- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2679/2679] arch/arm64/kernel/bpf-rvi.c:8:6: warning: no previous prototype for function 'bpf_arm64_cpu_have_feature'
by kernel test robot 15 Aug '25

15 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 43d8c124ec4624389b14d42595e5f0195e3e5a1d commit: 225346eb8c1a1c9cc44f816da80a5c12a0e93cba [2679/2679] bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250815/202508150054.NTqDP4S0-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250815/202508150054.NTqDP4S0-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508150054.NTqDP4S0-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/bpf-rvi.c:8:6: warning: no previous prototype for function 'bpf_arm64_cpu_have_feature' [-Wmissing-prototypes] 8 | bool bpf_arm64_cpu_have_feature(unsigned int num) | ^ arch/arm64/kernel/bpf-rvi.c:8:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 8 | bool bpf_arm64_cpu_have_feature(unsigned int num) | ^ | static 1 warning generated. vim +/bpf_arm64_cpu_have_feature +8 arch/arm64/kernel/bpf-rvi.c 7 > 8 bool bpf_arm64_cpu_have_feature(unsigned int num) 9 { 10 return cpu_have_feature(num); 11 } 12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2679/2679] block/blk-cgroup.c:2320:18: warning: no previous prototype for function 'bpf_blkcg_get_dev_iostat'
by kernel test robot 14 Aug '25

14 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 43d8c124ec4624389b14d42595e5f0195e3e5a1d commit: 969159a7bdeceb8bf814c6e0bf3b5360d9d9b167 [2679/2679] bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250814/202508142302.3YamVK7A-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250814/202508142302.3YamVK7A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508142302.3YamVK7A-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/blk-cgroup.c:2320:18: warning: no previous prototype for function 'bpf_blkcg_get_dev_iostat' [-Wmissing-prototypes] 2320 | __bpf_kfunc void bpf_blkcg_get_dev_iostat(struct blkcg *blkcg, int major, int minor, | ^ block/blk-cgroup.c:2320:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 2320 | __bpf_kfunc void bpf_blkcg_get_dev_iostat(struct blkcg *blkcg, int major, int minor, | ^ | static 1 warning generated. vim +/bpf_blkcg_get_dev_iostat +2320 block/blk-cgroup.c 2306 2307 /* 2308 * Basically inmitating: 2309 * 2310 * - v1: 2311 * - tg_print_rwstat_recursive() in block/blk-throttle.c 2312 * - bfqg_print_rwstat_recursive() in block/bfq-cgroup.c 2313 * - v2: 2314 * - blkcg_print_stat() 2315 * 2316 * without the final printing (e.g. the __blkg_prfill_rwstat() part). 2317 * 2318 * Note that a subsystem can only exist in either cgroup v1 or v2 at the same time. 2319 */ > 2320 __bpf_kfunc void bpf_blkcg_get_dev_iostat(struct blkcg *blkcg, int major, int minor, 2321 struct blkg_rw_iostat *iostat, bool is_v2) 2322 { 2323 struct blkcg_gq *blkg; 2324 char dev_name[64]; 2325 2326 if (!blkcg || !iostat) 2327 return; 2328 2329 if (is_v2) { 2330 if (blkcg == &blkcg_root) 2331 blkcg_fill_root_iostats(); 2332 else 2333 cgroup_rstat_flush_atomic(blkcg->css.cgroup); 2334 } 2335 2336 snprintf(dev_name, sizeof(dev_name), "%d:%d", major, minor); 2337 rcu_read_lock(); 2338 hlist_for_each_entry_rcu(blkg, &blkcg->blkg_list, blkcg_node) { 2339 if (strcmp(dev_name, blkg_dev_name(blkg))) 2340 continue; 2341 spin_lock_irq(&blkg->q->queue_lock); 2342 if (is_v2) 2343 blkcg_get_one_stat_v2(blkg, iostat); 2344 else 2345 blkcg_get_one_stat_v1(blkg, iostat); 2346 spin_unlock_irq(&blkg->q->queue_lock); 2347 break; 2348 } 2349 rcu_read_unlock(); 2350 } 2351 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/7] net: sch: Fix CVE-2025-37798
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-37798 Cong Wang (5): sch_drr: make drr_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_qfq: make qfq_qlen_notify() idempotent sch_ets: make est_qlen_notify() idempotent codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() WANG Cong (2): sch_htb: make htb_qlen_notify() idempotent sch_htb: make htb_deactivate() idempotent net/sched/sch_codel.c | 5 +---- net/sched/sch_drr.c | 7 ++++--- net/sched/sch_ets.c | 8 ++++---- net/sched/sch_fq_codel.c | 6 ++---- net/sched/sch_hfsc.c | 8 ++++++-- net/sched/sch_htb.c | 13 ++++++------- net/sched/sch_qfq.c | 7 +++++-- 7 files changed, 28 insertions(+), 26 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6 0/7] net: sch: Fix CVE-2025-37798
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-37798 Cong Wang (5): sch_ets: make est_qlen_notify() idempotent sch_qfq: make qfq_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_drr: make drr_qlen_notify() idempotent codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() WANG Cong (2): sch_htb: make htb_qlen_notify() idempotent sch_htb: make htb_deactivate() idempotent net/sched/sch_codel.c | 5 +---- net/sched/sch_drr.c | 7 ++++--- net/sched/sch_ets.c | 8 ++++---- net/sched/sch_fq_codel.c | 6 ++---- net/sched/sch_hfsc.c | 8 ++++++-- net/sched/sch_htb.c | 13 ++++++------- net/sched/sch_qfq.c | 7 +++++-- 7 files changed, 28 insertions(+), 26 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6 0/3] net_sched: Fix CVE-2025-37890
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-37890 Cong Wang (1): sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() Pedro Tammela (1): net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Victor Nogueira (1): net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc net/sched/sch_hfsc.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/3] net_sched: Fix CVE-2025-37890
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-37890 Cong Wang (1): sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() Pedro Tammela (1): net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Victor Nogueira (1): net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc net/sched/sch_hfsc.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] wifi: at76c50x: fix use after free access in at76_disconnect
by Dong Chenchen 14 Aug '25

14 Aug '25

From: Abdun Nihaal <abdun.nihaal(a)gmail.com> stable inclusion from stable-v5.10.237 commit 6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BMW CVE: CVE-2025-37796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ] The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface. Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()") Signed-off-by: Abdun Nihaal <abdun.nihaal(a)gmail.com> Link: https://patch.msgid.link/20250330103110.44080-1-abdun.nihaal@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c index 404257800033..706de33d0ed4 100644 --- a/drivers/net/wireless/atmel/at76c50x-usb.c +++ b/drivers/net/wireless/atmel/at76c50x-usb.c @@ -2553,7 +2553,7 @@ static void at76_disconnect(struct usb_interface *interface) wiphy_info(priv->hw->wiphy, "disconnecting\n"); at76_delete_device(priv); - usb_put_dev(priv->udev); + usb_put_dev(interface_to_usbdev(interface)); dev_info(&interface->dev, "disconnected\n"); } -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: at76c50x: fix use after free access in at76_disconnect
by Dong Chenchen 14 Aug '25

14 Aug '25

From: Abdun Nihaal <abdun.nihaal(a)gmail.com> stable inclusion from stable-v6.6.88 commit 7ca513631fa6ad3011b8b9197cdde0f351103704 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BMW CVE: CVE-2025-37796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ] The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface. Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()") Signed-off-by: Abdun Nihaal <abdun.nihaal(a)gmail.com> Link: https://patch.msgid.link/20250330103110.44080-1-abdun.nihaal@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c index 447b51cff8f9..c1a92c7f0f8e 100644 --- a/drivers/net/wireless/atmel/at76c50x-usb.c +++ b/drivers/net/wireless/atmel/at76c50x-usb.c @@ -2554,7 +2554,7 @@ static void at76_disconnect(struct usb_interface *interface) wiphy_info(priv->hw->wiphy, "disconnecting\n"); at76_delete_device(priv); - usb_put_dev(priv->udev); + usb_put_dev(interface_to_usbdev(interface)); dev_info(&interface->dev, "disconnected\n"); } -- 2.25.1

2 1

[PATCH v8 0/8] arm64: entry: Convert to generic irq entry
by Jinjie Ruan 14 Aug '25

14 Aug '25

Currently, x86, Riscv, Loongarch use the generic entry which makes maintainers' work easier and codes more elegant. So also convert arm64 to use the generic entry infrastructure from kernel/entry/* by switching it to generic IRQ entry first, which will make PREEMPT_DYNAMIC and PREEMPT_LAZY use the generic entry common code and remove a lot of duplicate code. Since commit a70e9f647f50 ("entry: Split generic entry into generic exception and syscall entry") split the generic entry into generic irq entry and generic syscall entry, it is time to convert arm64 to use the generic irq entry. And ARM64 will be completely converted to generic entry in the upcoming patch series. The main convert steps are as follows: - Split generic entry into generic irq entry and generic syscall to make the single patch more concentrated in switching to one thing. - Make arm64 easier to use irqentry_enter/exit(). - Make arm64 closer to the PREEMPT_DYNAMIC code of generic entry. - Switch to generic irq entry. This patch set is rebased on 6.17-rc1. It was tested ok with following test cases on QEMU virt platform: - Perf tests. - Different `dynamic preempt` mode switch. - Pseudo NMI tests. - Stress-ng CPU stress test. - MTE test case in Documentation/arch/arm64/memory-tagging-extension.rst and all test cases in tools/testing/selftests/arm64/mte/*. The test QEMU configuration is as follows: qemu-system-aarch64 \ -M virt,gic-version=3,virtualization=on,mte=on \ -cpu max,pauth-impdef=on \ -kernel Image \ -smp 8,sockets=1,cores=4,threads=2 \ -m 512m \ -nographic \ -no-reboot \ -device virtio-rng-pci \ -append "root=/dev/vda rw console=ttyAMA0 kgdboc=ttyAMA0,115200 \ earlycon preempt=voluntary irqchip.gicv3_pseudo_nmi=1" \ -drive if=none,file=images/rootfs.ext4,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 \ Changes in v8: - Update the comment. - Fix a typo, inerrupts_enabled(regs) -> interrupts_enabled(regs). - Consistently defined 'state' on a separate line, before the main block. - Split the "arch_irqentry_exit_need_resched()" patch. - Fix CONFIG_PREEMPTION not set build issue. - Remove do_signal() declaration in exception.h as there remains no users of `do_signal(). - Add asm/cpufeature.h header for entry-common.h - Add Reviewed-by, Acked-by and Tested-by. - Update the commit message. - Link to v7: https://lore.kernel.org/all/20250729015456.3411143-1-ruanjinjie@huawei.com/ Changes in v7: - Rebased on v6.16-rc7 and remove the merged first patch. - Update the commit message. - Link to v6: https://lore.kernel.org/all/20250213130007.1418890-1-ruanjinjie@huawei.com/ Changes in v6: - Rebased on 6.14 rc2 next. - Put the syscall bits aside and split it out. - Have the split patch before the arm64 changes. - Merge some tightly coupled patches. - Adjust the order of some patches to make them more reasonable. - Define regs_irqs_disabled() by inline function. - Define interrupts_enabled() in terms of regs_irqs_disabled(). - Delete the fast_interrupts_enabled() macro. - irqentry_state_t -> arm64_irqentry_state_t. - Remove arch_exit_to_user_mode_prepare() and pull local_daif_mask() later in the arm64 exit sequence - Update the commit message. - Link to v5: https://lkml.org/lkml/2024/12/6/609 Changes in v5: - Not change arm32 and keep inerrupts_enabled() macro for gicv3 driver. - Move irqentry_state definition into arch/arm64/kernel/entry-common.c. - Avoid removing the __enter_from_*() and __exit_to_*() wrappers. - Update "irqentry_state_t ret/irq_state" to "state" to keep it consistently. - Use generic irq entry header for PREEMPT_DYNAMIC after split the generic entry. - Also refactor the ARM64 syscall code. - Introduce arch_ptrace_report_syscall_entry/exit(), instead of arch_pre/post_report_syscall_entry/exit() to simplify code. - Make the syscall patches clear separation. - Update the commit message. Changes in v4: - Rework/cleanup split into a few patches as Mark suggested. - Replace interrupts_enabled() macro with regs_irqs_disabled(), instead of left it here. - Remove rcu and lockdep state in pt_regs by using temporary irqentry_state_t as Mark suggested. - Remove some unnecessary intermediate functions to make it clear. - Rework preempt irq and PREEMPT_DYNAMIC code to make the switch more clear. - arch_prepare_*_entry/exit() -> arch_pre_*_entry/exit(). - Expand the arch functions comment. - Make arch functions closer to its caller. - Declare saved_reg in for block. - Remove arch_exit_to_kernel_mode_prepare(), arch_enter_from_kernel_mode(). - Adjust "Add few arch functions to use generic entry" patch to be the penultimate. - Update the commit message. - Add suggested-by. Changes in v3: - Test the MTE test cases. - Handle forget_syscall() in arch_post_report_syscall_entry() - Make the arch funcs not use __weak as Thomas suggested, so move the arch funcs to entry-common.h, and make arch_forget_syscall() folded in arch_post_report_syscall_entry() as suggested. - Move report_single_step() to thread_info.h for arm64 - Change __always_inline() to inline, add inline for the other arch funcs. - Remove unused signal.h for entry-common.h. - Add Suggested-by. - Update the commit message. Changes in v2: - Add tested-by. - Fix a bug that not call arch_post_report_syscall_entry() in syscall_trace_enter() if ptrace_report_syscall_entry() return not zero. - Refactor report_syscall(). - Add comment for arch_prepare_report_syscall_exit(). - Adjust entry-common.h header file inclusion to alphabetical order. - Update the commit message. Jinjie Ruan (8): arm64: ptrace: Replace interrupts_enabled() with regs_irqs_disabled() arm64: entry: Refactor the entry and exit for exceptions from EL1 arm64: entry: Rework arm64_preempt_schedule_irq() arm64: entry: Use preempt_count() and need_resched() helper entry: Add arch_irqentry_exit_need_resched() for arm64 arm64: entry: Refactor preempt_schedule_irq() check code arm64: entry: Move arm64_preempt_schedule_irq() into __exit_to_kernel_mode() arm64: entry: Switch to generic IRQ entry arch/arm64/Kconfig | 1 + arch/arm64/include/asm/daifflags.h | 2 +- arch/arm64/include/asm/entry-common.h | 57 ++++ arch/arm64/include/asm/exception.h | 1 - arch/arm64/include/asm/preempt.h | 2 - arch/arm64/include/asm/ptrace.h | 13 +- arch/arm64/include/asm/xen/events.h | 2 +- arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/debug-monitors.c | 2 +- arch/arm64/kernel/entry-common.c | 423 +++++++++----------------- arch/arm64/kernel/sdei.c | 2 +- arch/arm64/kernel/signal.c | 3 +- kernel/entry/common.c | 16 +- 13 files changed, 230 insertions(+), 296 deletions(-) create mode 100644 arch/arm64/include/asm/entry-common.h -- 2.34.1

1 8

[PATCH OLK-6.6 0/2] net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix VLAN 0 refcount imbalance of toggling filtering during Dong Chenchen (2): net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime net: vlan: Fix kabi breakage of struct vlan_info net/8021q/vlan.c | 42 +++++++++++++++++++++++++++++++++--------- net/8021q/vlan.h | 1 + 2 files changed, 34 insertions(+), 9 deletions(-) -- 2.25.1

2 3