable 'name' to silence this warning 430 | const char *name; | ^ | = NULL 7 warnings generated. vim +/formats +444 drivers/gpu/drm/loongson/lsdc_plane.c 420 421 int lsdc_plane_init(struct lsdc_device *ldev, 422 struct drm_plane *plane, 423 enum drm_plane_type type, 424 unsigned int index) 425 { 426 struct drm_device *ddev = ldev->ddev; 427 int zpos = lsdc_plane_get_default_zpos(type); 428 unsigned int format_count; 429 const u32 *formats; 430 const char *name; 431 int ret; 432 433 switch (type) { 434 case DRM_PLANE_TYPE_PRIMARY: 435 formats = lsdc_primary_formats; 436 format_count = ARRAY_SIZE(lsdc_primary_formats); 437 name = "primary-%u"; 438 break; 439 case DRM_PLANE_TYPE_CURSOR: 440 formats = lsdc_cursor_formats; 441 format_count = ARRAY_SIZE(lsdc_cursor_formats); 442 name = "cursor-%u"; 443 break; > 444 case DRM_PLANE_TYPE_OVERLAY: -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency
by Chen Jinghuang 24 Nov '25

24 Nov '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CIH ---------------------------------------- ARCH_SUPPORTS_SCHED_SOFT_QUOTA was previously in a CGROUPS-dependent block, causing build warning when ARCH_SUPPORTS_SCHED_SOFT_QUOTA=y and CGROUPS=n. Move it to a generic, CGROUPS-independent section in init/Kconfig to fix the errors, while preserving its original role as an arch capability flag. Fixes: a91091aed1fa ("sched: More flexible use of CPU quota when CPU is idle") Signed-off-by: Chen Jinghuang<chenjinghuang2(a)huawei.com> --- init/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/init/Kconfig b/init/Kconfig index 485583e8ecbe..874daa00304c 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -950,6 +950,9 @@ config NUMA_BALANCING_DEFAULT_ENABLED If set, automatic NUMA balancing will be enabled if running on a NUMA machine. +config ARCH_SUPPORTS_SCHED_SOFT_QUOTA + bool + menuconfig CGROUPS bool "Control Group support" select KERNFS @@ -1178,9 +1181,6 @@ config SCHED_SOFT_DOMAIN # # For architectures that want to enable the support for SCHED_SOFT_QUOTA # -config ARCH_SUPPORTS_SCHED_SOFT_QUOTA - bool - config SCHED_SOFT_QUOTA bool "More flexible use of CPU quota" depends on ARCH_SUPPORTS_SCHED_SOFT_QUOTA -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Avoid RCU context warning when unpinning htab with internal structs
by Luo Gengkun 24 Nov '25

24 Nov '25

From: KaFai Wan <kafai.wan(a)linux.dev> stable inclusion from stable-v6.6.113 commit b6e9645be9eb93f7aff3ca887f8edb6f1d63358f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID8BLB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ] When unpinning a BPF hash table (htab or htab_lru) that contains internal structures (timer, workqueue, or task_work) in its values, a BUG warning is triggered: BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 ... The issue arises from the interaction between BPF object unpinning and RCU callback mechanisms: 1. BPF object unpinning uses ->free_inode() which schedules cleanup via call_rcu(), deferring the actual freeing to an RCU callback that executes within the RCU_SOFTIRQ context. 2. During cleanup of hash tables containing internal structures, htab_map_free_internal_structs() is invoked, which includes cond_resched() or cond_resched_rcu() calls to yield the CPU during potentially long operations. However, cond_resched() or cond_resched_rcu() cannot be safely called from atomic RCU softirq context, leading to the BUG warning when attempting to reschedule. Fix this by changing from ->free_inode() to ->destroy_inode() and rename bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). This allows direct inode freeing without RCU callback scheduling, avoiding the invalid context warning. Reported-by: Le Chen <tom2cat(a)sjtu.edu.cn> Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbr… Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: KaFai Wan <kafai.wan(a)linux.dev> Acked-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/bpf/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c index 99d0625b6c82..9a9630adcba4 100644 --- a/kernel/bpf/inode.c +++ b/kernel/bpf/inode.c @@ -607,7 +607,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) return 0; } -static void bpf_free_inode(struct inode *inode) +static void bpf_destroy_inode(struct inode *inode) { enum bpf_type type; @@ -622,7 +622,7 @@ static const struct super_operations bpf_super_ops = { .statfs = simple_statfs, .drop_inode = generic_delete_inode, .show_options = bpf_show_options, - .free_inode = bpf_free_inode, + .destroy_inode = bpf_destroy_inode, }; enum { -- 2.34.1

2 1

[PATCH OLK-6.6] sunrpc: fix null pointer dereference on zero-length checksum
by Wang Liang 24 Nov '25

24 Nov '25

From: Lei Lu <llfamsec(a)gmail.com> stable inclusion from stable-v6.6.112 commit 81cec07d303186d0d8c623ef8b5ecd3b81e94cf6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B5E CVE: CVE-2025-40129 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream. In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT. Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream") Cc: stable(a)kernel.org Signed-off-by: Lei Lu <llfamsec(a)gmail.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index cf30bd649e27..d063b63516f8 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci, rqstp->rq_auth_stat = rpc_autherr_badverf; return SVC_DENIED; } - if (flavor != RPC_AUTH_GSS) { + if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) { rqstp->rq_auth_stat = rpc_autherr_badverf; return SVC_DENIED; } -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
by Wang Liang 24 Nov '25

24 Nov '25

From: Daniel Borkmann <daniel(a)iogearbox.net> stable inclusion from stable-v5.10.246 commit 3fba965a9aac0fa3cbd8138436a37af9ab466d79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVH CVE: CVE-2025-40183 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first. Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") Reported-by: Yusuke Suzuki <yusuke.suzuki(a)isovalent.com> Reported-by: Julian Wiedmann <jwi(a)isovalent.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Martin KaFai Lau <martin.lau(a)kernel.org> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Jordan Rife <jrife(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Jordan Rife <jrife(a)google.com> Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Reviewed-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index d3e64273b3c4..adacca9ee505 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2256,6 +2256,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, if (IS_ERR(dst)) goto out_drop; + skb_dst_drop(skb); skb_dst_set(skb, dst); } else if (nh->nh_family != AF_INET6) { goto out_drop; @@ -2371,6 +2372,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, goto out_drop; } + skb_dst_drop(skb); skb_dst_set(skb, &rt->dst); } -- 2.34.1

2 1