- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1740/1740] include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer
by kernel test robot 10 Oct '25

10 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 0e7e343932646d9a28d9b5f8b025d781051fa52a commit: 33d1f46ad98ea3a13752a6360d97732ab4e119b9 [1740/1740] mm: Introduce memory reliable config: arm64-randconfig-r121-20250729 (https://download.01.org/0day-ci/archive/20251010/202510101858.zuN3Y3pP-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251010/202510101858.zuN3Y3pP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510101858.zuN3Y3pP-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): >> include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4572:13: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4573:27: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4573:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4573:27: sparse: right side has type unsigned int mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 20- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 26- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 32- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 38- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 44- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 50- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 56- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 62- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 68- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 74- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 80- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 86- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 92- | ^~ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &__start_rodata[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 98- | ^~ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 104- | ^ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); vim +41 include/linux/mem_reliable.h 31 32 static inline bool skip_none_movable_zone(gfp_t gfp, struct zoneref *z) 33 { 34 if (!mem_reliable_is_enabled()) 35 return false; 36 37 if (!current->mm || (current->flags & PF_KTHREAD)) 38 return false; 39 40 /* user tasks can only alloc memory from non-mirrored region */ > 41 if (!(gfp & ___GFP_RELIABILITY) && (gfp & __GFP_HIGHMEM) && 42 (gfp & __GFP_MOVABLE)) { 43 if (zonelist_zone_idx(z) < ZONE_MOVABLE) 44 return true; 45 } 46 47 return false; 48 } 49 #else 50 #define reliable_enabled 0 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
by Pan Taixi 10 Oct '25

10 Oct '25

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.17-rc5 commit 1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVX CVE: CVE-2025-39850 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the "any" remote (0.0.0.0 / ::). The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4]. Fix by checking that the remote destination exists before dereferencing it. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_xmit+0xb58/0x15f0 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3 [3] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014 RIP: 0010:vxlan_xmit+0x803/0x1600 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 ip6_finish_output2+0x210/0x6c0 ip6_finish_output+0x1af/0x2b0 ip6_mr_output+0x92/0x3e0 ip6_send_skb+0x30/0x90 rawv6_sendmsg+0xe6e/0x12e0 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f383422ec77 [4] #!/bin/bash ip address add 2001:db8:1::1/128 dev lo ip nexthop add id 1 via 2001:db8:1::1 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0 Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Reviewed-by: Petr Machata <petrm(a)nvidia.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://patch.msgid.link/20250901065035.159644-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/vxlan/vxlan_core.c [Context conflicts due to commit 5cde39ea3881 ("vxlan: Rename FDB Tx lookup function") and 804b09be09f8 ("vxlan: Add RCU read-side critical sections in the Tx path") not merged] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/net/vxlan/vxlan_core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c index 4f01e6d1bb95..797357ae0591 100644 --- a/drivers/net/vxlan/vxlan_core.c +++ b/drivers/net/vxlan/vxlan_core.c @@ -1883,6 +1883,7 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) n = neigh_lookup(&arp_tbl, &tip, dev); if (n) { + struct vxlan_rdst *rdst = NULL; struct vxlan_fdb *f; struct sk_buff *reply; @@ -1892,7 +1893,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) } f = vxlan_find_mac(vxlan, n->ha, vni); - if (f && vxlan_addr_any(&(first_remote_rcu(f)->remote_ip))) { + if (f) + rdst = first_remote_rcu(f); + if (rdst && vxlan_addr_any(&rdst->remote_ip)) { /* bridge-local neighbor */ neigh_release(n); goto out; @@ -2047,6 +2050,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, dev); if (n) { + struct vxlan_rdst *rdst = NULL; struct vxlan_fdb *f; struct sk_buff *reply; @@ -2056,7 +2060,9 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) } f = vxlan_find_mac(vxlan, n->ha, vni); - if (f && vxlan_addr_any(&(first_remote_rcu(f)->remote_ip))) { + if (f) + rdst = first_remote_rcu(f); + if (rdst && vxlan_addr_any(&rdst->remote_ip)) { /* bridge-local neighbor */ neigh_release(n); goto out; -- 2.34.1

2 1

[PATCH OLK-5.10] vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
by Pan Taixi 10 Oct '25

10 Oct '25

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.17-rc5 commit 1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVX CVE: CVE-2025-39850 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the "any" remote (0.0.0.0 / ::). The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4]. Fix by checking that the remote destination exists before dereferencing it. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_xmit+0xb58/0x15f0 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3 [3] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014 RIP: 0010:vxlan_xmit+0x803/0x1600 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 ip6_finish_output2+0x210/0x6c0 ip6_finish_output+0x1af/0x2b0 ip6_mr_output+0x92/0x3e0 ip6_send_skb+0x30/0x90 rawv6_sendmsg+0xe6e/0x12e0 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f383422ec77 [4] #!/bin/bash ip address add 2001:db8:1::1/128 dev lo ip nexthop add id 1 via 2001:db8:1::1 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0 Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Reviewed-by: Petr Machata <petrm(a)nvidia.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://patch.msgid.link/20250901065035.159644-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/vxlan/vxlan_core.c [Context conflicts due to commit 5cde39ea3881 ("vxlan: Rename FDB Tx lookup function") and 804b09be09f8 ("vxlan: Add RCU read-side critical sections in the Tx path") not merged] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/net/vxlan/vxlan_core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c index b00d9abe91d6..8898103dbf1b 100644 --- a/drivers/net/vxlan/vxlan_core.c +++ b/drivers/net/vxlan/vxlan_core.c @@ -2021,6 +2021,7 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) n = neigh_lookup(&arp_tbl, &tip, dev); if (n) { + struct vxlan_rdst *rdst = NULL; struct vxlan_fdb *f; struct sk_buff *reply; @@ -2030,7 +2031,9 @@ static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) } f = vxlan_find_mac(vxlan, n->ha, vni); - if (f && vxlan_addr_any(&(first_remote_rcu(f)->remote_ip))) { + if (f) + rdst = first_remote_rcu(f); + if (rdst && vxlan_addr_any(&rdst->remote_ip)) { /* bridge-local neighbor */ neigh_release(n); goto out; @@ -2181,6 +2184,7 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, dev); if (n) { + struct vxlan_rdst *rdst = NULL; struct vxlan_fdb *f; struct sk_buff *reply; @@ -2190,7 +2194,9 @@ static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) } f = vxlan_find_mac(vxlan, n->ha, vni); - if (f && vxlan_addr_any(&(first_remote_rcu(f)->remote_ip))) { + if (f) + rdst = first_remote_rcu(f); + if (rdst && vxlan_addr_any(&rdst->remote_ip)) { /* bridge-local neighbor */ neigh_release(n); goto out; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
by Cui GaoSheng 10 Oct '25

10 Oct '25

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.270 commit 89303ddbb502c3bc8edbf864f9f85500c8fe07e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBX9 CVE: CVE-2022-50347 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fc38a5a10e9e5a75eb9189854abeb8405b214cc9 ] mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called. Fixes: c7f6558d84af ("mmc: Add realtek USB sdmmc host driver") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221101063023.1664968-7-yangyingliang@huawei.com Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/mmc/host/rtsx_usb_sdmmc.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c index 9a3ff22dd0fe..1e5f54054a53 100644 --- a/drivers/mmc/host/rtsx_usb_sdmmc.c +++ b/drivers/mmc/host/rtsx_usb_sdmmc.c @@ -1344,6 +1344,7 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev) #ifdef RTSX_USB_USE_LEDS_CLASS int err; #endif + int ret; ucr = usb_get_intfdata(to_usb_interface(pdev->dev.parent)); if (!ucr) @@ -1382,7 +1383,15 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev) INIT_WORK(&host->led_work, rtsx_usb_update_led); #endif - mmc_add_host(mmc); + ret = mmc_add_host(mmc); + if (ret) { +#ifdef RTSX_USB_USE_LEDS_CLASS + led_classdev_unregister(&host->led); +#endif + mmc_free_host(mmc); + pm_runtime_disable(&pdev->dev); + return ret; + } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT
by Qi Xi 10 Oct '25

10 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID0EGV -------------------------------- Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT Fixes: ff86423eddff ("[Backport] workqueue: Implement disable/enable for (delayed) work items") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/linux/workqueue.h | 11 ++++++----- kernel/workqueue.c | 12 ++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 3f1c3e699266..50ff1d28fb31 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -72,15 +72,14 @@ enum { * data contains off-queue information when !WORK_STRUCT_PWQ. * * MSB - * [ pool ID ] [ disable depth ] [ OFFQ flags ] [ STRUCT flags ] - * 16 bits 1 bit 4 or 5 bits + * [ disable depth ] [ pool ID ] [ OFFQ flags ] [ STRUCT flags ] + * 16 bits 1 bit 4 or 5 bits */ WORK_OFFQ_FLAG_SHIFT = WORK_STRUCT_FLAG_BITS, WORK_OFFQ_CANCELING_BIT = WORK_OFFQ_FLAG_SHIFT, WORK_OFFQ_FLAG_END, WORK_OFFQ_FLAG_BITS = WORK_OFFQ_FLAG_END - WORK_OFFQ_FLAG_SHIFT, - WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, WORK_OFFQ_DISABLE_BITS = 16, /* @@ -88,10 +87,12 @@ enum { * and the last pool it was on. Cap pool ID to 31 bits and use the * highest number to indicate that no pool is associated. */ - WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_DISABLE_SHIFT + WORK_OFFQ_DISABLE_BITS, - WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT, + WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, + WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT - WORK_OFFQ_DISABLE_BITS, WORK_OFFQ_POOL_BITS = WORK_OFFQ_LEFT <= 31 ? WORK_OFFQ_LEFT : 31, + WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_POOL_SHIFT + WORK_OFFQ_POOL_BITS, + /* bit mask for work_busy() return values */ WORK_BUSY_PENDING = 1 << 0, WORK_BUSY_RUNNING = 1 << 1, diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 81615eb5562e..fe1afd7fad31 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -722,6 +722,11 @@ static struct pool_workqueue *get_work_pwq(struct work_struct *work) return NULL; } +static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) +{ + return (v >> shift) & ((1U << bits) - 1); +} + /** * get_work_pool - return the worker_pool a given work was associated with * @work: the work item of interest @@ -747,18 +752,13 @@ static struct worker_pool *get_work_pool(struct work_struct *work) if (data & WORK_STRUCT_PWQ) return work_struct_pwq(data)->pool; - pool_id = data >> WORK_OFFQ_POOL_SHIFT; + pool_id = shift_and_mask(data, WORK_OFFQ_POOL_SHIFT, WORK_OFFQ_POOL_BITS); if (pool_id == WORK_OFFQ_POOL_NONE) return NULL; return idr_find(&worker_pool_idr, pool_id); } -static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) -{ - return (v >> shift) & ((1U << bits) - 1); -} - static void work_offqd_unpack(struct work_offq_data *offqd, unsigned long data) { WARN_ON_ONCE(data & WORK_STRUCT_PWQ); -- CodeHub

2 1

[PATCH OLK-6.6] workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT
by Qi Xi 10 Oct '25

10 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID0EGV -------------------------------- Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT Fixes: 26f866c1be5a ("[Backport] workqueue: Implement disable/enable for (delayed) work items") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/linux/workqueue.h | 11 ++++++----- kernel/workqueue.c | 12 ++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 3f1c3e699266..50ff1d28fb31 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -72,15 +72,14 @@ enum { * data contains off-queue information when !WORK_STRUCT_PWQ. * * MSB - * [ pool ID ] [ disable depth ] [ OFFQ flags ] [ STRUCT flags ] - * 16 bits 1 bit 4 or 5 bits + * [ disable depth ] [ pool ID ] [ OFFQ flags ] [ STRUCT flags ] + * 16 bits 1 bit 4 or 5 bits */ WORK_OFFQ_FLAG_SHIFT = WORK_STRUCT_FLAG_BITS, WORK_OFFQ_CANCELING_BIT = WORK_OFFQ_FLAG_SHIFT, WORK_OFFQ_FLAG_END, WORK_OFFQ_FLAG_BITS = WORK_OFFQ_FLAG_END - WORK_OFFQ_FLAG_SHIFT, - WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, WORK_OFFQ_DISABLE_BITS = 16, /* @@ -88,10 +87,12 @@ enum { * and the last pool it was on. Cap pool ID to 31 bits and use the * highest number to indicate that no pool is associated. */ - WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_DISABLE_SHIFT + WORK_OFFQ_DISABLE_BITS, - WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT, + WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, + WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT - WORK_OFFQ_DISABLE_BITS, WORK_OFFQ_POOL_BITS = WORK_OFFQ_LEFT <= 31 ? WORK_OFFQ_LEFT : 31, + WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_POOL_SHIFT + WORK_OFFQ_POOL_BITS, + /* bit mask for work_busy() return values */ WORK_BUSY_PENDING = 1 << 0, WORK_BUSY_RUNNING = 1 << 1, diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 81615eb5562e..fe1afd7fad31 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -722,6 +722,11 @@ static struct pool_workqueue *get_work_pwq(struct work_struct *work) return NULL; } +static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) +{ + return (v >> shift) & ((1U << bits) - 1); +} + /** * get_work_pool - return the worker_pool a given work was associated with * @work: the work item of interest @@ -747,18 +752,13 @@ static struct worker_pool *get_work_pool(struct work_struct *work) if (data & WORK_STRUCT_PWQ) return work_struct_pwq(data)->pool; - pool_id = data >> WORK_OFFQ_POOL_SHIFT; + pool_id = shift_and_mask(data, WORK_OFFQ_POOL_SHIFT, WORK_OFFQ_POOL_BITS); if (pool_id == WORK_OFFQ_POOL_NONE) return NULL; return idr_find(&worker_pool_idr, pool_id); } -static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) -{ - return (v >> shift) & ((1U << bits) - 1); -} - static void work_offqd_unpack(struct work_offq_data *offqd, unsigned long data) { WARN_ON_ONCE(data & WORK_STRUCT_PWQ); -- CodeHub

2 1

[PATCH v4 openEuler-25.03 00/16] Xsched Kernel Patch
by Xia Fukun 10 Oct '25

10 Oct '25

Xsched Kernel Patch Alekseev Dmitry (3): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups xsched/core: Add xcu_wait() implementation Konstantin Meskhidze (11): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Add debug prints in XSched mechanism xsched: Add XCU initialization support xsched: Introduce vstream management xsched: Add vstream_kick() implementation xsched: Add xsched_ctx_init_xse() implementation xsched: Add XCU xsched_schedule() implementation xsched: Add xsched RT class xsched: Add xsched_submit() implementation xsched: Add xsched CFS class Liu Kai (1): xsched/core: Add multi-card support for xsched Xia Fukun (1): XSched driver patch arch/arm/include/uapi/asm/unistd.h | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/include/uapi/asm/unistd.h | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 2 +- arch/x86/include/uapi/asm/unistd.h | 1 + drivers/Makefile | 1 + .../0001-Adapt-910b-npu-driver-for-xsched.txt | 918 ++++++++++++++++++ drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 246 +++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 86 ++ include/linux/xcu_group.h | 112 +++ include/linux/xsched.h | 625 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 57 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 51 + kernel/xsched/Makefile | 4 + kernel/xsched/cfs.c | 227 +++++ kernel/xsched/cfs_quota.c | 92 ++ kernel/xsched/cgroup.c | 675 +++++++++++++ kernel/xsched/core.c | 752 ++++++++++++++ kernel/xsched/rt.c | 242 +++++ kernel/xsched/vstream.c | 502 ++++++++++ 28 files changed, 4610 insertions(+), 4 deletions(-) create mode 100644 drivers/xcu/0001-Adapt-910b-npu-driver-for-xsched.txt create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 17

[PATCH OLK-6.6] workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT
by Qi Xi 10 Oct '25

10 Oct '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID0EGV -------------------------------- Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT Fixes: 26f866c1be5a ("[Backport] workqueue: Implement disable/enable for (delayed) work items") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/linux/workqueue.h | 11 ++++++----- kernel/workqueue.c | 12 ++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 3f1c3e699266..50ff1d28fb31 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -72,15 +72,14 @@ enum { * data contains off-queue information when !WORK_STRUCT_PWQ. * * MSB - * [ pool ID ] [ disable depth ] [ OFFQ flags ] [ STRUCT flags ] - * 16 bits 1 bit 4 or 5 bits + * [ disable depth ] [ pool ID ] [ OFFQ flags ] [ STRUCT flags ] + * 16 bits 1 bit 4 or 5 bits */ WORK_OFFQ_FLAG_SHIFT = WORK_STRUCT_FLAG_BITS, WORK_OFFQ_CANCELING_BIT = WORK_OFFQ_FLAG_SHIFT, WORK_OFFQ_FLAG_END, WORK_OFFQ_FLAG_BITS = WORK_OFFQ_FLAG_END - WORK_OFFQ_FLAG_SHIFT, - WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, WORK_OFFQ_DISABLE_BITS = 16, /* @@ -88,10 +87,12 @@ enum { * and the last pool it was on. Cap pool ID to 31 bits and use the * highest number to indicate that no pool is associated. */ - WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_DISABLE_SHIFT + WORK_OFFQ_DISABLE_BITS, - WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT, + WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, + WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT - WORK_OFFQ_DISABLE_BITS, WORK_OFFQ_POOL_BITS = WORK_OFFQ_LEFT <= 31 ? WORK_OFFQ_LEFT : 31, + WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_POOL_SHIFT + WORK_OFFQ_POOL_BITS, + /* bit mask for work_busy() return values */ WORK_BUSY_PENDING = 1 << 0, WORK_BUSY_RUNNING = 1 << 1, diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 81615eb5562e..fe1afd7fad31 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -722,6 +722,11 @@ static struct pool_workqueue *get_work_pwq(struct work_struct *work) return NULL; } +static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) +{ + return (v >> shift) & ((1U << bits) - 1); +} + /** * get_work_pool - return the worker_pool a given work was associated with * @work: the work item of interest @@ -747,18 +752,13 @@ static struct worker_pool *get_work_pool(struct work_struct *work) if (data & WORK_STRUCT_PWQ) return work_struct_pwq(data)->pool; - pool_id = data >> WORK_OFFQ_POOL_SHIFT; + pool_id = shift_and_mask(data, WORK_OFFQ_POOL_SHIFT, WORK_OFFQ_POOL_BITS); if (pool_id == WORK_OFFQ_POOL_NONE) return NULL; return idr_find(&worker_pool_idr, pool_id); } -static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) -{ - return (v >> shift) & ((1U << bits) - 1); -} - static void work_offqd_unpack(struct work_offq_data *offqd, unsigned long data) { WARN_ON_ONCE(data & WORK_STRUCT_PWQ); -- CodeHub

2 1

[PATCH v3 openEuler-25.03 00/16] Xsched Kernel Patch
by Xia Fukun 10 Oct '25

10 Oct '25

Xsched Kernel Patch Alekseev Dmitry (3): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups xsched/core: Add xcu_wait() implementation Konstantin Meskhidze (11): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Add debug prints in XSched mechanism xsched: Add XCU initialization support xsched: Introduce vstream management xsched: Add vstream_kick() implementation xsched: Add xsched_ctx_init_xse() implementation xsched: Add XCU xsched_schedule() implementation xsched: Add xsched RT class xsched: Add xsched_submit() implementation xsched: Add xsched CFS class Liu Kai (1): xsched/core: Add multi-card support for xsched Xia Fukun (1): XSched driver patch arch/arm/include/uapi/asm/unistd.h | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/include/uapi/asm/unistd.h | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 2 +- arch/x86/include/uapi/asm/unistd.h | 1 + drivers/Makefile | 1 + .../0001-Adapt-910b-npu-driver-for-xsched.txt | 918 ++++++++++++++++++ drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 246 +++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 86 ++ include/linux/xcu_group.h | 112 +++ include/linux/xsched.h | 625 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 57 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 51 + kernel/xsched/Makefile | 4 + kernel/xsched/cfs.c | 227 +++++ kernel/xsched/cfs_quota.c | 92 ++ kernel/xsched/cgroup.c | 675 +++++++++++++ kernel/xsched/core.c | 752 ++++++++++++++ kernel/xsched/rt.c | 242 +++++ kernel/xsched/vstream.c | 502 ++++++++++ 28 files changed, 4610 insertions(+), 4 deletions(-) create mode 100644 drivers/xcu/0001-Adapt-910b-npu-driver-for-xsched.txt create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 17

[PATCH OLK-6.6 0/2] CVE-2025-39886
by Pu Lehui 10 Oct '25

10 Oct '25

Peilin Ye (1): bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Shakeel Butt (1): memcg: skip cgroup_file_notify if spinning is not allowed include/linux/gfp.h | 19 +++++++++++++++++++ include/linux/memcontrol.h | 26 +++++++++++++++++++------- kernel/bpf/helpers.c | 7 +++++-- mm/memcontrol.c | 5 +++-- 4 files changed, 46 insertions(+), 11 deletions(-) -- 2.34.1

2 3