- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] NFSD: Fix crash in nfsd4_read_release()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v6.6.117 commit 03524ccff698d4a77d096ed529073d91f5edee5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBAJB CVE: CVE-2025-40324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream. When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index b2bbf3d6d177..04a2c44e0f95 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -978,10 +978,11 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, static void nfsd4_read_release(union nfsd4_op_u *u) { - if (u->read.rd_nf) + if (u->read.rd_nf) { + trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length); nfsd_file_put(u->read.rd_nf); - trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32 -- 2.46.1

2 1

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (8): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free include/linux/xsched.h | 36 +++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 200 insertions(+), 131 deletions(-) -- 2.34.1

2 9

[openeuler:OLK-5.10 3399/3399] block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7579fd89cb4a201d22bd5b78f48df5ce339c0b2d commit: 6381672514c4d94637cd4db830b8644440abe99a [3399/3399] block: fix kabi broken config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100653.S0mIExGw-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100653.S0mIExGw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100653.S0mIExGw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset' >> block/bio.c:412: warning: Excess function parameter 'nr_iovecs' description in 'bio_alloc_bioset' vim +412 block/bio.c df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 374 ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 375 /** ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 376 * bio_alloc_bioset - allocate a bio for I/O 519c8e9ffd8614 block/bio.c Randy Dunlap 2017-10-16 377 * @gfp_mask: the GFP_* mask given to the slab allocator ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 378 * @nr_iovecs: number of iovecs to pre-allocate db18efac0bd644 fs/bio.c Jaak Ristioja 2010-01-15 379 * @bs: the bio_set to allocate from. ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 380 * ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 381 * Description: 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 382 * If @bs is NULL, uses kmalloc() to allocate the bio; else the allocation is 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 383 * backed by the @bs's mempool. 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 384 * d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 385 * When @bs is not NULL, if %__GFP_DIRECT_RECLAIM is set then bio_alloc will d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 386 * always be able to allocate a bio. This is due to the mempool guarantees. d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 387 * To make this work, callers must never allocate more than 1 bio at a time d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 388 * from this pool. Callers that need to allocate more than 1 bio must always d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 389 * submit the previously allocated bio for IO before attempting to allocate d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 390 * a new one. Failure to do so can cause deadlocks under memory pressure. 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 391 * ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 392 * Note that when running under submit_bio_noacct() (i.e. any block df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 393 * driver), bios are not submitted until after you return - see the code in ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 394 * submit_bio_noacct() that converts recursion into iteration, to prevent df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 395 * stack overflows. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 396 * df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 397 * This would normally mean allocating multiple bios under ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 398 * submit_bio_noacct() would be susceptible to deadlocks, but we have df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 399 * deadlock avoidance code that resubmits any blocked bios from a rescuer df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 400 * thread. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 401 * df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 402 * However, we do not guarantee forward progress for allocations from other df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 403 * mempools. Doing multiple allocations from the same mempool under ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 404 * submit_bio_noacct() should be avoided - instead, use bio_set's front_pad df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 405 * for per bio allocations. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 406 * 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 407 * RETURNS: 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 408 * Pointer to new bio on success, NULL on failure. 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 409 */ 6381672514c4d9 block/bio.c Li Lingfeng 2025-02-10 410 struct bio *bio_alloc_bioset(gfp_t gfp_mask, unsigned int nr_iovecs_int, 7a88fa19194458 block/bio.c Dan Carpenter 2017-03-23 411 struct bio_set *bs) ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 @412 { df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 413 gfp_t saved_gfp = gfp_mask; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 414 unsigned front_pad; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 415 unsigned inline_vecs; 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 416 struct bio_vec *bvl = NULL; 451a9ebf653d28 fs/bio.c Tejun Heo 2009-04-15 417 struct bio *bio; 451a9ebf653d28 fs/bio.c Tejun Heo 2009-04-15 418 void *p; 6381672514c4d9 block/bio.c Li Lingfeng 2025-02-10 419 unsigned short nr_iovecs = (unsigned short)nr_iovecs_int; 0a0d96b03a1f3b fs/bio.c Jens Axboe 2008-09-11 420 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 421 if (!bs) { 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 422 if (nr_iovecs > UIO_MAXIOV) 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 423 return NULL; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 424 1f4fe21cf45c79 block/bio.c Gustavo A. R. Silva 2020-06-19 425 p = kmalloc(struct_size(bio, bi_inline_vecs, nr_iovecs), gfp_mask); 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 426 front_pad = 0; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 427 inline_vecs = nr_iovecs; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 428 } else { d8f429e1669b97 block/bio.c Junichi Nomura 2014-10-03 429 /* should not use nobvec bioset for nr_iovecs > 0 */ 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 430 if (WARN_ON_ONCE(!mempool_initialized(&bs->bvec_pool) && 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 431 nr_iovecs > 0)) d8f429e1669b97 block/bio.c Junichi Nomura 2014-10-03 432 return NULL; df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 433 /* ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 434 * submit_bio_noacct() converts recursion to iteration; this df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 435 * means if we're running beneath it, any bios we allocate and df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 436 * submit will not be submitted (and thus freed) until after we df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 437 * return. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 438 * df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 439 * This exposes us to a potential deadlock if we allocate df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 440 * multiple bios from the same bio_set() while running ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 441 * underneath submit_bio_noacct(). If we were to allocate df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 442 * multiple bios (say a stacking block driver that was splitting df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 443 * bios), we would deadlock if we exhausted the mempool's df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 444 * reserve. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 445 * df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 446 * We solve this, and guarantee forward progress, with a rescuer df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 447 * workqueue per bio_set. If we go to allocate and there are df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 448 * bios on current->bio_list, we first try the allocation d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 449 * without __GFP_DIRECT_RECLAIM; if that fails, we punt those d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 450 * bios we would be blocking to the rescuer workqueue before d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 451 * we retry with the original gfp_flags. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 452 */ df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 453 f5fe1b51905df7 block/bio.c NeilBrown 2017-03-10 454 if (current->bio_list && f5fe1b51905df7 block/bio.c NeilBrown 2017-03-10 455 (!bio_list_empty(&current->bio_list[0]) || 47e0fb461fca1a block/bio.c NeilBrown 2017-06-18 456 !bio_list_empty(&current->bio_list[1])) && 47e0fb461fca1a block/bio.c NeilBrown 2017-06-18 457 bs->rescue_workqueue) d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 458 gfp_mask &= ~__GFP_DIRECT_RECLAIM; df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 459 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 460 p = mempool_alloc(&bs->bio_pool, gfp_mask); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 461 if (!p && gfp_mask != saved_gfp) { df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 462 punt_bios_to_rescuer(bs); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 463 gfp_mask = saved_gfp; 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 464 p = mempool_alloc(&bs->bio_pool, gfp_mask); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 465 } df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 466 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 467 front_pad = bs->front_pad; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 468 inline_vecs = BIO_INLINE_VECS; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 469 } 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 470 451a9ebf653d28 fs/bio.c Tejun Heo 2009-04-15 471 if (unlikely(!p)) 451a9ebf653d28 fs/bio.c Tejun Heo 2009-04-15 472 return NULL; ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 473 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 474 bio = p + front_pad; 3a83f4677539bc block/bio.c Ming Lei 2016-11-22 475 bio_init(bio, NULL, 0); 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 476 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 477 if (nr_iovecs > inline_vecs) { ed996a52c868b6 block/bio.c Christoph Hellwig 2016-07-19 478 958384da6a734e block/bio.c Christoph Hellwig 2025-02-10 479 bvl = bvec_alloc(&bs->bvec_pool, &nr_iovecs, gfp_mask); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 480 if (!bvl && gfp_mask != saved_gfp) { df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 481 punt_bios_to_rescuer(bs); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 482 gfp_mask = saved_gfp; 958384da6a734e block/bio.c Christoph Hellwig 2025-02-10 483 bvl = bvec_alloc(&bs->bvec_pool, &nr_iovecs, gfp_mask); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 484 } df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 485 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 486 if (unlikely(!bvl)) 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 487 goto err_free; a38352e0ac02db fs/bio.c Kent Overstreet 2012-05-25 488 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 489 } else if (nr_iovecs) { 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 490 bvl = bio->bi_inline_vecs; 392ddc32982a5c fs/bio.c Jens Axboe 2008-12-23 491 } 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 492 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 493 bio->bi_pool = bs; 392ddc32982a5c fs/bio.c Jens Axboe 2008-12-23 494 bio->bi_max_vecs = nr_iovecs; ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 495 bio->bi_io_vec = bvl; ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 496 return bio; 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 497 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 498 err_free: 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 499 mempool_free(p, &bs->bio_pool); 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 500 return NULL; ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 501 } a112a71d45b5e4 fs/bio.c H Hartley Sweeten 2009-09-26 502 EXPORT_SYMBOL(bio_alloc_bioset); ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 503 :::::: The code at line 412 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <torvalds(a)ppc970.osdl.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3508/3508] mm/madvise.c:297:6: warning: no previous prototype for 'force_swapin_vma'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d7d7f131569485a9b6737b85cd8144196135b1a1 commit: 92a0eb9bde6c03412b39f9f3d20968c091ea3b46 [3508/3508] memcg: introduce per-memcg swapin interface config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100526.hg7amXND-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100526.hg7amXND-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100526.hg7amXND-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/madvise.c:297:6: warning: no previous prototype for 'force_swapin_vma' [-Wmissing-prototypes] 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^~~~~~~~~~~~~~~~ vim +/force_swapin_vma +297 mm/madvise.c 280 281 #ifdef CONFIG_MEMCG_SWAP_QOS 282 void force_swapin_vma(struct vm_area_struct *vma) 283 { 284 struct file *file = vma->vm_file; 285 286 if (!can_madv_lru_vma(vma)) 287 return; 288 289 if (!file) { 290 walk_page_vma(vma, &swapin_walk_ops, vma); 291 lru_add_drain(); 292 } else if (shmem_mapping(file->f_mapping)) 293 shmem_swapin_range(vma, vma->vm_start, 294 vma->vm_end, file->f_mapping); 295 } 296 #else > 297 void force_swapin_vma(struct vm_area_struct *vma) 298 { 299 } 300 #endif 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3399/3399] drivers/acpi/numa/hmat.c:726:6: warning: no previous prototype for 'hmat_restore_target'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7579fd89cb4a201d22bd5b78f48df5ce339c0b2d commit: 2e1b00fcf1e3152a1e73846f5f9ec37cef088a65 [3399/3399] ACPI/HMAT: Add missing locality information for hot-added device config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100332.Dzr4IpBp-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100332.Dzr4IpBp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100332.Dzr4IpBp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/acpi/numa/hmat.c:726:6: warning: no previous prototype for 'hmat_restore_target' [-Wmissing-prototypes] 726 | void hmat_restore_target(int nid) | ^~~~~~~~~~~~~~~~~~~ vim +/hmat_restore_target +726 drivers/acpi/numa/hmat.c 725 > 726 void hmat_restore_target(int nid) 727 { 728 struct memory_target *target; 729 int pxm; 730 731 pxm = node_to_pxm(nid); 732 target = find_mem_target(pxm); 733 if (!target) 734 return; 735 736 mutex_lock(&target_lock); 737 hmat_register_target_cache(target); 738 hmat_register_target_perf(target, 0); 739 hmat_register_target_perf(target, 1); 740 mutex_unlock(&target_lock); 741 } 742 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3388/3388] kernel/sched/core.c:8279:18: error: member reference type 'struct mem_cgroup *' is a pointer; did you mean to use '->'?
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: b7772972a0a76efac27078392f3f706914fe2af7 [3388/3388] sched/core: Add cpu.steal_task in cgroup v1 cpu subsystem config: x86_64-randconfig-r054-20251209 (https://download.01.org/0day-ci/archive/20251210/202512101034.mDWav7mE-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 6ec8c4351cfc1d0627d1633b02ea787bd29c77d8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512101034.mDWav7mE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512101034.mDWav7mE-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <built-in>:2: In file included from include/linux/compiler_types.h:69: include/linux/compiler-clang.h:34:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 34 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:352:9: note: previous definition is here 352 | #define __SANITIZE_ADDRESS__ 1 | ^ kernel/sched/core.c:2750:6: warning: no previous prototype for function 'sched_set_stop_task' [-Wmissing-prototypes] 2750 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ kernel/sched/core.c:2750:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2750 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ | static kernel/sched/core.c:8279:3: error: use of undeclared identifier 'root_task_group'; did you mean 'root_mem_cgroup'? 8279 | root_task_group.steal_task = TG_STEAL_NO; | ^~~~~~~~~~~~~~~ | root_mem_cgroup include/linux/memcontrol.h:461:27: note: 'root_mem_cgroup' declared here 461 | extern struct mem_cgroup *root_mem_cgroup; | ^ >> kernel/sched/core.c:8279:18: error: member reference type 'struct mem_cgroup *' is a pointer; did you mean to use '->'? 8279 | root_task_group.steal_task = TG_STEAL_NO; | ~~~~~~~~~~~~~~~^ | -> >> kernel/sched/core.c:8279:19: error: no member named 'steal_task' in 'struct mem_cgroup' 8279 | root_task_group.steal_task = TG_STEAL_NO; | ~~~~~~~~~~~~~~~ ^ kernel/sched/core.c:8279:32: error: use of undeclared identifier 'TG_STEAL_NO' 8279 | root_task_group.steal_task = TG_STEAL_NO; | ^~~~~~~~~~~ 2 warnings and 4 errors generated. vim +8279 kernel/sched/core.c 8253 8254 wait_bit_init(); 8255 8256 #ifdef CONFIG_FAIR_GROUP_SCHED 8257 ptr += 2 * nr_cpu_ids * sizeof(void **); 8258 #endif 8259 #ifdef CONFIG_RT_GROUP_SCHED 8260 ptr += 2 * nr_cpu_ids * sizeof(void **); 8261 #endif 8262 if (ptr) { 8263 ptr = (unsigned long)kzalloc(ptr, GFP_NOWAIT); 8264 8265 #ifdef CONFIG_FAIR_GROUP_SCHED 8266 root_task_group.se = (struct sched_entity **)ptr; 8267 ptr += nr_cpu_ids * sizeof(void **); 8268 8269 root_task_group.cfs_rq = (struct cfs_rq **)ptr; 8270 ptr += nr_cpu_ids * sizeof(void **); 8271 8272 root_task_group.shares = ROOT_TASK_GROUP_LOAD; 8273 init_cfs_bandwidth(&root_task_group.cfs_bandwidth); 8274 #endif /* CONFIG_FAIR_GROUP_SCHED */ 8275 #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER 8276 root_task_group.smt_expell = TG_SMT_EXPELL; 8277 #endif 8278 #ifdef CONFIG_SCHED_STEAL > 8279 root_task_group.steal_task = TG_STEAL_NO; 8280 #endif 8281 #ifdef CONFIG_RT_GROUP_SCHED 8282 root_task_group.rt_se = (struct sched_rt_entity **)ptr; 8283 ptr += nr_cpu_ids * sizeof(void **); 8284 8285 root_task_group.rt_rq = (struct rt_rq **)ptr; 8286 ptr += nr_cpu_ids * sizeof(void **); 8287 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] test arm ci
by Tengda Wu 10 Dec '25

10 Dec '25

--- kernel/cgroup/ifs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/cgroup/ifs.c b/kernel/cgroup/ifs.c index e6419899d725..0cd53572dac4 100644 --- a/kernel/cgroup/ifs.c +++ b/kernel/cgroup/ifs.c @@ -314,6 +314,7 @@ static void tdesc_init(struct ifs_tdesc *desc, u64 freq) static void cgroup_ifs_tdesc_init(void) { + // test tdesc_init(&ifs_tdesc[IFS_TIMER_CLK], NSEC_PER_SEC); tdesc_init(&ifs_tdesc[IFS_TIMER_TSC], this_cpu_read(ifs_tsc_freq)); } -- 2.34.1

2 1

[PATCH OLK-6.6] sctp: initialize more fields in sctp_v6_from_sk()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.104 commit 463aa96fca6209bb205f49f7deea3817d7ddaa3a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBRO CVE: CVE-2025-39812 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e8750469242cad8f01f320131fd5a6f540dbb99 ] syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+e69f06a0f30116c68056(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68adc0a2.050a0220.37038e.00c4.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20250826141314.1802610-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/ipv6.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index 717828e53162..0673857cb3d8 100644 --- a/net/sctp/ipv6.c +++ b/net/sctp/ipv6.c @@ -547,7 +547,9 @@ static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk) { addr->v6.sin6_family = AF_INET6; addr->v6.sin6_port = 0; + addr->v6.sin6_flowinfo = 0; addr->v6.sin6_addr = sk->sk_v6_rcv_saddr; + addr->v6.sin6_scope_id = 0; } /* Initialize sk->sk_rcv_saddr from sctp_addr. */ -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: nf_tables: reject duplicate device on updates
by Wang Liang 10 Dec '25

10 Dec '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.117 commit 3f358a66a04513311668ea4b40f5064e253d8386 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICW8ZD CVE: CVE-2025-38678 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973 upstream. A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of the duplicated device. Check if a duplicated device exists in the transaction batch, bail out with EEXIST in such case. WARNING is hit when unregistering the hook: [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full) [...] [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150 Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable") Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nf_tables_api.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 18ae39cf4188..bea2c3c4d3de 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2586,6 +2586,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, struct nft_chain *chain = ctx->chain; struct nft_chain_hook hook = {}; struct nft_stats *stats = NULL; + struct nftables_pernet *nft_net; struct nft_hook *h, *next; struct nf_hook_ops *ops; struct nft_trans *trans; @@ -2626,6 +2627,20 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, if (nft_hook_list_find(&basechain->hook_list, h)) { list_del(&h->list); kfree(h); + continue; + } + + nft_net = nft_pernet(ctx->net); + list_for_each_entry(trans, &nft_net->commit_list, list) { + if (trans->msg_type != NFT_MSG_NEWCHAIN || + trans->ctx.table != ctx->table || + !nft_trans_chain_update(trans)) + continue; + + if (nft_hook_list_find(&nft_trans_chain_hooks(trans), h)) { + nft_chain_release_hook(&hook); + return -EEXIST; + } } } } else { @@ -8514,6 +8529,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, { const struct nlattr * const *nla = ctx->nla; struct nft_flowtable_hook flowtable_hook; + struct nftables_pernet *nft_net; struct nft_hook *hook, *next; struct nft_trans *trans; bool unregister = false; @@ -8529,6 +8545,20 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, if (nft_hook_list_find(&flowtable->hook_list, hook)) { list_del(&hook->list); kfree(hook); + continue; + } + + nft_net = nft_pernet(ctx->net); + list_for_each_entry(trans, &nft_net->commit_list, list) { + if (trans->msg_type != NFT_MSG_NEWFLOWTABLE || + trans->ctx.table != ctx->table || + !nft_trans_flowtable_update(trans)) + continue; + + if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook)) { + err = -EEXIST; + goto err_flowtable_update_hook; + } } } -- 2.34.1

2 1

[PATCH OLK-6.6] net/packet: fix a race in packet_set_ring() and packet_notifier()
by Wang Liang 10 Dec '25

10 Dec '25

From: Quang Le <quanglex97(a)gmail.com> stable inclusion from stable-v6.6.102 commit 88caf46db8239e6471413d28aabaa6b8bd552805 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4S CVE: CVE-2025-38617 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01d3c8417b9c1b884a8a981a3b886da556512f36 upstream. When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Quang Le <quanglex97(a)gmail.com> Signed-off-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250801175423.2970334-1-willemdebruijn.kernel@gma… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 4abf7e9ac4f2..677d3190479f 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4567,10 +4567,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, spin_lock(&po->bind_lock); was_running = packet_sock_flag(po, PACKET_SOCK_RUNNING); num = po->num; - if (was_running) { - WRITE_ONCE(po->num, 0); + WRITE_ONCE(po->num, 0); + if (was_running) __unregister_prot_hook(sk, false); - } + spin_unlock(&po->bind_lock); synchronize_net(); @@ -4602,10 +4602,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, mutex_unlock(&po->pg_vec_lock); spin_lock(&po->bind_lock); - if (was_running) { - WRITE_ONCE(po->num, num); + WRITE_ONCE(po->num, num); + if (was_running) register_prot_hook(sk); - } + spin_unlock(&po->bind_lock); if (pg_vec && (po->tp_version > TPACKET_V2)) { /* Because we don't support block-based V3 on tx-ring */ -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: xt_nfacct: don't assume acct name is null-terminated
by Wang Liang 10 Dec '25

10 Dec '25

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.102 commit 58004aa21e79addaf41667bfe65e93ec51653f18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9G CVE: CVE-2025-38639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bf58e667af7d96c8eb9411f926a0a0955f41ce21 ] BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523 nfnl_acct_find_get() handles non-null input, but the error printk relied on its presence. Reported-by: syzbot+4ff165b9251e4d295690(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ff165b9251e4d295690 Tested-by: syzbot+4ff165b9251e4d295690(a)syzkaller.appspotmail.com Fixes: ceb98d03eac5 ("netfilter: xtables: add nfacct match to support extended accounting") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/xt_nfacct.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c index 7c6bf1c16813..0ca1cdfc4095 100644 --- a/net/netfilter/xt_nfacct.c +++ b/net/netfilter/xt_nfacct.c @@ -38,8 +38,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par) nfacct = nfnl_acct_find_get(par->net, info->name); if (nfacct == NULL) { - pr_info_ratelimited("accounting object `%s' does not exists\n", - info->name); + pr_info_ratelimited("accounting object `%.*s' does not exist\n", + NFACCT_NAME_MAX, info->name); return -ENOENT; } info->nfacct = nfacct; -- 2.34.1

2 1

[PATCH OLK-6.6] net: drop UFO packets in udp_rcv_segment()
by Wang Liang 10 Dec '25

10 Dec '25

stable inclusion from stable-v6.6.102 commit 0d45954034f8edd6d4052e0190d3d6335c37e4de category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC8Y CVE: CVE-2025-38622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d46e51f1c78b9ab9323610feb14238d06d46d519 ] When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size, below crash may happen. ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:4572! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 62 Comm: mytest Not tainted 6.16.0-rc7 #203 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:skb_pull_rcsum+0x8e/0xa0 Code: 00 00 5b c3 cc cc cc cc 8b 93 88 00 00 00 f7 da e8 37 44 38 00 f7 d8 89 83 88 00 00 00 48 8b 83 c8 00 00 00 5b c3 cc cc cc cc <0f> 0b 0f 0b 66 66 2e 0f 1f 84 00 000 RSP: 0018:ffffc900001fba38 EFLAGS: 00000297 RAX: 0000000000000004 RBX: ffff8880040c1000 RCX: ffffc900001fb948 RDX: ffff888003e6d700 RSI: 0000000000000008 RDI: ffff88800411a062 RBP: ffff8880040c1000 R08: 0000000000000000 R09: 0000000000000001 R10: ffff888003606c00 R11: 0000000000000001 R12: 0000000000000000 R13: ffff888004060900 R14: ffff888004050000 R15: ffff888004060900 FS: 000000002406d3c0(0000) GS:ffff888084a19000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000040 CR3: 0000000004007000 CR4: 00000000000006f0 Call Trace: <TASK> udp_queue_rcv_one_skb+0x176/0x4b0 net/ipv4/udp.c:2445 udp_queue_rcv_skb+0x155/0x1f0 net/ipv4/udp.c:2475 udp_unicast_rcv_skb+0x71/0x90 net/ipv4/udp.c:2626 __udp4_lib_rcv+0x433/0xb00 net/ipv4/udp.c:2690 ip_protocol_deliver_rcu+0xa6/0x160 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x72/0x90 net/ipv4/ip_input.c:233 ip_sublist_rcv_finish+0x5f/0x70 net/ipv4/ip_input.c:579 ip_sublist_rcv+0x122/0x1b0 net/ipv4/ip_input.c:636 ip_list_rcv+0xf7/0x130 net/ipv4/ip_input.c:670 __netif_receive_skb_list_core+0x21d/0x240 net/core/dev.c:6067 netif_receive_skb_list_internal+0x186/0x2b0 net/core/dev.c:6210 napi_complete_done+0x78/0x180 net/core/dev.c:6580 tun_get_user+0xa63/0x1120 drivers/net/tun.c:1909 tun_chr_write_iter+0x65/0xb0 drivers/net/tun.c:1984 vfs_write+0x300/0x420 fs/read_write.c:593 ksys_write+0x60/0xd0 fs/read_write.c:686 do_syscall_64+0x50/0x1c0 arch/x86/entry/syscall_64.c:63 </TASK> To trigger gso segment in udp_queue_rcv_skb(), we should also set option UDP_ENCAP_ESPINUDP to enable udp_sk(sk)->encap_rcv. When the encap_rcv hook return 1 in udp_queue_rcv_one_skb(), udp_csum_pull_header() will try to pull udphdr, but the skb size has been segmented to gso size, which leads to this crash. Previous commit cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") introduces segmentation in UDP receive path only for GRO, which was never intended to be used for UFO, so drop UFO packets in udp_rcv_segment(). Link: https://lore.kernel.org/netdev/20250724083005.3918375-1-wangliang74@huawei.… Link: https://lore.kernel.org/netdev/20250729123907.3318425-1-wangliang74@huawei.… Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") Suggested-by: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250730101458.3470788-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/udp.h | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/include/net/udp.h b/include/net/udp.h index 488a6d2babcc..89eeb187667b 100644 --- a/include/net/udp.h +++ b/include/net/udp.h @@ -466,6 +466,16 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, { netdev_features_t features = NETIF_F_SG; struct sk_buff *segs; + int drop_count; + + /* + * Segmentation in UDP receive path is only for UDP GRO, drop udp + * fragmentation offload (UFO) packets. + */ + if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP) { + drop_count = 1; + goto drop; + } /* Avoid csum recalculation by skb_segment unless userspace explicitly * asks for the final checksum values @@ -489,16 +499,18 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, */ segs = __skb_gso_segment(skb, features, false); if (IS_ERR_OR_NULL(segs)) { - int segs_nr = skb_shinfo(skb)->gso_segs; - - atomic_add(segs_nr, &sk->sk_drops); - SNMP_ADD_STATS(__UDPX_MIB(sk, ipv4), UDP_MIB_INERRORS, segs_nr); - kfree_skb(skb); - return NULL; + drop_count = skb_shinfo(skb)->gso_segs; + goto drop; } consume_skb(skb); return segs; + +drop: + atomic_add(drop_count, &sk->sk_drops); + SNMP_ADD_STATS(__UDPX_MIB(sk, ipv4), UDP_MIB_INERRORS, drop_count); + kfree_skb(skb); + return NULL; } static inline void udp_post_segment_fix_csum(struct sk_buff *skb) -- 2.34.1

2 1

[PATCH OLK-6.6] ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
by Wang Liang 10 Dec '25

10 Dec '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.101 commit 3028f2a4e746b499043bbb8ab816f975473a0535 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUCA2 CVE: CVE-2025-38664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 upstream. Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. Fixes: c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_ddp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c b/drivers/net/ethernet/intel/ice/ice_ddp.c index b27ec93638b6..cd97974b451a 100644 --- a/drivers/net/ethernet/intel/ice/ice_ddp.c +++ b/drivers/net/ethernet/intel/ice/ice_ddp.c @@ -1884,6 +1884,8 @@ enum ice_ddp_state ice_copy_and_init_pkg(struct ice_hw *hw, const u8 *buf, return ICE_DDP_PKG_ERR; buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len, GFP_KERNEL); + if (!buf_copy) + return ICE_DDP_PKG_ERR; state = ice_init_pkg(hw, buf_copy, len); if (!ice_is_init_pkg_successful(state)) { -- 2.34.1

2 1

[PATCH OLK-6.6] ipv6: prevent infinite loop in rt6_nlmsg_size()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.102 commit e1b7932af47f92432be8303d2439d1bf77b0be23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU76G CVE: CVE-2025-38588 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 54e6fe9dd3b0e7c481c2228782c9494d653546da ] While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero. Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250725140725.3626540-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/ip6_fib.c | 4 ++-- net/ipv6/route.c | 34 ++++++++++++++++++---------------- 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index 023ac39041a2..65702bddb21f 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -1240,7 +1240,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; - rt->fib6_nsiblings = 0; + WRITE_ONCE(rt->fib6_nsiblings, 0); list_del_rcu(&rt->fib6_siblings); rt6_multipath_rebalance(next_sibling); return err; @@ -1953,7 +1953,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, list_for_each_entry_safe(sibling, next_sibling, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; - rt->fib6_nsiblings = 0; + WRITE_ONCE(rt->fib6_nsiblings, 0); list_del_rcu(&rt->fib6_siblings); rt6_multipath_rebalance(next_sibling); } diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 53197087353a..41d358dd58c0 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5577,32 +5577,34 @@ static int rt6_nh_nlmsg_size(struct fib6_nh *nh, void *arg) static size_t rt6_nlmsg_size(struct fib6_info *f6i) { + struct fib6_info *sibling; + struct fib6_nh *nh; int nexthop_len; if (f6i->nh) { nexthop_len = nla_total_size(4); /* RTA_NH_ID */ nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size, &nexthop_len); - } else { - struct fib6_nh *nh = f6i->fib6_nh; - struct fib6_info *sibling; - - nexthop_len = 0; - if (f6i->fib6_nsiblings) { - rt6_nh_nlmsg_size(nh, &nexthop_len); - - rcu_read_lock(); + goto common; + } - list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, - fib6_siblings) { - rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); - } + rcu_read_lock(); +retry: + nh = f6i->fib6_nh; + nexthop_len = 0; + if (READ_ONCE(f6i->fib6_nsiblings)) { + rt6_nh_nlmsg_size(nh, &nexthop_len); - rcu_read_unlock(); + list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, + fib6_siblings) { + rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); + if (!READ_ONCE(f6i->fib6_nsiblings)) + goto retry; } - nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); } - + rcu_read_unlock(); + nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); +common: return NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(16) /* RTA_SRC */ + nla_total_size(16) /* RTA_DST */ -- 2.34.1

2 1

[PATCH OLK-6.6] net: phy: Don't register LEDs for genphy
by Wang Liang 10 Dec '25

10 Dec '25

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v6.6.100 commit ec158d05eaa91b2809cab65f8068290e3c05ebdd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTB60 CVE: CVE-2025-38537 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f0f2b992d8185a0366be951685e08643aae17d6d ] If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic. Generic PHYs do not support LEDs anyway, so don't bother registering them. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Link: https://patch.msgid.link/20250707195803.666097-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/phy/phy_device.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index ee43f4dbf6a7..0550c89761f9 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3402,7 +3402,8 @@ static int phy_probe(struct device *dev) /* Get the LEDs from the device tree, and instantiate standard * LEDs for them. */ - if (IS_ENABLED(CONFIG_PHYLIB_LEDS)) + if (IS_ENABLED(CONFIG_PHYLIB_LEDS) && !phy_driver_is_genphy(phydev) && + !phy_driver_is_genphy_10g(phydev)) err = of_phy_leds(phydev); out: @@ -3419,7 +3420,8 @@ static int phy_remove(struct device *dev) cancel_delayed_work_sync(&phydev->state_queue); - if (IS_ENABLED(CONFIG_PHYLIB_LEDS)) + if (IS_ENABLED(CONFIG_PHYLIB_LEDS) && !phy_driver_is_genphy(phydev) && + !phy_driver_is_genphy_10g(phydev)) phy_leds_unregister(phydev); phydev->state = PHY_DOWN; -- 2.34.1

2 1

[PATCH OLK-6.6] ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
by Wang Liang 10 Dec '25

10 Dec '25

From: Yue Haibing <yuehaibing(a)huawei.com> stable inclusion from stable-v6.6.100 commit dcbc346f50a009d8b7f4e330f9f2e22d6442fa26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTB6U CVE: CVE-2025-38550 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ae3264a25a4635531264728859dbe9c659fad554 ] pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return. Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data") Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> Link: https://patch.msgid.link/20250714141957.3301871-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/mcast.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 9bb246c09fce..e153dac47a53 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -803,8 +803,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im) } else { im->mca_crcount = idev->mc_qrv; } - in6_dev_put(pmc->idev); ip6_mc_clear_src(pmc); + in6_dev_put(pmc->idev); kfree_rcu(pmc, rcu); } } -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
by Wang Liang 10 Dec '25

10 Dec '25

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.100 commit 76179961c423cd698080b5e4d5583cf7f4fcdde9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD78 CVE: CVE-2025-38472 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2d72afb340657f03f7261e9243b44457a9228ac7 ] A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP: __nf_ct_delete_from_lists+172] [..] #7 [ff539b5a2b043aa0] nf_ct_delete at ffffffffc124d421 [nf_conntrack] #8 [ff539b5a2b043ad0] nf_ct_gc_expired at ffffffffc124d999 [nf_conntrack] #9 [ff539b5a2b043ae0] __nf_conntrack_find_get at ffffffffc124efbc [nf_conntrack] [..] The nf_conn struct is marked as allocated from slab but appears to be in a partially initialised state: ct hlist pointer is garbage; looks like the ct hash value (hence crash). ct->status is equal to IPS_CONFIRMED|IPS_DYING, which is expected ct->timeout is 30000 (=30s), which is unexpected. Everything else looks like normal udp conntrack entry. If we ignore ct->status and pretend its 0, the entry matches those that are newly allocated but not yet inserted into the hash: - ct hlist pointers are overloaded and store/cache the raw tuple hash - ct->timeout matches the relative time expected for a new udp flow rather than the absolute 'jiffies' value. If it were not for the presence of IPS_CONFIRMED, __nf_conntrack_find_get() would have skipped the entry. Theory is that we did hit following race: cpu x cpu y cpu z found entry E found entry E E is expired <preemption> nf_ct_delete() return E to rcu slab init_conntrack E is re-inited, ct->status set to 0 reply tuplehash hnnode.pprev stores hash value. cpu y found E right before it was deleted on cpu x. E is now re-inited on cpu z. cpu y was preempted before checking for expiry and/or confirm bit. ->refcnt set to 1 E now owned by skb ->timeout set to 30000 If cpu y were to resume now, it would observe E as expired but would skip E due to missing CONFIRMED bit. nf_conntrack_confirm gets called sets: ct->status |= CONFIRMED This is wrong: E is not yet added to hashtable. cpu y resumes, it observes E as expired but CONFIRMED: <resumes> nf_ct_expired() -> yes (ct->timeout is 30s) confirmed bit set. cpu y will try to delete E from the hashtable: nf_ct_delete() -> set DYING bit __nf_ct_delete_from_lists Even this scenario doesn't guarantee a crash: cpu z still holds the table bucket lock(s) so y blocks: wait for spinlock held by z CONFIRMED is set but there is no guarantee ct will be added to hash: "chaintoolong" or "clash resolution" logic both skip the insert step. reply hnnode.pprev still stores the hash value. unlocks spinlock return NF_DROP <unblocks, then crashes on hlist_nulls_del_rcu pprev> In case CPU z does insert the entry into the hashtable, cpu y will unlink E again right away but no crash occurs. Without 'cpu y' race, 'garbage' hlist is of no consequence: ct refcnt remains at 1, eventually skb will be free'd and E gets destroyed via: nf_conntrack_put -> nf_conntrack_destroy -> nf_ct_destroy. To resolve this, move the IPS_CONFIRMED assignment after the table insertion but before the unlock. Pablo points out that the confirm-bit-store could be reordered to happen before hlist add resp. the timeout fixup, so switch to set_bit and before_atomic memory barrier to prevent this. It doesn't matter if other CPUs can observe a newly inserted entry right before the CONFIRMED bit was set: Such event cannot be distinguished from above "E is the old incarnation" case: the entry will be skipped. Also change nf_ct_should_gc() to first check the confirmed bit. The gc sequence is: 1. Check if entry has expired, if not skip to next entry 2. Obtain a reference to the expired entry. 3. Call nf_ct_should_gc() to double-check step 1. nf_ct_should_gc() is thus called only for entries that already failed an expiry check. After this patch, once the confirmed bit check passes ct->timeout has been altered to reflect the absolute 'best before' date instead of a relative time. Step 3 will therefore not remove the entry. Without this change to nf_ct_should_gc() we could still get this sequence: 1. Check if entry has expired. 2. Obtain a reference. 3. Call nf_ct_should_gc() to double-check step 1: 4 - entry is still observed as expired 5 - meanwhile, ct->timeout is corrected to absolute value on other CPU and confirm bit gets set 6 - confirm bit is seen 7 - valid entry is removed again First do check 6), then 4) so the gc expiry check always picks up either confirmed bit unset (entry gets skipped) or expiry re-check failure for re-inited conntrack objects. This change cannot be backported to releases before 5.19. Without commit 8a75a2c17410 ("netfilter: conntrack: remove unconfirmed list") |= IPS_CONFIRMED line cannot be moved without further changes. Cc: Razvan Cojocaru <rzvncj(a)gmail.com> Link: https://lore.kernel.org/netfilter-devel/20250627142758.25664-1-fw@strlen.de/ Link: https://lore.kernel.org/netfilter-devel/4239da15-83ff-4ca4-939d-faef283471b… Fixes: 1397af5bfd7d ("netfilter: conntrack: remove the percpu dying list") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/netfilter/nf_conntrack.h | 15 +++++++++++++-- net/netfilter/nf_conntrack_core.c | 26 ++++++++++++++++++++------ 2 files changed, 33 insertions(+), 8 deletions(-) diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h index f2a2c2c69175..f991f6e523c2 100644 --- a/include/net/netfilter/nf_conntrack.h +++ b/include/net/netfilter/nf_conntrack.h @@ -306,8 +306,19 @@ static inline bool nf_ct_is_expired(const struct nf_conn *ct) /* use after obtaining a reference count */ static inline bool nf_ct_should_gc(const struct nf_conn *ct) { - return nf_ct_is_expired(ct) && nf_ct_is_confirmed(ct) && - !nf_ct_is_dying(ct); + if (!nf_ct_is_confirmed(ct)) + return false; + + /* load ct->timeout after is_confirmed() test. + * Pairs with __nf_conntrack_confirm() which: + * 1. Increases ct->timeout value + * 2. Inserts ct into rcu hlist + * 3. Sets the confirmed bit + * 4. Unlocks the hlist lock + */ + smp_acquire__after_ctrl_dep(); + + return nf_ct_is_expired(ct) && !nf_ct_is_dying(ct); } #define NF_CT_DAY (86400 * HZ) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 34ad5975fbf3..0081c1a0d5e5 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1075,6 +1075,12 @@ static int nf_ct_resolve_clash_harder(struct sk_buff *skb, u32 repl_idx) hlist_nulls_add_head_rcu(&loser_ct->tuplehash[IP_CT_DIR_REPLY].hnnode, &nf_conntrack_hash[repl_idx]); + /* confirmed bit must be set after hlist add, not before: + * loser_ct can still be visible to other cpu due to + * SLAB_TYPESAFE_BY_RCU. + */ + smp_mb__before_atomic(); + set_bit(IPS_CONFIRMED_BIT, &loser_ct->status); NF_CT_STAT_INC(net, clash_resolve); return NF_ACCEPT; @@ -1211,8 +1217,6 @@ __nf_conntrack_confirm(struct sk_buff *skb) * user context, else we insert an already 'dead' hash, blocking * further use of that particular connection -JM. */ - ct->status |= IPS_CONFIRMED; - if (unlikely(nf_ct_is_dying(ct))) { NF_CT_STAT_INC(net, insert_failed); goto dying; @@ -1244,7 +1248,7 @@ __nf_conntrack_confirm(struct sk_buff *skb) } } - /* Timer relative to confirmation time, not original + /* Timeout is relative to confirmation time, not original setting time, otherwise we'd get timer wrap in weird delay cases. */ ct->timeout += nfct_time_stamp; @@ -1252,11 +1256,21 @@ __nf_conntrack_confirm(struct sk_buff *skb) __nf_conntrack_insert_prepare(ct); /* Since the lookup is lockless, hash insertion must be done after - * starting the timer and setting the CONFIRMED bit. The RCU barriers - * guarantee that no other CPU can find the conntrack before the above - * stores are visible. + * setting ct->timeout. The RCU barriers guarantee that no other CPU + * can find the conntrack before the above stores are visible. */ __nf_conntrack_hash_insert(ct, hash, reply_hash); + + /* IPS_CONFIRMED unset means 'ct not (yet) in hash', conntrack lookups + * skip entries that lack this bit. This happens when a CPU is looking + * at a stale entry that is being recycled due to SLAB_TYPESAFE_BY_RCU + * or when another CPU encounters this entry right after the insertion + * but before the set-confirm-bit below. This bit must not be set until + * after __nf_conntrack_hash_insert(). + */ + smp_mb__before_atomic(); + set_bit(IPS_CONFIRMED_BIT, &ct->status); + nf_conntrack_double_unlock(hash, reply_hash); local_bh_enable(); -- 2.34.1

2 1

[openeuler:OLK-5.10 3399/3399] certs/system_keyring.c:42: warning: Function parameter or member 'dest_keyring' not described in 'restrict_link_by_builtin_trusted'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Salvatore, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 68ee705da160d123656dcbf9ebd449fb77b54bc0 [3399/3399] scripts: kernel-doc: Fix syntax error due to undeclared args variable config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100037.0LOqY3GV-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100037.0LOqY3GV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100037.0LOqY3GV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> certs/system_keyring.c:42: warning: Function parameter or member 'dest_keyring' not described in 'restrict_link_by_builtin_trusted' >> certs/system_keyring.c:42: warning: Function parameter or member 'type' not described in 'restrict_link_by_builtin_trusted' >> certs/system_keyring.c:42: warning: Function parameter or member 'payload' not described in 'restrict_link_by_builtin_trusted' >> certs/system_keyring.c:42: warning: Function parameter or member 'restriction_key' not described in 'restrict_link_by_builtin_trusted' >> certs/system_keyring.c:61: warning: Function parameter or member 'dest_keyring' not described in 'restrict_link_by_builtin_and_secondary_trusted' >> certs/system_keyring.c:61: warning: Function parameter or member 'type' not described in 'restrict_link_by_builtin_and_secondary_trusted' >> certs/system_keyring.c:61: warning: Function parameter or member 'payload' not described in 'restrict_link_by_builtin_and_secondary_trusted' >> certs/system_keyring.c:61: warning: Function parameter or member 'restrict_key' not described in 'restrict_link_by_builtin_and_secondary_trusted' -- >> mm/filemap.c:823:14: warning: no previous prototype for '__add_to_page_cache_locked' [-Wmissing-prototypes] 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> mm/truncate.c:543: warning: Function parameter or member 'mapping' not described in 'invalidate_mapping_pagevec' >> mm/truncate.c:543: warning: Function parameter or member 'start' not described in 'invalidate_mapping_pagevec' >> mm/truncate.c:543: warning: Function parameter or member 'end' not described in 'invalidate_mapping_pagevec' >> mm/truncate.c:543: warning: Function parameter or member 'nr_pagevec' not described in 'invalidate_mapping_pagevec' -- >> mm/oom_kill.c:316: warning: Function parameter or member 'task' not described in 'oom_next_task' >> mm/oom_kill.c:316: warning: Function parameter or member 'oc' not described in 'oom_next_task' >> mm/oom_kill.c:316: warning: Function parameter or member 'points' not described in 'oom_next_task' -- >> mm/page_vma_mapped.c:86: warning: Function parameter or member 'pvmw' not described in 'check_pte' -- >> mm/vmalloc.c:3666: warning: Function parameter or member 'pgoff' not described in 'remap_vmalloc_hugepage_range_partial' >> mm/vmalloc.c:3795: warning: Function parameter or member 'align' not described in 'pvm_determine_end_from_reverse' -- >> mm/page_alloc.c:3040:6: warning: no previous prototype for '__drain_all_pages' [-Wmissing-prototypes] 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^~~~~~~~~~~~~~~~~ >> mm/page_alloc.c:3603:15: warning: no previous prototype for 'should_fail_alloc_page' [-Wmissing-prototypes] 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^~~~~~~~~~~~~~~~~~~~~~ >> mm/page_alloc.c:6754:20: warning: no previous prototype for 'memmap_init' [-Wmissing-prototypes] 6754 | void __init __weak memmap_init(void) | ^~~~~~~~~~~ >> mm/page_alloc.c:6792:23: warning: no previous prototype for 'arch_memmap_init' [-Wmissing-prototypes] 6792 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^~~~~~~~~~~~~~~~ >> mm/page_alloc.c:6910:6: warning: no previous prototype for '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] 6910 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> mm/khugepaged.c:102: warning: Function parameter or member 'nr_pte_mapped_thp' not described in 'mm_slot' >> mm/khugepaged.c:102: warning: Function parameter or member 'pte_mapped_thp' not described in 'mm_slot' >> mm/khugepaged.c:1453: warning: Function parameter or member 'mm' not described in 'collapse_pte_mapped_thp' >> mm/khugepaged.c:1453: warning: Function parameter or member 'addr' not described in 'collapse_pte_mapped_thp' >> mm/khugepaged.c:1691: warning: Function parameter or member 'mm' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'file' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'start' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'hpage' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'node' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'reliable' not described in 'collapse_file' -- >> mm/early_ioremap.c:34:24: warning: no previous prototype for 'early_memremap_pgprot_adjust' [-Wmissing-prototypes] 34 | pgprot_t __init __weak early_memremap_pgprot_adjust(resource_size_t phys_addr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> mm/kasan/init.c:232: warning: Function parameter or member 'shadow_start' not described in 'kasan_populate_early_shadow' >> mm/kasan/init.c:232: warning: Function parameter or member 'shadow_end' not described in 'kasan_populate_early_shadow' -- >> fs/open.c:887: warning: Excess function parameter 'opened' description in 'finish_open' >> fs/open.c:929: warning: Excess function parameter 'cred' description in 'vfs_open' .. vim +42 certs/system_keyring.c b56e5a17b6b9acd kernel/system_keyring.c David Howells 2013-08-30 31 a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 32 /** d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 33 * restrict_link_to_builtin_trusted - Restrict keyring addition by built in CA a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 34 * a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 35 * Restrict the addition of keys into a keyring based on the key-to-be-added d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 36 * being vouched for by a key in the built in system keyring. a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 37 */ aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 38 int restrict_link_by_builtin_trusted(struct key *dest_keyring, a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 39 const struct key_type *type, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 40 const union key_payload *payload, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 41 struct key *restriction_key) a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 @42 { aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 43 return restrict_link_by_signature(dest_keyring, type, payload, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 44 builtin_trusted_keys); a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 45 } a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 46 d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 47 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 48 /** d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 49 * restrict_link_by_builtin_and_secondary_trusted - Restrict keyring d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 50 * addition by both builtin and secondary keyrings d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 51 * d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 52 * Restrict the addition of keys into a keyring based on the key-to-be-added d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 53 * being vouched for by a key in either the built-in or the secondary system d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 54 * keyrings. d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 55 */ d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 56 int restrict_link_by_builtin_and_secondary_trusted( aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 57 struct key *dest_keyring, d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 58 const struct key_type *type, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 59 const union key_payload *payload, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 60 struct key *restrict_key) d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 @61 { d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 62 /* If we have a secondary trusted keyring, then that contains a link d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 63 * through to the builtin keyring and the search will follow that link. d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 64 */ d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 65 if (type == &key_type_keyring && aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 66 dest_keyring == secondary_trusted_keys && d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 67 payload == &builtin_trusted_keys->payload) d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 68 /* Allow the builtin keyring to be added to the secondary */ d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 69 return 0; d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 70 aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 71 return restrict_link_by_signature(dest_keyring, type, payload, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 72 secondary_trusted_keys); d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 73 } 2b6aa412ff23a02 certs/system_keyring.c Mat Martineau 2016-08-31 74 :::::: The code at line 42 was first introduced by commit :::::: a511e1af8b12f44c6e55786c463c9f093c214fb6 KEYS: Move the point of trust determination to __key_link() :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: David Howells <dhowells(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3508/3508] include/linux/bitfield.h:165:17: error: call to '__bad_mask' declared with attribute error: bad bitfield mask
by kernel test robot 10 Dec '25

10 Dec '25

Hi Suzuki, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f3072e528ba53a76e66a34613ecc7b86dc96816d commit: 9e76624e89d2d5210d25a33749d8989212945735 [3508/3508] [v8-28-43]arm64: RME: Allow checking SVE on VM instance config: arm64-randconfig-001-20251210 (https://download.01.org/0day-ci/archive/20251210/202512100623.1pjIPxzS-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100623.1pjIPxzS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100623.1pjIPxzS-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/arm64/include/asm/sysreg.h:1065, from arch/arm64/include/asm/percpu.h:13, from arch/arm64/include/asm/smp.h:28, from include/linux/smp.h:113, from include/linux/percpu.h:7, from include/linux/context_tracking_state.h:5, from include/linux/hardirq.h:5, from include/linux/kvm_host.h:7, from arch/arm64/kvm/rme.c:6: In function 'field_multiplier', inlined from 'u64_get_bits' at include/linux/bitfield.h:201:1, inlined from 'rme_has_feature' at arch/arm64/kvm/rme.c:38:11: >> include/linux/bitfield.h:165:17: error: call to '__bad_mask' declared with attribute error: bad bitfield mask 165 | __bad_mask(); | ^~~~~~~~~~~~ vim +/__bad_mask +165 include/linux/bitfield.h e2192de59e457ae Johannes Berg 2023-01-18 119 e2192de59e457ae Johannes Berg 2023-01-18 120 /** e2192de59e457ae Johannes Berg 2023-01-18 121 * FIELD_PREP_CONST() - prepare a constant bitfield element e2192de59e457ae Johannes Berg 2023-01-18 122 * @_mask: shifted mask defining the field's length and position e2192de59e457ae Johannes Berg 2023-01-18 123 * @_val: value to put in the field e2192de59e457ae Johannes Berg 2023-01-18 124 * e2192de59e457ae Johannes Berg 2023-01-18 125 * FIELD_PREP_CONST() masks and shifts up the value. The result should e2192de59e457ae Johannes Berg 2023-01-18 126 * be combined with other fields of the bitfield using logical OR. e2192de59e457ae Johannes Berg 2023-01-18 127 * e2192de59e457ae Johannes Berg 2023-01-18 128 * Unlike FIELD_PREP() this is a constant expression and can therefore e2192de59e457ae Johannes Berg 2023-01-18 129 * be used in initializers. Error checking is less comfortable for this e2192de59e457ae Johannes Berg 2023-01-18 130 * version, and non-constant masks cannot be used. e2192de59e457ae Johannes Berg 2023-01-18 131 */ e2192de59e457ae Johannes Berg 2023-01-18 132 #define FIELD_PREP_CONST(_mask, _val) \ e2192de59e457ae Johannes Berg 2023-01-18 133 ( \ e2192de59e457ae Johannes Berg 2023-01-18 134 /* mask must be non-zero */ \ e2192de59e457ae Johannes Berg 2023-01-18 135 BUILD_BUG_ON_ZERO((_mask) == 0) + \ e2192de59e457ae Johannes Berg 2023-01-18 136 /* check if value fits */ \ e2192de59e457ae Johannes Berg 2023-01-18 137 BUILD_BUG_ON_ZERO(~((_mask) >> __bf_shf(_mask)) & (_val)) + \ e2192de59e457ae Johannes Berg 2023-01-18 138 /* check if mask is contiguous */ \ e2192de59e457ae Johannes Berg 2023-01-18 139 __BF_CHECK_POW2((_mask) + (1ULL << __bf_shf(_mask))) + \ e2192de59e457ae Johannes Berg 2023-01-18 140 /* and create the value */ \ e2192de59e457ae Johannes Berg 2023-01-18 141 (((typeof(_mask))(_val) << __bf_shf(_mask)) & (_mask)) \ e2192de59e457ae Johannes Berg 2023-01-18 142 ) e2192de59e457ae Johannes Berg 2023-01-18 143 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 144 /** 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 145 * FIELD_GET() - extract a bitfield element 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 146 * @_mask: shifted mask defining the field's length and position 7240767450d6d83 Masahiro Yamada 2017-10-03 147 * @_reg: value of entire bitfield 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 148 * 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 149 * FIELD_GET() extracts the field specified by @_mask from the 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 150 * bitfield passed in as @_reg by masking and shifting it down. 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 151 */ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 152 #define FIELD_GET(_mask, _reg) \ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 153 ({ \ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 154 __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 155 (typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask)); \ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 156 }) 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 157 e7d4a95da86e0b0 Johannes Berg 2018-06-20 158 extern void __compiletime_error("value doesn't fit into mask") 00b0c9b82663ac4 Al Viro 2017-12-14 159 __field_overflow(void); 00b0c9b82663ac4 Al Viro 2017-12-14 160 extern void __compiletime_error("bad bitfield mask") 00b0c9b82663ac4 Al Viro 2017-12-14 161 __bad_mask(void); 00b0c9b82663ac4 Al Viro 2017-12-14 162 static __always_inline u64 field_multiplier(u64 field) 00b0c9b82663ac4 Al Viro 2017-12-14 163 { 00b0c9b82663ac4 Al Viro 2017-12-14 164 if ((field | (field - 1)) & ((field | (field - 1)) + 1)) 00b0c9b82663ac4 Al Viro 2017-12-14 @165 __bad_mask(); 00b0c9b82663ac4 Al Viro 2017-12-14 166 return field & -field; 00b0c9b82663ac4 Al Viro 2017-12-14 167 } 00b0c9b82663ac4 Al Viro 2017-12-14 168 static __always_inline u64 field_mask(u64 field) 00b0c9b82663ac4 Al Viro 2017-12-14 169 { 00b0c9b82663ac4 Al Viro 2017-12-14 170 return field / field_multiplier(field); 00b0c9b82663ac4 Al Viro 2017-12-14 171 } e31a50162feb352 Alex Elder 2020-03-12 172 #define field_max(field) ((typeof(field))field_mask(field)) 00b0c9b82663ac4 Al Viro 2017-12-14 173 #define ____MAKE_OP(type,base,to,from) \ 00b0c9b82663ac4 Al Viro 2017-12-14 174 static __always_inline __##type type##_encode_bits(base v, base field) \ 00b0c9b82663ac4 Al Viro 2017-12-14 175 { \ e7d4a95da86e0b0 Johannes Berg 2018-06-20 176 if (__builtin_constant_p(v) && (v & ~field_mask(field))) \ 00b0c9b82663ac4 Al Viro 2017-12-14 177 __field_overflow(); \ 00b0c9b82663ac4 Al Viro 2017-12-14 178 return to((v & field_mask(field)) * field_multiplier(field)); \ 00b0c9b82663ac4 Al Viro 2017-12-14 179 } \ 00b0c9b82663ac4 Al Viro 2017-12-14 180 static __always_inline __##type type##_replace_bits(__##type old, \ 00b0c9b82663ac4 Al Viro 2017-12-14 181 base val, base field) \ 00b0c9b82663ac4 Al Viro 2017-12-14 182 { \ 00b0c9b82663ac4 Al Viro 2017-12-14 183 return (old & ~to(field)) | type##_encode_bits(val, field); \ 00b0c9b82663ac4 Al Viro 2017-12-14 184 } \ 00b0c9b82663ac4 Al Viro 2017-12-14 185 static __always_inline void type##p_replace_bits(__##type *p, \ 00b0c9b82663ac4 Al Viro 2017-12-14 186 base val, base field) \ 00b0c9b82663ac4 Al Viro 2017-12-14 187 { \ 00b0c9b82663ac4 Al Viro 2017-12-14 188 *p = (*p & ~to(field)) | type##_encode_bits(val, field); \ 00b0c9b82663ac4 Al Viro 2017-12-14 189 } \ 00b0c9b82663ac4 Al Viro 2017-12-14 190 static __always_inline base type##_get_bits(__##type v, base field) \ 00b0c9b82663ac4 Al Viro 2017-12-14 191 { \ 00b0c9b82663ac4 Al Viro 2017-12-14 192 return (from(v) & field)/field_multiplier(field); \ 00b0c9b82663ac4 Al Viro 2017-12-14 193 } 00b0c9b82663ac4 Al Viro 2017-12-14 194 #define __MAKE_OP(size) \ 00b0c9b82663ac4 Al Viro 2017-12-14 195 ____MAKE_OP(le##size,u##size,cpu_to_le##size,le##size##_to_cpu) \ 00b0c9b82663ac4 Al Viro 2017-12-14 196 ____MAKE_OP(be##size,u##size,cpu_to_be##size,be##size##_to_cpu) \ 00b0c9b82663ac4 Al Viro 2017-12-14 197 ____MAKE_OP(u##size,u##size,,) 37a3862e1238262 Johannes Berg 2018-06-20 198 ____MAKE_OP(u8,u8,,) 00b0c9b82663ac4 Al Viro 2017-12-14 199 __MAKE_OP(16) 00b0c9b82663ac4 Al Viro 2017-12-14 200 __MAKE_OP(32) 00b0c9b82663ac4 Al Viro 2017-12-14 201 __MAKE_OP(64) 00b0c9b82663ac4 Al Viro 2017-12-14 202 #undef __MAKE_OP 00b0c9b82663ac4 Al Viro 2017-12-14 203 #undef ____MAKE_OP 00b0c9b82663ac4 Al Viro 2017-12-14 204 :::::: The code at line 165 was first introduced by commit :::::: 00b0c9b82663ac42e5a09f58ce960f81f29d64ee Add primitives for manipulating bitfields both in host- and fixed-endian. :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: arch/x86/kernel/cpu/resctrl/monitor.c references a file that doesn't exist: Documentation/x86/resctrl.rst
by kernel test robot 10 Dec '25

10 Dec '25

Hi Fenghua, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: a6c0245e15d65203dbe3b21d47e8618b4444bf27 [3398/3398] x86/resctrl: Correct MBM total and local values reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092256.qjUEQ2Ay-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092256.qjUEQ2Ay-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: MAINTAINERS references a file that doesn't exist: Documentation/x86/amd_hsmp.rst Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/pinctrl/toshiba,tmpv7700-pinctrl.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst >> Warning: arch/x86/kernel/cpu/resctrl/monitor.c references a file that doesn't exist: Documentation/x86/resctrl.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 ./Documentation/ABI/testing/sysfs-bus-iio:394 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 0378ac5f333ca75e4fae5a8a8ed499ed374f3bdd [3398/3398] net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092215.R7vj8ToZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092215.R7vj8ToZ-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst >> Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 ./Documentation/ABI/testing/sysfs-bus-iio:394 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:1 ./Documentation/ABI/testing/sysfs-bus-iio:395 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_z_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:2 ./Documentation/ABI/testing/sysfs-bus-iio:396 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:3 ./Documentation/ABI/testing/sysfs-bus-iio:397 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:4 ./Documentation/ABI/testing/sysfs-bus-iio:398 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: d48b7d951d22f7f97d68ae7b580769827683d404 [3398/3398] drivers: initial support for xsc drivers from Yunsilicon Technology reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092129.rSRtn0GX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092129.rSRtn0GX-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst >> Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 ./Documentation/ABI/testing/sysfs-bus-iio:394 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:1 ./Documentation/ABI/testing/sysfs-bus-iio:395 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_z_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:2 ./Documentation/ABI/testing/sysfs-bus-iio:396 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:3 ./Documentation/ABI/testing/sysfs-bus-iio:397 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: The Sphinx 'sphinx_rtd_theme' HTML theme was not found. Make sure you have the theme installed to produce pretty HTML output. Falling back to the default theme.
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 9ecc6f98e74d5553122ee564caa72dd2a1abf9ff [3398/3398] docs: Fix the docs build with Sphinx 6.0 reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092104.D3gEhdzh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092104.D3gEhdzh-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: /sys/class/leds/<led>/repeat is defined 2 times: ./Documentation/ABI/testing/sysfs-class-led-trigger-pattern:28 ./Documentation/ABI/testing/sysfs-class-led-driver-el15203000:0 Warning: /sys/kernel/iommu_groups/reserved_regions is defined 2 times: ./Documentation/ABI/testing/sysfs-kernel-iommu_groups:15 ./Documentation/ABI/testing/sysfs-kernel-iommu_groups:27 WARNING: The kernel documentation build process support for Sphinx v3.0 and above is brand new. Be prepared for possible issues in the generated output. >> Warning: The Sphinx 'sphinx_rtd_theme' HTML theme was not found. Make sure you have the theme installed to produce pretty HTML output. Falling back to the default theme. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 8dbec732f16ae6510354065536da591114ec83ab [3398/3398] irqchip: Add LoongArch CPU interrupt controller support reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092124.8pmDXxxf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092124.8pmDXxxf-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt >> Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 ./Documentation/ABI/testing/sysfs-bus-iio:394 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:1 ./Documentation/ABI/testing/sysfs-bus-iio:395 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_z_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:2 ./Documentation/ABI/testing/sysfs-bus-iio:396 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:3 ./Documentation/ABI/testing/sysfs-bus-iio:397 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:4 ./Documentation/ABI/testing/sysfs-bus-iio:398 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: MAINTAINERS references a file that doesn't exist: Documentation/x86/amd_hsmp.rst
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 2970038b4fbf5aee2a666769d676f01dc74fe7c9 [3398/3398] platform/x86: Add AMD system management interface reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092005.eZ34Xp2b-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092005.eZ34Xp2b-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: Documentation/arm/booting.rst references a file that doesn't exist: Documentation/devicetree/booting-without-of.rst Warning: Documentation/devicetree/bindings/regulator/rohm,bd9576-regulator.yaml references a file that doesn't exist: Documentation/devicetree/bindings/mfd/rohm,bd9576-pmic.yaml Warning: Documentation/translations/zh_CN/arm/Booting references a file that doesn't exist: Documentation/devicetree/booting-without-of.rst >> Warning: MAINTAINERS references a file that doesn't exist: Documentation/x86/amd_hsmp.rst Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/pinctrl/toshiba,tmpv7700-pinctrl.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3399/3399] versioncheck: ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: b9d65551a3adfa87a7c5d33391187ee60a1b501d [3399/3399] drm: add inspur drm driver support reproduce: (https://download.01.org/0day-ci/archive/20251209/202512091544.uZcPctXl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091544.uZcPctXl-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* \( -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git \) -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. >> ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h >> ./drivers/gpu/drm/inspur/inspur_drm_drv.c: 456: need linux/version.h ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 12 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 19 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] versioncheck: ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed.
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 01e6e2075c432fde7fb5a66202b41bbd469de620 [3398/3398] Net: m1600: Add m1600-driver for nebula-matrix m1600 series smart NIC. reproduce: (https://download.01.org/0day-ci/archive/20251209/202512091533.OSoO5rbE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091533.OSoO5rbE-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* \( -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git \) -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. >> ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 19 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] start_kernel: Add __no_stack_protector function attribute
by Lin Yujun 09 Dec '25

09 Dec '25

From: "ndesaulniers(a)google.com" <ndesaulniers(a)google.com> mainline inclusion from mainline-v6.5-rc1 commit 514ca14ed5444b911de59ed3381dfd195d99fe4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RFA CVE: CVE-2023-53491 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Back during the discussion of commit a9a3ed1eff36 ("x86: Fix early boot crash on gcc-10, third try") we discussed the need for a function attribute to control the omission of stack protectors on a per-function basis; at the time Clang had support for no_stack_protector but GCC did not. This was fixed in gcc-11. Now that the function attribute is available, let's start using it. Callers of boot_init_stack_canary need to use this function attribute unless they're compiled with -fno-stack-protector, otherwise the canary stored in the stack slot of the caller will differ upon the call to boot_init_stack_canary. This will lead to a call to __stack_chk_fail() then panic. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94722 Link: https://lore.kernel.org/all/20200316130414.GC12561@hirez.programming.kicks-… Tested-by: Nathan Chancellor <nathan(a)kernel.org> Acked-by: Michael Ellerman <mpe(a)ellerman.id.au> (powerpc) Acked-by: Miguel Ojeda <ojeda(a)kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com> Link: https://lore.kernel.org/r/20230412-no_stackp-v2-1-116f9fe4bbe7@google.com Signed-off-by: Josh Poimboeuf <jpoimboe(a)kernel.org> Signed-off-by: ndesaulniers(a)google.com <ndesaulniers(a)google.com> Conflicts: arch/powerpc/kernel/smp.c include/linux/compiler_attributes.h init/main.c [fix context conflicts] Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 3 ++- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c index b12e4437bf0a..f3fea3928efc 100644 --- a/arch/powerpc/kernel/smp.c +++ b/arch/powerpc/kernel/smp.c @@ -1467,10 +1467,11 @@ static void add_cpu_to_masks(int cpu) free_cpumask_var(mask); } /* Activate a secondary processor. */ +__no_stack_protector void start_secondary(void *unused) { unsigned int cpu = raw_smp_processor_id(); mmgrab(&init_mm); diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h index 08eb06301791..6f495fca9d79 100644 --- a/include/linux/compiler_attributes.h +++ b/include/linux/compiler_attributes.h @@ -249,10 +249,22 @@ * clang: https://clang.llvm.org/docs/AttributeReference.html#noreturn * clang: https://clang.llvm.org/docs/AttributeReference.html#id1 */ #define __noreturn __attribute__((__noreturn__)) +/* + * Optional: only supported since GCC >= 11.1, clang >= 7.0. + * + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-no… + * clang: https://clang.llvm.org/docs/AttributeReference.html#no-stack-protector-safe… + */ +#if __has_attribute(__no_stack_protector__) +# define __no_stack_protector __attribute__((__no_stack_protector__)) +#else +# define __no_stack_protector +#endif + /* * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-packed… * clang: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-pa… */ #define __packed __attribute__((__packed__)) diff --git a/init/main.c b/init/main.c index 2b466bd04110..5d73bd096bd0 100644 --- a/init/main.c +++ b/init/main.c @@ -872,11 +872,12 @@ early_param("randomize_kstack_offset", early_randomize_kstack_offset); void __init __weak arch_call_rest_init(void) { rest_init(); } -asmlinkage __visible void __init __no_sanitize_address start_kernel(void) +asmlinkage __visible __init __no_sanitize_address __noreturn __no_stack_protector +void start_kernel(void) { char *command_line; char *after_dashes; set_task_stack_end_magic(&init_task); -- 2.34.1

2 1

[PATCH OLK-6.6 00/14] Fix incorrect use of cpuhp_remove_multi_state parameter
by Yushan Wang 09 Dec '25

09 Dec '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDBQ74 ---------------------------------------------------------------------- Yifan Wu (3): soc_cache: Fix incorrect use of cpuhp_remove_multi_state parameter soc_cache: Fix error code returning from hisi_soc_l3c_do_lock soc_cache: Fix component removal order to avoid race condition Yushan Wang (10): soc cache: cleanup: replace dynamically allocated param with local variable soc cache: cleanup: fix memory leakage on error path soc cache: cleanup: move judgement of soc cache dev into lock protection soc cache: cleanup: avoid tag addr from interfering range validation soc cache: cleanup: Change type of mnt_type soc cache: cleanup: Remove the redundant check of vm_pgoff soc cache: Check address while walking pages soc cache: fix walk page parameter and drop incorrect check soc cache: Drop redundant vm_pgoff soc cache: Don't poll before removing all locks .../soc/hisilicon/hisi_soc_cache_framework.c | 65 ++++++++----------- drivers/soc/hisilicon/hisi_soc_l3c.c | 13 ++-- 2 files changed, 31 insertions(+), 47 deletions(-) -- 2.33.0

2 15

[PATCH 00/14] Fix incorrect use of cpuhp_remove_multi_state parameter
by Yushan Wang 09 Dec '25

09 Dec '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDBQ74 ---------------------------------------------------------------------- Yifan Wu (3): soc_cache: Fix incorrect use of cpuhp_remove_multi_state parameter soc_cache: Fix error code returning from hisi_soc_l3c_do_lock soc_cache: Fix component removal order to avoid race condition Yushan Wang (10): soc cache: cleanup: replace dynamically allocated param with local variable soc cache: cleanup: fix memory leakage on error path soc cache: cleanup: move judgement of soc cache dev into lock protection soc cache: cleanup: avoid tag addr from interfering range validation soc cache: cleanup: Change type of mnt_type soc cache: cleanup: Remove the redundant check of vm_pgoff soc cache: Check address while walking pages soc cache: fix walk page parameter and drop incorrect check soc cache: Drop redundant vm_pgoff soc cache: Don't poll before removing all locks .../soc/hisilicon/hisi_soc_cache_framework.c | 65 ++++++++----------- drivers/soc/hisilicon/hisi_soc_l3c.c | 13 ++-- 2 files changed, 31 insertions(+), 47 deletions(-) -- 2.33.0

1 14

[PATCH OLK-6.6 0/3] Some bugfixes for interference
by Tengda Wu 09 Dec '25

09 Dec '25

This small patch series addresses some interference issues. Tengda Wu (3): interference: Add fallback to sched_clock when TSC is unavailable interference: Fix missing interference.stat file in v1 hierarchy interference: add version compatibility check between subsystem and cgroup include/linux/cgroup.h | 25 ++++++++++++++------- kernel/cgroup/ifs.c | 51 +++++++++++++++++++++++++++++------------- 2 files changed, 53 insertions(+), 23 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/2] CVE-2023-53491 v3
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2023-53491 v2
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[openeuler:OLK-6.6 3493/3493] mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static?
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0189df7df2ef7f7dbbabf7ff8398e45adf306e24 commit: cf98ffbc116bc49dc4506c68e20b02e26519ad35 [3493/3493] mm/dynamic_pool: fill dpool with pagelist config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091544.YzqAeHFm-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091544.YzqAeHFm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091544.YzqAeHFm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/dynamic_pool.c:999:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_pool.c:999:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_pool.c:999:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * >> mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static? vim +/pagelist_dpool_ops +1577 mm/dynamic_pool.c 1576 > 1577 struct dynamic_pool_ops pagelist_dpool_ops = { 1578 .fill_pool = dpool_fill_from_pagelist, 1579 .drain_pool = dpool_drain_to_pagelist, 1580 .restore_pool = dpool_migrate_used_pages, 1581 }; 1582 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net/oenetcls: Prioritize oenetcls hooks over rps
by Yue Haibing 09 Dec '25

09 Dec '25

hulk inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/ICBFCS -------------------------------- Prioritize oenetcls hooks over rps, clean up unnecessary oecls_rps goto statements. Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/core/dev.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index df6c0ac02a5e..372bab73b8bf 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5890,11 +5890,15 @@ static int netif_receive_skb_internal(struct sk_buff *skb) return NET_RX_SUCCESS; rcu_read_lock(); -#ifdef CONFIG_RPS #if IS_ENABLED(CONFIG_OENETCLS) - if (static_branch_unlikely(&oecls_rps_needed)) - goto oecls_rps; + if (static_branch_unlikely(&oecls_rps_needed)) { + if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { + rcu_read_unlock(); + return ret; + } + } #endif +#ifdef CONFIG_RPS if (static_branch_unlikely(&rps_needed)) { struct rps_dev_flow voidflow, *rflow = &voidflow; int cpu = get_rps_cpu(skb->dev, skb, &rflow); @@ -5906,15 +5910,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb) } } #endif - -#if IS_ENABLED(CONFIG_OENETCLS) -oecls_rps: - if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { - rcu_read_unlock(); - return ret; - } -#endif - ret = __netif_receive_skb(skb); rcu_read_unlock(); return ret; @@ -5935,11 +5930,11 @@ static void netif_receive_skb_list_internal(struct list_head *head) list_splice_init(&sublist, head); rcu_read_lock(); -#ifdef CONFIG_RPS #if IS_ENABLED(CONFIG_OENETCLS) if (static_branch_unlikely(&oecls_rps_needed)) - goto oecls_rps_list; + oenetcls_skblist_set_cpu(head, enqueue_to_backlog); #endif +#ifdef CONFIG_RPS if (static_branch_unlikely(&rps_needed)) { list_for_each_entry_safe(skb, next, head, list) { struct rps_dev_flow voidflow, *rflow = &voidflow; @@ -5953,12 +5948,6 @@ static void netif_receive_skb_list_internal(struct list_head *head) } } #endif - -#if IS_ENABLED(CONFIG_OENETCLS) -oecls_rps_list: - oenetcls_skblist_set_cpu(head, enqueue_to_backlog); -#endif - __netif_receive_skb_list(head); rcu_read_unlock(); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-53491
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Bugfix for two issues
by Liu Mingrui 09 Dec '25

09 Dec '25

Bugfix for the following two issues Liu Mingrui (2): zcopy: Fix NULL pointer dereference while attach conflict with free zcopy: Fix softlockup while attach PUD-SIZE page drivers/misc/zcopy/zcopy.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10 0/3] Bugfix for three issues
by Liu Mingrui 09 Dec '25

09 Dec '25

Bugfix for the following issues: Liu Mingrui (3): zcopy: Fix invalid paging request while attach transhugepage to same addr zcopy: Fix softlockup while attach PUD-SIZE page zcopy: Fix NULL pointer dereference while attach conflict with free drivers/misc/zcopy/zcopy.c | 104 +++++++++++++++---------------------- 1 file changed, 42 insertions(+), 62 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] Bluetooth: hci_event: call disconnect callback before deleting conn
by Wang Liang 09 Dec '25

09 Dec '25

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v6.5-rc3 commit 7f7cfcb6f0825652973b780f248603e23f16ee90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIH CVE: CVE-2023-53673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn without hci_conn_get, so disconn_cfm must be called so they can clean up their conn, otherwise use-after-free occurs. ISO: ========================================================== iso_sock_connect:880: sk 00000000eabd6557 iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073 hci_dev_put:1487: hci0 orig refcnt 17 __iso_chan_add:214: conn 00000000b6251073 iso_sock_clear_timer:117: sock 00000000eabd6557 state 3 ... hci_rx_work:4085: hci0 Event packet hci_event_packet:7601: hci0: event 0x0f hci_cmd_status_evt:4346: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3107: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon 000000001696f1fd handle 2560 hci_conn_unlink:1102: hci0: hcon 000000001696f1fd hci_conn_drop:1451: hcon 00000000d8521aaf orig refcnt 2 hci_chan_list_flush:2780: hcon 000000001696f1fd hci_dev_put:1487: hci0 orig refcnt 21 hci_dev_put:1487: hci0 orig refcnt 20 hci_req_cmd_complete:3978: opcode 0x0406 status 0x0c ... <no iso_* activity on sk/conn> ... iso_sock_sendmsg:1098: sock 00000000dea5e2e0, sk 00000000eabd6557 BUG: kernel NULL pointer dereference, address: 0000000000000668 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg (net/bluetooth/iso.c:1112) bluetooth ========================================================== L2CAP: ================================================================== hci_cmd_status_evt:4359: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3085: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon ffff88800c999000 handle 3585 hci_conn_unlink:1102: hci0: hcon ffff88800c999000 hci_chan_list_flush:2780: hcon ffff88800c999000 hci_chan_del:2761: hci0 hcon ffff88800c999000 chan ffff888018ddd280 ... BUG: KASAN: slab-use-after-free in hci_send_acl+0x2d/0x540 [bluetooth] Read of size 8 at addr ffff888018ddd298 by task bluetoothd/1175 CPU: 0 PID: 1175 Comm: bluetoothd Tainted: G E 6.4.0-rc4+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xf8/0x180 ? hci_send_acl+0x2d/0x540 [bluetooth] kasan_report+0xa8/0xe0 ? hci_send_acl+0x2d/0x540 [bluetooth] hci_send_acl+0x2d/0x540 [bluetooth] ? __pfx___lock_acquire+0x10/0x10 l2cap_chan_send+0x1fd/0x1300 [bluetooth] ? l2cap_sock_sendmsg+0xf2/0x170 [bluetooth] ? __pfx_l2cap_chan_send+0x10/0x10 [bluetooth] ? lock_release+0x1d5/0x3c0 ? mark_held_locks+0x1a/0x90 l2cap_sock_sendmsg+0x100/0x170 [bluetooth] sock_write_iter+0x275/0x280 ? __pfx_sock_write_iter+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 do_iter_readv_writev+0x176/0x220 ? __pfx_do_iter_readv_writev+0x10/0x10 ? find_held_lock+0x83/0xa0 ? selinux_file_permission+0x13e/0x210 do_iter_write+0xda/0x340 vfs_writev+0x1b4/0x400 ? __pfx_vfs_writev+0x10/0x10 ? __seccomp_filter+0x112/0x750 ? populate_seccomp_data+0x182/0x220 ? __fget_light+0xdf/0x100 ? do_writev+0x19d/0x210 do_writev+0x19d/0x210 ? __pfx_do_writev+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0x60/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 ? do_syscall_64+0x6c/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7ff45cb23e64 Code: 15 d1 1f 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d 9d a7 0d 00 00 74 13 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff21ae09b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ff45cb23e64 RDX: 0000000000000001 RSI: 00007fff21ae0aa0 RDI: 0000000000000017 RBP: 00007fff21ae0aa0 R08: 000000000095a8a0 R09: 0000607000053f40 R10: 0000000000000001 R11: 0000000000000202 R12: 00007fff21ae0ac0 R13: 00000fffe435c150 R14: 00007fff21ae0a80 R15: 000060f000000040 </TASK> Allocated by task 771: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0xaa/0xb0 hci_chan_create+0x67/0x1b0 [bluetooth] l2cap_conn_add.part.0+0x17/0x590 [bluetooth] l2cap_connect_cfm+0x266/0x6b0 [bluetooth] hci_le_remote_feat_complete_evt+0x167/0x310 [bluetooth] hci_event_packet+0x38d/0x800 [bluetooth] hci_rx_work+0x287/0xb20 [bluetooth] process_one_work+0x4f7/0x970 worker_thread+0x8f/0x620 kthread+0x17f/0x1c0 ret_from_fork+0x2c/0x50 Freed by task 771: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 ____kasan_slab_free+0x169/0x1c0 slab_free_freelist_hook+0x9e/0x1c0 __kmem_cache_free+0xc0/0x310 hci_chan_list_flush+0x46/0x90 [bluetooth] hci_conn_cleanup+0x7d/0x330 [bluetooth] hci_cs_disconnect+0x35d/0x530 [bluetooth] hci_cmd_status_evt+0xef/0x2b0 [bluetooth] hci_event_packet+0x38d/0x800 [bluetooth] hci_rx_work+0x287/0xb20 [bluetooth] process_one_work+0x4f7/0x970 worker_thread+0x8f/0x620 kthread+0x17f/0x1c0 ret_from_fork+0x2c/0x50 ================================================================== Fixes: b8d290525e39 ("Bluetooth: clean up connection in hci_cs_disconnect") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_event.c [conflicts due to not merge 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/hci_event.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 037f923b433b..509ec9fd4865 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2286,6 +2286,9 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) mgmt_disconnect_failed(hdev, &conn->dst, conn->type, conn->dst_type, status); + /* Inform sockets conn is gone before we delete it */ + hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED); + /* If the disconnection failed for any reason, the upper layer * does not retry to disconnect in current implementation. * Hence, we need to do some basic cleanup here and re-enable -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: Fix hci_suspend_sync crash
by Wang Liang 09 Dec '25

09 Dec '25

From: Ying Hsu <yinghsu(a)chromium.org> mainline inclusion from mainline-v6.6-rc1 commit 573ebae162111063eedc6c838a659ba628f66a0f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RG9 CVE: CVE-2023-53520 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier may still be accessing it, it can cause the program to crash. Here's the call trace: <4>[102152.653246] Call Trace: <4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth] <4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth] <4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth] <4>[102152.653268] notifier_call_chain+0x43/0x6b <4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69 <4>[102152.653273] __pm_notifier_call_chain+0x22/0x39 <4>[102152.653276] pm_suspend+0x287/0x57c <4>[102152.653278] state_store+0xae/0xe5 <4>[102152.653281] kernfs_fop_write+0x109/0x173 <4>[102152.653284] __vfs_write+0x16f/0x1a2 <4>[102152.653287] ? selinux_file_permission+0xca/0x16f <4>[102152.653289] ? security_file_permission+0x36/0x109 <4>[102152.653291] vfs_write+0x114/0x21d <4>[102152.653293] __x64_sys_write+0x7b/0xdb <4>[102152.653296] do_syscall_64+0x59/0x194 <4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 This patch holds the reference count of the hci_dev object while processing it in hci_suspend_notifier to avoid potential crash caused by the race condition. Signed-off-by: Ying Hsu <yinghsu(a)chromium.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_core.c [conflicts due to not merge e1b77d68feea ("Bluetooth: Make use of hci_{suspend,resume}_dev on suspend notifier")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/hci_core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 0a517bdf2de6..e3b98fd6e1f3 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3559,6 +3559,9 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, goto done; } + /* To avoid a potential race with hci_unregister_dev. */ + hci_dev_hold(hdev); + /* Suspend notifier should only act on events when powered. */ if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_UNREGISTER)) @@ -3602,6 +3605,7 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d", action, ret); + hci_dev_put(hdev); return NOTIFY_DONE; } -- 2.34.1

2 1

[PATCH OLK-5.10] net/smc: fix UAF on smcsk after smc_listen_out()
by Wang Liang 09 Dec '25

09 Dec '25

From: "D. Wythe" <alibuda(a)linux.alibaba.com> mainline inclusion from mainline-v6.17-rc3 commit d9cef55ed49117bd63695446fb84b4b91815c0b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWO2I CVE: CVE-2025-38734 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] <TASK > [ 16.456989] ? __die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ? exc_page_fault+0x68/0x20 0 [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0 [ 16.458389] ? smc_listen_work+0xc02/0x159 0 [ 16.458689] ? smc_listen_work+0xc02/0x159 0 [ 16.458987] ? lock_is_held_type+0x8f/0x10 0 [ 16.459284] process_one_work+0x1ea/0x6d 0 [ 16.459570] worker_thread+0x1c3/0x38 0 [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? __pfx_kthread+0x10/0x1 0 [ 16.460640] ret_from_fork+0x31/0x5 0 [ 16.460896] ? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590 The direct cause of this issue is that after smc_listen_out_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows: smc_listen_work | userspace ----------------------------------------------------------------- lock_sock(sk) | smc_listen_out_connected() | | \- smc_listen_out | | | \- release_sock | | |- sk->sk_data_ready() | | fd = accept(); | close(fd); | \- socket->sk = NULL; /* newclcsock->sk is NULL now */ SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk)) Since smc_listen_out_connected() will not fail, simply swapping the order of the code can easily fix this issue. Fixes: 3b2dec2603d5 ("net/smc: restructure client and server code in af_smc") Signed-off-by: D. Wythe <alibuda(a)linux.alibaba.com> Reviewed-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Alexandra Winter <wintera(a)linux.ibm.com> Reviewed-by: Dust Li <dust.li(a)linux.alibaba.com> Link: https://patch.msgid.link/20250818054618.41615-1-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/smc/af_smc.c [conflicts due to not merge 194730a9beb5 ("net/smc: Make SMC statistics network namespace aware")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/af_smc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 9cd508208a0d..9d4c58b09505 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2492,8 +2492,9 @@ static void smc_listen_work(struct work_struct *work) goto out_decl; } - smc_listen_out_connected(new_smc); SMC_STAT_SERV_SUCC_INC(ini); + /* smc_listen_out() will release smcsk */ + smc_listen_out_connected(new_smc); goto out_free; out_unlock: -- 2.34.1

2 1

[PATCH OLK-5.10] i40e: remove read access to debugfs files
by Wang Liang 09 Dec '25

09 Dec '25

From: Jacob Keller <jacob.e.keller(a)intel.com> mainline inclusion from mainline-v6.17-rc5 commit 9fcdb1c3c4ba134434694c001dbff343f1ffa319 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0R34 CVE: CVE-2025-39901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The 'command' and 'netdev_ops' debugfs files are a legacy debugging interface supported by the i40e driver since its early days by commit 02e9c290814c ("i40e: debugfs interface"). Both of these debugfs files provide a read handler which is mostly useless, and which is implemented with questionable logic. They both use a static 256 byte buffer which is initialized to the empty string. In the case of the 'command' file this buffer is literally never used and simply wastes space. In the case of the 'netdev_ops' file, the last command written is saved here. On read, the files contents are presented as the name of the device followed by a colon and then the contents of their respective static buffer. For 'command' this will always be "<device>: ". For 'netdev_ops', this will be "<device>: <last command written>". But note the buffer is shared between all devices operated by this module. At best, it is mostly meaningless information, and at worse it could be accessed simultaneously as there doesn't appear to be any locking mechanism. We have also recently received multiple reports for both read functions about their use of snprintf and potential overflow that could result in reading arbitrary kernel memory. For the 'command' file, this is definitely impossible, since the static buffer is always zero and never written to. For the 'netdev_ops' file, it does appear to be possible, if the user carefully crafts the command input, it will be copied into the buffer, which could be large enough to cause snprintf to truncate, which then causes the copy_to_user to read beyond the length of the buffer allocated by kzalloc. A minimal fix would be to replace snprintf() with scnprintf() which would cap the return to the number of bytes written, preventing an overflow. A more involved fix would be to drop the mostly useless static buffers, saving 512 bytes and modifying the read functions to stop needing those as input. Instead, lets just completely drop the read access to these files. These are debug interfaces exposed as part of debugfs, and I don't believe that dropping read access will break any script, as the provided output is pretty useless. You can find the netdev name through other more standard interfaces, and the 'netdev_ops' interface can easily result in garbage if you issue simultaneous writes to multiple devices at once. In order to properly remove the i40e_dbg_netdev_ops_buf, we need to refactor its write function to avoid using the static buffer. Instead, use the same logic as the i40e_dbg_command_write, with an allocated buffer. Update the code to use this instead of the static buffer, and ensure we free the buffer on exit. This fixes simultaneous writes to 'netdev_ops' on multiple devices, and allows us to remove the now unused static buffer along with removing the read access. Fixes: 02e9c290814c ("i40e: debugfs interface") Reported-by: Kunwu Chan <chentao(a)kylinos.cn> Closes: https://lore.kernel.org/intel-wired-lan/20231208031950.47410-1-chentao@kyli… Reported-by: Wang Haoran <haoranwangsec(a)gmail.com> Closes: https://lore.kernel.org/all/CANZ3JQRRiOdtfQJoP9QM=6LS1Jto8PGBGw6y7-TL=BcnzH… Reported-by: Amir Mohammad Jahangirzad <a.jahangirzad(a)gmail.com> Closes: https://lore.kernel.org/all/20250722115017.206969-1-a.jahangirzad@gmail.com/ Signed-off-by: Jacob Keller <jacob.e.keller(a)intel.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Kunwu Chan <kunwu.chan(a)linux.dev> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/i40e/i40e_debugfs.c [conflicts due to not merge 43f4466ca91d ("i40e: Add helper to access main VSI")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- .../net/ethernet/intel/i40e/i40e_debugfs.c | 121 +++--------------- 1 file changed, 19 insertions(+), 102 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c index 8bcf5902babf..d5c7f07db071 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c @@ -57,47 +57,6 @@ static struct i40e_veb *i40e_dbg_find_veb(struct i40e_pf *pf, int seid) * setup, adding or removing filters, or other things. Many of * these will be useful for some forms of unit testing. **************************************************************/ -static char i40e_dbg_command_buf[256] = ""; - -/** - * i40e_dbg_command_read - read for command datum - * @filp: the opened file - * @buffer: where to write the data for the user to read - * @count: the size of the user's buffer - * @ppos: file position offset - **/ -static ssize_t i40e_dbg_command_read(struct file *filp, char __user *buffer, - size_t count, loff_t *ppos) -{ - struct i40e_pf *pf = filp->private_data; - int bytes_not_copied; - int buf_size = 256; - char *buf; - int len; - - /* don't allow partial reads */ - if (*ppos != 0) - return 0; - if (count < buf_size) - return -ENOSPC; - - buf = kzalloc(buf_size, GFP_KERNEL); - if (!buf) - return -ENOSPC; - - len = snprintf(buf, buf_size, "%s: %s\n", - pf->vsi[pf->lan_vsi]->netdev->name, - i40e_dbg_command_buf); - - bytes_not_copied = copy_to_user(buffer, buf, len); - kfree(buf); - - if (bytes_not_copied) - return -EFAULT; - - *ppos = len; - return len; -} static char *i40e_filter_state_string[] = { "INVALID", @@ -1635,7 +1594,6 @@ static ssize_t i40e_dbg_command_write(struct file *filp, static const struct file_operations i40e_dbg_command_fops = { .owner = THIS_MODULE, .open = simple_open, - .read = i40e_dbg_command_read, .write = i40e_dbg_command_write, }; @@ -1644,47 +1602,6 @@ static const struct file_operations i40e_dbg_command_fops = { * The netdev_ops entry in debugfs is for giving the driver commands * to be executed from the netdev operations. **************************************************************/ -static char i40e_dbg_netdev_ops_buf[256] = ""; - -/** - * i40e_dbg_netdev_ops - read for netdev_ops datum - * @filp: the opened file - * @buffer: where to write the data for the user to read - * @count: the size of the user's buffer - * @ppos: file position offset - **/ -static ssize_t i40e_dbg_netdev_ops_read(struct file *filp, char __user *buffer, - size_t count, loff_t *ppos) -{ - struct i40e_pf *pf = filp->private_data; - int bytes_not_copied; - int buf_size = 256; - char *buf; - int len; - - /* don't allow partal reads */ - if (*ppos != 0) - return 0; - if (count < buf_size) - return -ENOSPC; - - buf = kzalloc(buf_size, GFP_KERNEL); - if (!buf) - return -ENOSPC; - - len = snprintf(buf, buf_size, "%s: %s\n", - pf->vsi[pf->lan_vsi]->netdev->name, - i40e_dbg_netdev_ops_buf); - - bytes_not_copied = copy_to_user(buffer, buf, len); - kfree(buf); - - if (bytes_not_copied) - return -EFAULT; - - *ppos = len; - return len; -} /** * i40e_dbg_netdev_ops_write - write into netdev_ops datum @@ -1698,35 +1615,36 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, size_t count, loff_t *ppos) { struct i40e_pf *pf = filp->private_data; + char *cmd_buf, *buf_tmp; int bytes_not_copied; struct i40e_vsi *vsi; - char *buf_tmp; int vsi_seid; int i, cnt; /* don't allow partial writes */ if (*ppos != 0) return 0; - if (count >= sizeof(i40e_dbg_netdev_ops_buf)) - return -ENOSPC; - memset(i40e_dbg_netdev_ops_buf, 0, sizeof(i40e_dbg_netdev_ops_buf)); - bytes_not_copied = copy_from_user(i40e_dbg_netdev_ops_buf, - buffer, count); - if (bytes_not_copied) + cmd_buf = kzalloc(count + 1, GFP_KERNEL); + if (!cmd_buf) + return count; + bytes_not_copied = copy_from_user(cmd_buf, buffer, count); + if (bytes_not_copied) { + kfree(cmd_buf); return -EFAULT; - i40e_dbg_netdev_ops_buf[count] = '\0'; + } + cmd_buf[count] = '\0'; - buf_tmp = strchr(i40e_dbg_netdev_ops_buf, '\n'); + buf_tmp = strchr(cmd_buf, '\n'); if (buf_tmp) { *buf_tmp = '\0'; - count = buf_tmp - i40e_dbg_netdev_ops_buf + 1; + count = buf_tmp - cmd_buf + 1; } - if (strncmp(i40e_dbg_netdev_ops_buf, "change_mtu", 10) == 0) { + if (strncmp(cmd_buf, "change_mtu", 10) == 0) { int mtu; - cnt = sscanf(&i40e_dbg_netdev_ops_buf[11], "%i %i", + cnt = sscanf(&cmd_buf[11], "%i %i", &vsi_seid, &mtu); if (cnt != 2) { dev_info(&pf->pdev->dev, "change_mtu <vsi_seid> <mtu>\n"); @@ -1748,8 +1666,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, dev_info(&pf->pdev->dev, "Could not acquire RTNL - please try again\n"); } - } else if (strncmp(i40e_dbg_netdev_ops_buf, "set_rx_mode", 11) == 0) { - cnt = sscanf(&i40e_dbg_netdev_ops_buf[11], "%i", &vsi_seid); + } else if (strncmp(cmd_buf, "set_rx_mode", 11) == 0) { + cnt = sscanf(&cmd_buf[11], "%i", &vsi_seid); if (cnt != 1) { dev_info(&pf->pdev->dev, "set_rx_mode <vsi_seid>\n"); goto netdev_ops_write_done; @@ -1769,8 +1687,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, dev_info(&pf->pdev->dev, "Could not acquire RTNL - please try again\n"); } - } else if (strncmp(i40e_dbg_netdev_ops_buf, "napi", 4) == 0) { - cnt = sscanf(&i40e_dbg_netdev_ops_buf[4], "%i", &vsi_seid); + } else if (strncmp(cmd_buf, "napi", 4) == 0) { + cnt = sscanf(&cmd_buf[4], "%i", &vsi_seid); if (cnt != 1) { dev_info(&pf->pdev->dev, "napi <vsi_seid>\n"); goto netdev_ops_write_done; @@ -1788,21 +1706,20 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, dev_info(&pf->pdev->dev, "napi called\n"); } } else { - dev_info(&pf->pdev->dev, "unknown command '%s'\n", - i40e_dbg_netdev_ops_buf); + dev_info(&pf->pdev->dev, "unknown command '%s'\n", cmd_buf); dev_info(&pf->pdev->dev, "available commands\n"); dev_info(&pf->pdev->dev, " change_mtu <vsi_seid> <mtu>\n"); dev_info(&pf->pdev->dev, " set_rx_mode <vsi_seid>\n"); dev_info(&pf->pdev->dev, " napi <vsi_seid>\n"); } netdev_ops_write_done: + kfree(cmd_buf); return count; } static const struct file_operations i40e_dbg_netdev_ops_fops = { .owner = THIS_MODULE, .open = simple_open, - .read = i40e_dbg_netdev_ops_read, .write = i40e_dbg_netdev_ops_write, }; -- 2.34.1

2 1

[PATCH OLK-5.10] ipvs: Defer ip_vs_ftp unregister during netns cleanup
by Wang Liang 09 Dec '25

09 Dec '25

From: Slavin Liu <slavin452(a)gmail.com> stable inclusion from stable-v5.10.246 commit 421b1ae1574dfdda68b835c15ac4921ec0030182 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3FOO CVE: CVE-2025-40018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately. Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") Suggested-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Slavin Liu <slavin452(a)gmail.com> Signed-off-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c index cf925906f59b..67d0d4f1f0db 100644 --- a/net/netfilter/ipvs/ip_vs_ftp.c +++ b/net/netfilter/ipvs/ip_vs_ftp.c @@ -53,6 +53,7 @@ enum { IP_VS_FTP_EPSV, }; +static bool exiting_module; /* * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper * First port is set to the default port. @@ -607,7 +608,7 @@ static void __ip_vs_ftp_exit(struct net *net) { struct netns_ipvs *ipvs = net_ipvs(net); - if (!ipvs) + if (!ipvs || !exiting_module) return; unregister_ip_vs_app(ipvs, &ip_vs_ftp); @@ -629,6 +630,7 @@ static int __init ip_vs_ftp_init(void) */ static void __exit ip_vs_ftp_exit(void) { + exiting_module = true; unregister_pernet_subsys(&ip_vs_ftp_ops); /* rcu_barrier() is called by netns */ } -- 2.34.1

2 1

[PATCH OLK-5.10] net/packet: fix a race in packet_set_ring() and packet_notifier()
by Wang Liang 09 Dec '25

09 Dec '25

From: Quang Le <quanglex97(a)gmail.com> stable inclusion from stable-v5.10.241 commit 7da733f117533e9b2ebbd530a22ae4028713955c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4S CVE: CVE-2025-38617 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01d3c8417b9c1b884a8a981a3b886da556512f36 upstream. When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Quang Le <quanglex97(a)gmail.com> Signed-off-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250801175423.2970334-1-willemdebruijn.kernel@gma… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index ae57d3e5df32..ba7c192342d9 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4446,10 +4446,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, spin_lock(&po->bind_lock); was_running = po->running; num = po->num; - if (was_running) { - WRITE_ONCE(po->num, 0); + WRITE_ONCE(po->num, 0); + if (was_running) __unregister_prot_hook(sk, false); - } + spin_unlock(&po->bind_lock); synchronize_net(); @@ -4481,10 +4481,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, mutex_unlock(&po->pg_vec_lock); spin_lock(&po->bind_lock); - if (was_running) { - WRITE_ONCE(po->num, num); + WRITE_ONCE(po->num, num); + if (was_running) register_prot_hook(sk); - } + spin_unlock(&po->bind_lock); if (pg_vec && (po->tp_version > TPACKET_V2)) { /* Because we don't support block-based V3 on tx-ring */ -- 2.34.1

2 1

[openeuler:OLK-6.6 3493/3493] mm/dynamic_pool.c:118:55: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0189df7df2ef7f7dbbabf7ff8398e45adf306e24 commit: 8822f3476adadcf84c7cb3db0d1a0a39a6fdc398 [3493/3493] mm/dynamic_pool: introduce per-memcg memory pool config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091456.3c7HGfWF-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091456.3c7HGfWF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091456.3c7HGfWF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/dynamic_pool.c:118:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_pool.c:118:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_pool.c:118:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * vim +118 mm/dynamic_pool.c 115 116 int dynamic_pool_destroy(struct cgroup *cgrp, bool *clear_css_online) 117 { > 118 struct cgroup_subsys_state *css = cgrp->subsys[memory_cgrp_id]; 119 struct mem_cgroup *memcg = mem_cgroup_from_css(css); 120 struct dynamic_pool *dpool; 121 int ret = 0; 122 123 if (!dpool_enabled || !memcg) 124 return 0; 125 126 mutex_lock(&dpool_mutex); 127 dpool = dpool_get_from_memcg(memcg); 128 if (!dpool) 129 goto unlock; 130 131 if (dpool->memcg != memcg) { 132 memcg->dpool = NULL; 133 goto put; 134 } 135 136 /* A offline dpool is not allowed for allocation */ 137 dpool->online = false; 138 139 memcg->dpool = NULL; 140 141 /* Release the initial reference count */ 142 dpool_put(dpool); 143 144 /* 145 * Since dpool is destroyed and the memcg will be freed then, 146 * clear CSS_ONLINE immediately to prevent race with create. 147 */ 148 if (cgrp->self.flags & CSS_ONLINE) { 149 cgrp->self.flags &= ~CSS_ONLINE; 150 *clear_css_online = true; 151 } 152 153 put: 154 dpool_put(dpool); 155 unlock: 156 mutex_unlock(&dpool_mutex); 157 158 return ret; 159 } 160 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] vsock: Do not allow binding to VMADDR_PORT_ANY
by Wang Liang 09 Dec '25

09 Dec '25

From: Budimir Markovic <markovicbudimir(a)gmail.com> stable inclusion from stable-v5.10.241 commit d1a5b1964cef42727668ac0d8532dae4f8c19386 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4U CVE: CVE-2025-38618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit aba0c94f61ec05315fa7815d21aefa4c87f6a9f4 upstream. It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir(a)gmail.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 3d24457ddf15..5e68c0705d3f 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -612,7 +612,8 @@ static int __vsock_bind_stream(struct vsock_sock *vsk, unsigned int i; for (i = 0; i < MAX_PORT_RETRIES; i++) { - if (port <= LAST_RESERVED_PORT) + if (port == VMADDR_PORT_ANY || + port <= LAST_RESERVED_PORT) port = LAST_RESERVED_PORT + 1; new_addr.svm_port = port++; -- 2.34.1

2 1

[PATCH OLK-5.10] ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
by Wang Liang 09 Dec '25

09 Dec '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v5.10.241 commit 435462f8ab2b9c5340a5414ce02f70117d0cfede category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUCA2 CVE: CVE-2025-38664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 ] Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. Fixes: c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> [ applied the patch to ice_flex_pipe.c instead of ice_ddp.c ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c index a81be917f653..da2906720c63 100644 --- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c +++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c @@ -1449,6 +1449,8 @@ enum ice_status ice_copy_and_init_pkg(struct ice_hw *hw, const u8 *buf, u32 len) return ICE_ERR_PARAM; buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len, GFP_KERNEL); + if (!buf_copy) + return ICE_ERR_NO_MEMORY; status = ice_init_pkg(hw, buf_copy, len); if (status) { -- 2.34.1

2 1

[PATCH OLK-5.10] ipv6: reject malicious packets in ipv6_gso_segment()
by Wang Liang 09 Dec '25

09 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.241 commit 3f638e0b28bde7c3354a0df938ab3a96739455d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6G7 CVE: CVE-2025-38572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe ] syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support") Reported-by: syzbot+af43e647fd835acc02df(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250730131738.3385939-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/linux/skbuff.h | 23 +++++++++++++++++++++++ net/ipv6/ip6_offload.c | 4 +++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 4a7a2ff7aec3..6e8dfec0a2a9 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2594,6 +2594,29 @@ static inline void skb_reset_transport_header(struct sk_buff *skb) skb->transport_header = skb->data - skb->head; } +/** + * skb_reset_transport_header_careful - conditionally reset transport header + * @skb: buffer to alter + * + * Hardened version of skb_reset_transport_header(). + * + * Returns: true if the operation was a success. + */ +static inline bool __must_check +skb_reset_transport_header_careful(struct sk_buff *skb) +{ + long offset = skb->data - skb->head; + + if (unlikely(offset != (typeof(skb->transport_header))offset)) + return false; + + if (unlikely(offset == (typeof(skb->transport_header))~0U)) + return false; + + skb->transport_header = offset; + return true; +} + static inline void skb_set_transport_header(struct sk_buff *skb, const int offset) { diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c index 15c8eef1ef44..71b5a7c3df09 100644 --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -111,7 +111,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, ops = rcu_dereference(inet6_offloads[proto]); if (likely(ops && ops->callbacks.gso_segment)) { - skb_reset_transport_header(skb); + if (!skb_reset_transport_header_careful(skb)) + goto out; + segs = ops->callbacks.gso_segment(skb, features); if (!segs) skb->network_header = skb_mac_header(skb) + nhoff - skb->head; -- 2.34.1

2 1

[PATCH OLK-5.10] arm64: kdump: Skip kmemleak scan reserved memory for kdump
by Zeng Heng 09 Dec '25

09 Dec '25

From: Chen Wandun <chenwandun(a)huawei.com> mainline inclusion from mainline-v5.15-rc1 commit 85f58eb1889826b9745737718723a80b639e0fbd category: bugfix bugzilla: 188440 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Trying to boot with kdump + kmemleak, command will result in a crash: "echo scan > /sys/kernel/debug/kmemleak" crashkernel reserved: 0x0000000007c00000 - 0x0000000027c00000 (512 MB) Kernel command line: BOOT_IMAGE=(hd1,gpt2)/vmlinuz-5.14.0-rc5-next-20210809+ root=/dev/mapper/ao-root ro rd.lvm.lv=ao/root rd.lvm.lv=ao/swap crashkernel=512M Unable to handle kernel paging request at virtual address ffff000007c00000 Mem abort info: ESR = 0x96000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007 CM = 0, WnR = 0 swapper pgtable: 64k pages, 48-bit VAs, pgdp=00002024f0d80000 [ffff000007c00000] pgd=1800205ffffd0003, p4d=1800205ffffd0003, pud=1800205ffffd0003, pmd=1800205ffffc0003, pte=0068000007c00f06 Internal error: Oops: 96000007 [#1] SMP pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : scan_block+0x98/0x230 lr : scan_block+0x94/0x230 sp : ffff80008d6cfb70 x29: ffff80008d6cfb70 x28: 0000000000000000 x27: 0000000000000000 x26: 00000000000000c0 x25: 0000000000000001 x24: 0000000000000000 x23: ffffa88a6b18b398 x22: ffff000007c00ff9 x21: ffffa88a6ac7fc40 x20: ffffa88a6af6a830 x19: ffff000007c00000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff x14: ffffffff00000000 x13: ffffffffffffffff x12: 0000000000000020 x11: 0000000000000000 x10: 0000000001080000 x9 : ffffa88a6951c77c x8 : ffffa88a6a893988 x7 : ffff203ff6cfb3c0 x6 : ffffa88a6a52b3c0 x5 : ffff203ff6cfb3c0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffff20226cb56a40 x0 : 0000000000000000 Call trace: scan_block+0x98/0x230 scan_gray_list+0x120/0x270 kmemleak_scan+0x3a0/0x648 kmemleak_write+0x3ac/0x4c8 full_proxy_write+0x6c/0xa0 vfs_write+0xc8/0x2b8 ksys_write+0x70/0xf8 __arm64_sys_write+0x24/0x30 invoke_syscall+0x4c/0x110 el0_svc_common+0x9c/0x190 do_el0_svc+0x30/0x98 el0_svc+0x28/0xd8 el0t_64_sync_handler+0x90/0xb8 el0t_64_sync+0x180/0x184 The reserved memory for kdump will be looked up by kmemleak, this area will be set invalid when kdump service is bring up. That will result in crash when kmemleak scan this area. Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private") Signed-off-by: Chen Wandun <chenwandun(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Mike Rapoport <rppt(a)linux.ibm.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20210910064844.3827813-1-chenwandun@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> conflict: arch/arm64/mm/init.c Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- kernel/crash_core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/crash_core.c b/kernel/crash_core.c index d1402585bf84..368d8d1dd03c 100644 --- a/kernel/crash_core.c +++ b/kernel/crash_core.c @@ -9,6 +9,7 @@ #include <linux/vmalloc.h> #include <linux/memblock.h> #include <linux/swiotlb.h> +#include <linux/kmemleak.h> #ifdef CONFIG_KEXEC_CORE #include <asm/kexec.h> @@ -556,6 +557,14 @@ void __init reserve_crashkernel(void) (unsigned long)(crash_base >> 20), (unsigned long)(total_mem >> 20)); +#ifdef CONFIG_ARM64 + /* + * The crashkernel memory will be removed from the kernel linear + * map. Inform kmemleak so that it won't try to access it. + */ + kmemleak_ignore_phys(crash_base); +#endif + crashk_res.start = crash_base; crashk_res.end = crash_base + crash_size - 1; } -- 2.25.1

2 1

[openeuler:OLK-6.6 3493/3493] mm/memblock.c:1409:20: warning: no previous prototype for function 'memblock_alloc_range_nid_flags'
by kernel test robot 09 Dec '25

09 Dec '25

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d86ef4e1e96aa04c46e92dca30f98d069c1ad15a commit: 64018b291c1f49622c4b23b303364d760306d662 [3493/3493] mm/memblock: Introduce ability to alloc memory from specify memory region config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091204.Q8mSD8MC-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091204.Q8mSD8MC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091204.Q8mSD8MC-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memblock.c:18: In file included from include/linux/memblock.h:12: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> mm/memblock.c:1409:20: warning: no previous prototype for function 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] 1409 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ mm/memblock.c:1409:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1409 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ | static 2 warnings generated. -- >> mm/memblock.c:1579: warning: expecting prototype for memblock_alloc_internal(). Prototype was for __memblock_alloc_internal() instead vim +/memblock_alloc_range_nid_flags +1409 mm/memblock.c 1386 1387 /** 1388 * memblock_alloc_range_nid_flags - allocate boot memory block with specify flag 1389 * @size: size of memory block to be allocated in bytes 1390 * @align: alignment of the region and block's size 1391 * @start: the lower bound of the memory region to allocate (phys address) 1392 * @end: the upper bound of the memory region to allocate (phys address) 1393 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1394 * @exact_nid: control the allocation fall back to other nodes 1395 * @flags: alloc memory from specify memblock flag 1396 * 1397 * The allocation is performed from memory region limited by 1398 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1399 * 1400 * If the specified node can not hold the requested memory and @exact_nid 1401 * is false, the allocation falls back to any node in the system. 1402 * 1403 * In addition, function sets the min_count to 0 using kmemleak_alloc_phys for 1404 * allocated boot memory block, so that it is never reported as leaks. 1405 * 1406 * Return: 1407 * Physical address of allocated memory block on success, %0 on failure. 1408 */ > 1409 phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, 1410 phys_addr_t align, phys_addr_t start, 1411 phys_addr_t end, int nid, 1412 bool exact_nid, 1413 enum memblock_flags flags) 1414 { 1415 phys_addr_t found; 1416 1417 if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) 1418 nid = NUMA_NO_NODE; 1419 1420 if (!align) { 1421 /* Can't use WARNs this early in boot on powerpc */ 1422 dump_stack(); 1423 align = SMP_CACHE_BYTES; 1424 } 1425 1426 again: 1427 found = memblock_find_in_range_node(size, align, start, end, nid, 1428 flags); 1429 if (found && !memblock_reserve(found, size)) 1430 goto done; 1431 1432 if (nid != NUMA_NO_NODE && !exact_nid) { 1433 found = memblock_find_in_range_node(size, align, start, 1434 end, NUMA_NO_NODE, 1435 flags); 1436 if (found && !memblock_reserve(found, size)) 1437 goto done; 1438 } 1439 1440 if (flags & MEMBLOCK_MIRROR) { 1441 flags &= ~MEMBLOCK_MIRROR; 1442 pr_warn_ratelimited("Could not allocate %pap bytes of mirrored memory\n", 1443 &size); 1444 goto again; 1445 } 1446 1447 return 0; 1448 1449 done: 1450 /* 1451 * Skip kmemleak for those places like kasan_init() and 1452 * early_pgtable_alloc() due to high volume. 1453 */ 1454 if (end != MEMBLOCK_ALLOC_NOLEAKTRACE) 1455 /* 1456 * Memblock allocated blocks are never reported as 1457 * leaks. This is because many of these blocks are 1458 * only referred via the physical address which is 1459 * not looked up by kmemleak. 1460 */ 1461 kmemleak_alloc_phys(found, size, 0); 1462 1463 /* 1464 * Some Virtual Machine platforms, such as Intel TDX or AMD SEV-SNP, 1465 * require memory to be accepted before it can be used by the 1466 * guest. 1467 * 1468 * Accept the memory of the allocated buffer. 1469 */ 1470 accept_memory(found, found + size); 1471 1472 return found; 1473 } 1474 1475 /** 1476 * memblock_alloc_range_nid - allocate boot memory block 1477 * @size: size of memory block to be allocated in bytes 1478 * @align: alignment of the region and block's size 1479 * @start: the lower bound of the memory region to allocate (phys address) 1480 * @end: the upper bound of the memory region to allocate (phys address) 1481 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1482 * @exact_nid: control the allocation fall back to other nodes 1483 * 1484 * The allocation is performed from memory region limited by 1485 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1486 * 1487 * If the specified node can not hold the requested memory and @exact_nid 1488 * is false, the allocation falls back to any node in the system. 1489 * 1490 * For systems with memory mirroring, the allocation is attempted first 1491 * from the regions with mirroring enabled and then retried from any 1492 * memory region. 1493 * 1494 * In addition, function using kmemleak_alloc_phys for allocated boot 1495 * memory block, it is never reported as leaks. 1496 * 1497 * Return: 1498 * Physical address of allocated memory block on success, %0 on failure. 1499 */ 1500 phys_addr_t __init memblock_alloc_range_nid(phys_addr_t size, 1501 phys_addr_t align, phys_addr_t start, 1502 phys_addr_t end, int nid, 1503 bool exact_nid) 1504 { 1505 return memblock_alloc_range_nid_flags(size, align, start, end, nid, 1506 exact_nid, 1507 choose_memblock_flags()); 1508 } 1509 1510 /** 1511 * memblock_phys_alloc_range - allocate a memory block inside specified range 1512 * @size: size of memory block to be allocated in bytes 1513 * @align: alignment of the region and block's size 1514 * @start: the lower bound of the memory region to allocate (physical address) 1515 * @end: the upper bound of the memory region to allocate (physical address) 1516 * 1517 * Allocate @size bytes in the between @start and @end. 1518 * 1519 * Return: physical address of the allocated memory block on success, 1520 * %0 on failure. 1521 */ 1522 phys_addr_t __init memblock_phys_alloc_range(phys_addr_t size, 1523 phys_addr_t align, 1524 phys_addr_t start, 1525 phys_addr_t end) 1526 { 1527 memblock_dbg("%s: %llu bytes align=0x%llx from=%pa max_addr=%pa %pS\n", 1528 __func__, (u64)size, (u64)align, &start, &end, 1529 (void *)_RET_IP_); 1530 return memblock_alloc_range_nid(size, align, start, end, NUMA_NO_NODE, 1531 false); 1532 } 1533 1534 /** 1535 * memblock_phys_alloc_try_nid - allocate a memory block from specified NUMA node 1536 * @size: size of memory block to be allocated in bytes 1537 * @align: alignment of the region and block's size 1538 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1539 * 1540 * Allocates memory block from the specified NUMA node. If the node 1541 * has no available memory, attempts to allocated from any node in the 1542 * system. 1543 * 1544 * Return: physical address of the allocated memory block on success, 1545 * %0 on failure. 1546 */ 1547 phys_addr_t __init memblock_phys_alloc_try_nid(phys_addr_t size, phys_addr_t align, int nid) 1548 { 1549 return memblock_alloc_range_nid(size, align, 0, 1550 MEMBLOCK_ALLOC_ACCESSIBLE, nid, false); 1551 } 1552 1553 /** 1554 * memblock_alloc_internal - allocate boot memory block 1555 * @size: size of memory block to be allocated in bytes 1556 * @align: alignment of the region and block's size 1557 * @min_addr: the lower bound of the memory region to allocate (phys address) 1558 * @max_addr: the upper bound of the memory region to allocate (phys address) 1559 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1560 * @exact_nid: control the allocation fall back to other nodes 1561 * @flags: alloc memory from specify memblock flag 1562 * 1563 * Allocates memory block using memblock_alloc_range_nid() and 1564 * converts the returned physical address to virtual. 1565 * 1566 * The @min_addr limit is dropped if it can not be satisfied and the allocation 1567 * will fall back to memory below @min_addr. Other constraints, such 1568 * as node and mirrored memory will be handled again in 1569 * memblock_alloc_range_nid(). 1570 * 1571 * Return: 1572 * Virtual address of allocated memory block on success, NULL on failure. 1573 */ 1574 static void * __init __memblock_alloc_internal( 1575 phys_addr_t size, phys_addr_t align, 1576 phys_addr_t min_addr, phys_addr_t max_addr, 1577 int nid, bool exact_nid, 1578 enum memblock_flags flags) > 1579 { 1580 phys_addr_t alloc; 1581 1582 /* 1583 * Detect any accidental use of these APIs after slab is ready, as at 1584 * this moment memblock may be deinitialized already and its 1585 * internal data may be destroyed (after execution of memblock_free_all) 1586 */ 1587 if (WARN_ON_ONCE(slab_is_available())) 1588 return kzalloc_node(size, GFP_NOWAIT, nid); 1589 1590 if (max_addr > memblock.current_limit) 1591 max_addr = memblock.current_limit; 1592 1593 alloc = memblock_alloc_range_nid_flags(size, align, min_addr, max_addr, nid, 1594 exact_nid, flags); 1595 1596 /* retry allocation without lower limit */ 1597 if (!alloc && min_addr) 1598 alloc = memblock_alloc_range_nid_flags(size, align, 0, max_addr, nid, 1599 exact_nid, flags); 1600 1601 if (!alloc) 1602 return NULL; 1603 1604 return phys_to_virt(alloc); 1605 } 1606 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] fs/proc/task_mmu.c:192:23: warning: variable 'last_vma_start' set but not used
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: 094a76ab06c367065280f8760d2100db0c8a0b6a [3386/3386] mm: proc: use per_vma mmap_lock for vma traversal. config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251209/202512090552.wjNONK6W-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090552.wjNONK6W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090552.wjNONK6W-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/proc/task_mmu.c: In function 'numa_maps_next': >> fs/proc/task_mmu.c:192:23: warning: variable 'last_vma_start' set but not used [-Wunused-but-set-variable] 192 | unsigned long last_vma_start; | ^~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +/last_vma_start +192 fs/proc/task_mmu.c 184 185 static void *numa_maps_next(struct seq_file *m, void *v, loff_t *ppos) 186 { 187 struct proc_maps_private *priv = m->private; 188 struct vm_area_struct *next = NULL; 189 struct vm_area_struct *vma = v; 190 struct mm_struct *mm = priv->mm; 191 unsigned long last_vma_end; > 192 unsigned long last_vma_start; 193 int ret; 194 195 if (!mm) 196 goto out; 197 198 if (vma == priv->tail_vma) 199 goto out; 200 201 if (vma->vm_next) 202 next = vma->vm_next; 203 else 204 next = priv->tail_vma; 205 206 last_vma_end = vma->vm_end; 207 last_vma_start = vma->vm_start; 208 if (mmap_lock_is_contended(mm)) { 209 mmap_read_unlock(mm); 210 ret = mmap_read_lock_killable(mm); 211 if (ret) { 212 mmput(mm); 213 put_task_struct(priv->task); 214 priv->task = NULL; 215 return ERR_PTR(ret); 216 } 217 218 /* 219 * After dropping the lock, there are four cases to 220 * consider. See the following example for explanation. 221 * 222 * +------+------+-----------+ 223 * | VMA1 | VMA2 | VMA3 | 224 * +------+------+-----------+ 225 * | | | | 226 * 4k 8k 16k 400k 227 * 228 * Suppose we drop the lock after reading VMA2 due to 229 * contention, then we get: 230 * 231 * last_vma_end = 16k 232 * 233 * 1) VMA2 is freed, but VMA3 exists: 234 * 235 * find_vma(mm, 16k - 1) will return VMA3. 236 * In this case, just continue from VMA3. 237 * 238 * 2) VMA2 still exists: 239 * 240 * find_vma(mm, 16k - 1) will return VMA2. 241 * Iterate the loop like the original one. 242 * 243 * 3) No more VMAs can be found: 244 * 245 * find_vma(mm, 16k - 1) will return NULL. 246 * No more things to do, just break. 247 * 248 * 4) (last_vma_end - 1) is the middle of a vma (VMA'): 249 * 250 * find_vma(mm, 16k - 1) will return VMA' whose range 251 * contains last_vma_end. 252 * Iterate VMA' from last_vma_end. 253 */ 254 next = find_vma(mm, last_vma_end - 1); 255 256 /* Case 3 above */ 257 if (!next) 258 goto out; 259 260 /* Case 1 above */ 261 if (next->vm_start >= last_vma_end) 262 goto out; 263 264 /* Case 4 above */ 265 if (next->vm_end > last_vma_end) { 266 *ppos = last_vma_end; 267 return next; 268 } 269 270 /* Case 2 above */ 271 if (next->vm_next) 272 next = next->vm_next; 273 else 274 next = priv->tail_vma; 275 } 276 out: 277 *ppos = next ? next->vm_start : -1UL; 278 return next; 279 } 280 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/mempolicy.c:1115:25: warning: variable 'vma' set but not used
by kernel test robot 09 Dec '25

09 Dec '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d86ef4e1e96aa04c46e92dca30f98d069c1ad15a commit: dba69db9a5fc7c2c9c0cda0f32bb3b5f3d73ef93 [3493/3493] mm/damon/vaddr: Add demotion interface for migrating cold pages to target nodemask config: loongarch-randconfig-r111-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091141.r06Y9a5w-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 6ec8c4351cfc1d0627d1633b02ea787bd29c77d8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091141.r06Y9a5w-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091141.r06Y9a5w-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from <built-in>:3: In file included from include/linux/compiler_types.h:150: include/linux/compiler-clang.h:33:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:372:9: note: previous definition is here 372 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from mm/mempolicy.c:108: In file included from arch/loongarch/include/asm/tlb.h:140: include/asm-generic/tlb.h:632:10: warning: parameter 'ptep' set but not used [-Wunused-but-set-parameter] 632 | pte_t *ptep, unsigned int nr, unsigned long address) | ^ In file included from mm/mempolicy.c:108: arch/loongarch/include/asm/tlb.h:144:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 144 | struct vm_area_struct vma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ >> mm/mempolicy.c:1115:25: warning: variable 'vma' set but not used [-Wunused-but-set-variable] 1115 | struct vm_area_struct *vma; | ^ mm/mempolicy.c:2951:25: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 2951 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ 5 warnings generated. vim +/vma +1115 mm/mempolicy.c 1106 1107 /* 1108 * Migrate area pages from one node to a target node. 1109 * Returns error or the number of pages not migrated. 1110 */ 1111 static int migrate_area_to_node(struct mm_struct *mm, int source, int dest, 1112 unsigned long start, unsigned long end, int flags) 1113 { 1114 nodemask_t nmask; > 1115 struct vm_area_struct *vma; 1116 LIST_HEAD(pagelist); 1117 int err = 0; 1118 struct migration_target_control mtc = { 1119 .nid = dest, 1120 .gfp_mask = GFP_HIGHUSER_MOVABLE | __GFP_THISNODE, 1121 }; 1122 1123 nodes_clear(nmask); 1124 node_set(source, nmask); 1125 1126 /* 1127 * This does not "check" the range but isolates all pages that 1128 * need migration. Between passing in the full user address 1129 * space range and MPOL_MF_DISCONTIG_OK, this call can not fail. 1130 */ 1131 vma = find_vma(mm, 0); 1132 VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))); 1133 queue_pages_range(mm, start, end, &nmask, 1134 flags | MPOL_MF_DISCONTIG_OK, &pagelist, false); 1135 1136 if (!list_empty(&pagelist)) { 1137 err = migrate_pages(&pagelist, alloc_migration_target, NULL, 1138 (unsigned long)&mtc, MIGRATE_SYNC, MR_DAMON_DEMOTION, NULL); 1139 if (err) 1140 putback_movable_pages(&pagelist); 1141 } 1142 1143 return err; 1144 } 1145 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/madvise.c:297:6: warning: no previous prototype for function 'force_swapin_vma'
by kernel test robot 09 Dec '25

09 Dec '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 92a0eb9bde6c03412b39f9f3d20968c091ea3b46 [3493/3493] memcg: introduce per-memcg swapin interface config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091138.u8NXXfZk-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091138.u8NXXfZk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091138.u8NXXfZk-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/madvise.c:9: In file included from include/linux/mman.h:5: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/madvise.c:21: include/linux/mm_inline.h:46:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 46 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:48:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 48 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ >> mm/madvise.c:297:6: warning: no previous prototype for function 'force_swapin_vma' [-Wmissing-prototypes] 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^ mm/madvise.c:297:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^ | static 4 warnings generated. vim +/force_swapin_vma +297 mm/madvise.c 280 281 #ifdef CONFIG_MEMCG_SWAP_QOS 282 void force_swapin_vma(struct vm_area_struct *vma) 283 { 284 struct file *file = vma->vm_file; 285 286 if (!can_madv_lru_vma(vma)) 287 return; 288 289 if (!file) { 290 walk_page_vma(vma, &swapin_walk_ops, vma); 291 lru_add_drain(); 292 } else if (shmem_mapping(file->f_mapping)) 293 shmem_swapin_range(vma, vma->vm_start, 294 vma->vm_end, file->f_mapping); 295 } 296 #else > 297 void force_swapin_vma(struct vm_area_struct *vma) 298 { 299 } 300 #endif 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3490/3490] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for function 'sxe_hw_event_irq_auto_clear_set'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 451d7461fb9403af592235b03ec6ead64b43e7c8 commit: 0ba0ebb029b99864fa5963024535f48299373354 [3490/3490] !15589 [OLK-6.6] Ethernet: Supports Linkdata ethernet Controllers config: arm64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251209/202512090327.qpSaRPFx-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 4125e73cdc6188cca4c1c72b72e2b2d85c157483) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090327.qpSaRPFx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090327.qpSaRPFx-lkp@intel.com/ All errors (new ones prefixed by >>): 367 | #define __SANITIZE_ADDRESS__ 1 | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:6: error: no previous prototype for function 'sxe_hw_no_snoop_disable' [-Werror,-Wmissing-prototypes] 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for function 'sxe_hw_uc_addr_pool_del' [-Werror,-Wmissing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for function 'sxe_hw_uc_addr_pool_enable' [-Werror,-Wmissing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for function 'sxe_hw_nic_reset' [-Werror,-Wmissing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for function 'sxe_hw_pf_rst_done_set' [-Werror,-Wmissing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for function 'sxe_hw_pending_irq_read_clear' [-Werror,-Wmissing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for function 'sxe_hw_pending_irq_write_clear' [-Werror,-Wmissing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for function 'sxe_hw_irq_cause_get' [-Werror,-Wmissing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for function 'sxe_hw_ring_irq_auto_disable' [-Werror,-Wmissing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for function 'sxe_hw_irq_general_reg_set' [-Werror,-Wmissing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for function 'sxe_hw_irq_general_reg_get' [-Werror,-Wmissing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for function 'sxe_hw_event_irq_map' [-Werror,-Wmissing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for function 'sxe_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for function 'sxe_hw_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for function 'sxe_hw_event_irq_auto_clear_set' [-Werror,-Wmissing-prototypes] 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:6: error: no previous prototype for function 'sxe_hw_specific_irq_disable' [-Werror,-Wmissing-prototypes] 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:6: error: no previous prototype for function 'sxe_hw_specific_irq_enable' [-Werror,-Wmissing-prototypes] 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:6: error: no previous prototype for function 'sxe_hw_all_irq_disable' [-Werror,-Wmissing-prototypes] 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. -- 367 | #define __SANITIZE_ADDRESS__ 1 | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:160:6: error: no previous prototype for function 'sxevf_hw_stop' [-Werror,-Wmissing-prototypes] 160 | void sxevf_hw_stop(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:160:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 160 | void sxevf_hw_stop(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:187:6: error: no previous prototype for function 'sxevf_msg_write' [-Werror,-Wmissing-prototypes] 187 | void sxevf_msg_write(struct sxevf_hw *hw, u8 index, u32 msg) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:187:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 187 | void sxevf_msg_write(struct sxevf_hw *hw, u8 index, u32 msg) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:196:5: error: no previous prototype for function 'sxevf_msg_read' [-Werror,-Wmissing-prototypes] 196 | u32 sxevf_msg_read(struct sxevf_hw *hw, u8 index) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:196:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 196 | u32 sxevf_msg_read(struct sxevf_hw *hw, u8 index) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:206:5: error: no previous prototype for function 'sxevf_mailbox_read' [-Werror,-Wmissing-prototypes] 206 | u32 sxevf_mailbox_read(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:206:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 206 | u32 sxevf_mailbox_read(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:211:6: error: no previous prototype for function 'sxevf_mailbox_write' [-Werror,-Wmissing-prototypes] 211 | void sxevf_mailbox_write(struct sxevf_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:211:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 211 | void sxevf_mailbox_write(struct sxevf_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:216:6: error: no previous prototype for function 'sxevf_pf_req_irq_trigger' [-Werror,-Wmissing-prototypes] 216 | void sxevf_pf_req_irq_trigger(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:216:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 216 | void sxevf_pf_req_irq_trigger(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:221:6: error: no previous prototype for function 'sxevf_pf_ack_irq_trigger' [-Werror,-Wmissing-prototypes] 221 | void sxevf_pf_ack_irq_trigger(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:221:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 221 | void sxevf_pf_ack_irq_trigger(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:226:6: error: no previous prototype for function 'sxevf_event_irq_map' [-Werror,-Wmissing-prototypes] 226 | void sxevf_event_irq_map(struct sxevf_hw *hw, u16 vector) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:226:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 226 | void sxevf_event_irq_map(struct sxevf_hw *hw, u16 vector) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:240:6: error: no previous prototype for function 'sxevf_specific_irq_enable' [-Werror,-Wmissing-prototypes] 240 | void sxevf_specific_irq_enable(struct sxevf_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:240:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 240 | void sxevf_specific_irq_enable(struct sxevf_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:245:6: error: no previous prototype for function 'sxevf_irq_enable' [-Werror,-Wmissing-prototypes] 245 | void sxevf_irq_enable(struct sxevf_hw *hw, u32 mask) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:245:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 245 | void sxevf_irq_enable(struct sxevf_hw *hw, u32 mask) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:251:6: error: no previous prototype for function 'sxevf_irq_disable' [-Werror,-Wmissing-prototypes] 251 | void sxevf_irq_disable(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:251:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 251 | void sxevf_irq_disable(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:259:6: error: no previous prototype for function 'sxevf_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 259 | void sxevf_hw_ring_irq_map(struct sxevf_hw *hw, bool is_tx, u16 hw_ring_idx, | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:259:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 259 | void sxevf_hw_ring_irq_map(struct sxevf_hw *hw, bool is_tx, u16 hw_ring_idx, | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:276:6: error: no previous prototype for function 'sxevf_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 276 | void sxevf_ring_irq_interval_set(struct sxevf_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:276:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 276 | void sxevf_ring_irq_interval_set(struct sxevf_hw *hw, u16 irq_idx, u32 interval) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:313:6: error: no previous prototype for function 'sxevf_hw_reset' [-Werror,-Wmissing-prototypes] 313 | void sxevf_hw_reset(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:313:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 313 | void sxevf_hw_reset(struct sxevf_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:324:5: error: no previous prototype for function 'sxevf_link_state_get' [-Werror,-Wmissing-prototypes] 324 | u32 sxevf_link_state_get(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:324:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 324 | u32 sxevf_link_state_get(struct sxevf_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:539:6: error: no previous prototype for function 'sxevf_tx_ring_switch' [-Werror,-Wmissing-prototypes] 539 | void sxevf_tx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:539:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 539 | void sxevf_tx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^ | static >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:594:6: error: no previous prototype for function 'sxevf_rx_ring_switch' [-Werror,-Wmissing-prototypes] 594 | void sxevf_rx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:594:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 594 | void sxevf_rx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^ | static >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:626:6: error: no previous prototype for function 'sxevf_rx_ring_desc_configure' [-Werror,-Wmissing-prototypes] 626 | void sxevf_rx_ring_desc_configure(struct sxevf_hw *hw, u32 desc_mem_len, | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:626:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 626 | void sxevf_rx_ring_desc_configure(struct sxevf_hw *hw, u32 desc_mem_len, | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. vim +/sxe_hw_event_irq_auto_clear_set +838 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c dd013ad487534c liujie_answer 2025-04-15 837 dd013ad487534c liujie_answer 2025-04-15 @838 void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) dd013ad487534c liujie_answer 2025-04-15 839 { dd013ad487534c liujie_answer 2025-04-15 840 SXE_REG_WRITE(hw, SXE_EIAC, value); dd013ad487534c liujie_answer 2025-04-15 841 } dd013ad487534c liujie_answer 2025-04-15 842 dd013ad487534c liujie_answer 2025-04-15 @843 void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) dd013ad487534c liujie_answer 2025-04-15 844 { dd013ad487534c liujie_answer 2025-04-15 845 SXE_REG_WRITE(hw, SXE_EIMC, value); dd013ad487534c liujie_answer 2025-04-15 846 } dd013ad487534c liujie_answer 2025-04-15 847 dd013ad487534c liujie_answer 2025-04-15 @848 void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) dd013ad487534c liujie_answer 2025-04-15 849 { dd013ad487534c liujie_answer 2025-04-15 850 SXE_REG_WRITE(hw, SXE_EIMS, value); dd013ad487534c liujie_answer 2025-04-15 851 } dd013ad487534c liujie_answer 2025-04-15 852 dd013ad487534c liujie_answer 2025-04-15 853 static u32 sxe_hw_spp_state_get(struct sxe_hw *hw) dd013ad487534c liujie_answer 2025-04-15 854 { dd013ad487534c liujie_answer 2025-04-15 855 return SXE_REG_READ(hw, SXE_SPP_STATE); dd013ad487534c liujie_answer 2025-04-15 856 } dd013ad487534c liujie_answer 2025-04-15 857 dd013ad487534c liujie_answer 2025-04-15 858 static void sxe_hw_rx_los_disable(struct sxe_hw *hw) dd013ad487534c liujie_answer 2025-04-15 859 { dd013ad487534c liujie_answer 2025-04-15 860 u32 value; dd013ad487534c liujie_answer 2025-04-15 861 dd013ad487534c liujie_answer 2025-04-15 862 value = SXE_REG_READ(hw, SXE_EIMS); dd013ad487534c liujie_answer 2025-04-15 863 value &= ~SXE_EIMS_GPI_SPP1; dd013ad487534c liujie_answer 2025-04-15 864 SXE_REG_WRITE(hw, SXE_EIMS, value); dd013ad487534c liujie_answer 2025-04-15 865 } dd013ad487534c liujie_answer 2025-04-15 866 dd013ad487534c liujie_answer 2025-04-15 867 static void sxe_hw_rx_los_enable(struct sxe_hw *hw) dd013ad487534c liujie_answer 2025-04-15 868 { dd013ad487534c liujie_answer 2025-04-15 869 u32 value; dd013ad487534c liujie_answer 2025-04-15 870 dd013ad487534c liujie_answer 2025-04-15 871 value = SXE_REG_READ(hw, SXE_EIMS); dd013ad487534c liujie_answer 2025-04-15 872 value |= SXE_EIMS_GPI_SPP1; dd013ad487534c liujie_answer 2025-04-15 873 SXE_REG_WRITE(hw, SXE_EIMS, value); dd013ad487534c liujie_answer 2025-04-15 874 } dd013ad487534c liujie_answer 2025-04-15 875 dd013ad487534c liujie_answer 2025-04-15 @876 void sxe_hw_all_irq_disable(struct sxe_hw *hw) dd013ad487534c liujie_answer 2025-04-15 877 { dd013ad487534c liujie_answer 2025-04-15 878 SXE_REG_WRITE(hw, SXE_EIMC, 0xFFFF0000); dd013ad487534c liujie_answer 2025-04-15 879 dd013ad487534c liujie_answer 2025-04-15 880 SXE_REG_WRITE(hw, SXE_EIMC_EX(0), ~0); dd013ad487534c liujie_answer 2025-04-15 881 SXE_REG_WRITE(hw, SXE_EIMC_EX(1), ~0); dd013ad487534c liujie_answer 2025-04-15 882 dd013ad487534c liujie_answer 2025-04-15 883 SXE_WRITE_FLUSH(hw); dd013ad487534c liujie_answer 2025-04-15 884 } dd013ad487534c liujie_answer 2025-04-15 885 :::::: The code at line 838 was first introduced by commit :::::: dd013ad487534c1838afc2f55efdb5daec15aace Ethernet: Linkdata: Supports Linkdata ethernet Controllers :::::: TO: liujie_answer <liujie5(a)linkdatatechnology.com> :::::: CC: liujie_answer <liujie5(a)linkdatatechnology.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] drivers/cpufreq/intel_pstate.c:1473:6: warning: no previous prototype for 'notify_hwp_interrupt'
by kernel test robot 09 Dec '25

09 Dec '25

Hi Srinivas, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: e217d5958ee378eb304fb0b4eb6fcb551e555842 [3386/3386] cpufreq: intel_pstate: Process HWP Guaranteed change notification config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251209/202512090137.yqEfvu43-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090137.yqEfvu43-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090137.yqEfvu43-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/cpufreq/intel_pstate.c:1473:6: warning: no previous prototype for 'notify_hwp_interrupt' [-Wmissing-prototypes] 1473 | void notify_hwp_interrupt(void) | ^~~~~~~~~~~~~~~~~~~~ vim +/notify_hwp_interrupt +1473 drivers/cpufreq/intel_pstate.c 1472 > 1473 void notify_hwp_interrupt(void) 1474 { 1475 unsigned int this_cpu = smp_processor_id(); 1476 struct cpudata *cpudata; 1477 unsigned long flags; 1478 u64 value; 1479 1480 if (!READ_ONCE(hwp_active) || !boot_cpu_has(X86_FEATURE_HWP_NOTIFY)) 1481 return; 1482 1483 rdmsrl_safe(MSR_HWP_STATUS, &value); 1484 if (!(value & 0x01)) 1485 return; 1486 1487 spin_lock_irqsave(&hwp_notify_lock, flags); 1488 1489 if (!cpumask_test_cpu(this_cpu, &hwp_intr_enable_mask)) 1490 goto ack_intr; 1491 1492 /* 1493 * Currently we never free all_cpu_data. And we can't reach here 1494 * without this allocated. But for safety for future changes, added 1495 * check. 1496 */ 1497 if (unlikely(!READ_ONCE(all_cpu_data))) 1498 goto ack_intr; 1499 1500 /* 1501 * The free is done during cleanup, when cpufreq registry is failed. 1502 * We wouldn't be here if it fails on init or switch status. But for 1503 * future changes, added check. 1504 */ 1505 cpudata = READ_ONCE(all_cpu_data[this_cpu]); 1506 if (unlikely(!cpudata)) 1507 goto ack_intr; 1508 1509 schedule_delayed_work(&cpudata->hwp_notify_work, msecs_to_jiffies(10)); 1510 1511 spin_unlock_irqrestore(&hwp_notify_lock, flags); 1512 1513 return; 1514 1515 ack_intr: 1516 wrmsrl_safe(MSR_HWP_STATUS, 0); 1517 spin_unlock_irqrestore(&hwp_notify_lock, flags); 1518 } 1519 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/gmem_phys.c:345:19: warning: no previous prototype for 'gm_evict_page'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 8f4f66a9d851f366942e8ee319292e41ad2baa95 [3493/3493] gmem: support swapping heterogeneous memory config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251209/202512090139.MlPNvch8-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090139.MlPNvch8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090139.MlPNvch8-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/gmem_phys.c:245:19: warning: no previous prototype for 'gm_evict_page_locked' [-Wmissing-prototypes] 245 | enum gm_evict_ret gm_evict_page_locked(struct gm_page *gm_page) | ^~~~~~~~~~~~~~~~~~~~ >> mm/gmem_phys.c:345:19: warning: no previous prototype for 'gm_evict_page' [-Wmissing-prototypes] 345 | enum gm_evict_ret gm_evict_page(struct gm_page *gm_page) | ^~~~~~~~~~~~~ vim +/gm_evict_page +345 mm/gmem_phys.c 344 > 345 enum gm_evict_ret gm_evict_page(struct gm_page *gm_page) 346 { 347 struct mm_struct *mm = gm_page->mm; 348 enum gm_evict_ret ret; 349 350 mmap_read_lock(mm); 351 ret = gm_evict_page_locked(gm_page); 352 mmap_read_unlock(mm); 353 return ret; 354 } 355 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3490/3490] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:6: error: no previous prototype for function 'sxe_debugfs_entries_init'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: dd013ad487534c1838afc2f55efdb5daec15aace [3490/3490] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: arm64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082350.9BPj98cP-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 4125e73cdc6188cca4c1c72b72e2b2d85c157483) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082350.9BPj98cP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082350.9BPj98cP-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <built-in>:3: In file included from ././include/linux/compiler_types.h:150: ./include/linux/compiler-clang.h:33:9: error: '__SANITIZE_ADDRESS__' macro redefined [-Werror,-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:367:9: note: previous definition is here 367 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:11: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.h:15: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from ./include/linux/pci.h:1670: In file included from ./include/linux/dmapool.h:14: In file included from ./include/linux/scatterlist.h:8: In file included from ./include/linux/mm.h:2253: ./include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ ./include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:410:6: error: no previous prototype for function 'sxe_txrx_ring_enable' [-Werror,-Wmissing-prototypes] 410 | void sxe_txrx_ring_enable(struct sxe_adapter *adapter, u32 ring_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:410:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 410 | void sxe_txrx_ring_enable(struct sxe_adapter *adapter, u32 ring_idx) | ^ | static 6 errors generated. -- In file included from <built-in>:3: In file included from ././include/linux/compiler_types.h:150: ./include/linux/compiler-clang.h:33:9: error: '__SANITIZE_ADDRESS__' macro redefined [-Werror,-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:367:9: note: previous definition is here 367 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:14: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from ./include/linux/pci.h:1670: In file included from ./include/linux/dmapool.h:14: In file included from ./include/linux/scatterlist.h:8: In file included from ./include/linux/mm.h:2253: ./include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ ./include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:6: error: no previous prototype for function 'sxe_debugfs_entries_init' [-Werror,-Wmissing-prototypes] 432 | void sxe_debugfs_entries_init(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 432 | void sxe_debugfs_entries_init(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:459:6: error: no previous prototype for function 'sxe_debugfs_entries_exit' [-Werror,-Wmissing-prototypes] 459 | void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:459:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 459 | void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:465:6: error: no previous prototype for function 'sxe_debugfs_init' [-Werror,-Wmissing-prototypes] 465 | void sxe_debugfs_init(void) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:465:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 465 | void sxe_debugfs_init(void) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:470:6: error: no previous prototype for function 'sxe_debugfs_exit' [-Werror,-Wmissing-prototypes] 470 | void sxe_debugfs_exit(void) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:470:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 470 | void sxe_debugfs_exit(void) | ^ | static 9 errors generated. -- In file included from <built-in>:3: In file included from ././include/linux/compiler_types.h:150: ./include/linux/compiler-clang.h:33:9: error: '__SANITIZE_ADDRESS__' macro redefined [-Werror,-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:367:9: note: previous definition is here 367 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:11: In file included from ./include/linux/highmem.h:8: In file included from ./include/linux/cacheflush.h:5: In file included from ./arch/arm64/include/asm/cacheflush.h:11: In file included from ./include/linux/kgdb.h:19: In file included from ./include/linux/kprobes.h:28: In file included from ./include/linux/ftrace.h:13: In file included from ./include/linux/kallsyms.h:13: In file included from ./include/linux/mm.h:2253: ./include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ ./include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:20: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_filter.h:16: ./include/net/ip.h:466:14: error: default initialization of an object of type 'typeof (rt->dst.expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe] 466 | if (mtu && time_before(jiffies, rt->dst.expires)) | ^ ./include/linux/jiffies.h:135:26: note: expanded from macro 'time_before' 135 | #define time_before(a,b) time_after(b,a) | ^ ./include/linux/jiffies.h:125:3: note: expanded from macro 'time_after' 125 | (typecheck(unsigned long, a) && \ | ^ ./include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' 11 | typeof(x) __dummy2; \ | ^ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:5: error: no previous prototype for function 'sxe_reg_test' [-Werror,-Wmissing-prototypes] 2022 | int sxe_reg_test(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2022 | int sxe_reg_test(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2644:5: error: no previous prototype for function 'sxe_phys_id_set' [-Werror,-Wmissing-prototypes] 2644 | int sxe_phys_id_set(struct net_device *netdev, enum ethtool_phys_id_state state) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2644:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2644 | int sxe_phys_id_set(struct net_device *netdev, enum ethtool_phys_id_state state) | ^ | static 8 errors generated. -- In file included from <built-in>:3: In file included from ././include/linux/compiler_types.h:150: ./include/linux/compiler-clang.h:33:9: error: '__SANITIZE_ADDRESS__' macro redefined [-Werror,-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:367:9: note: previous definition is here 367 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:15: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_pci.h:14: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from ./include/linux/pci.h:1670: In file included from ./include/linux/dmapool.h:14: In file included from ./include/linux/scatterlist.h:8: In file included from ./include/linux/mm.h:2253: ./include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ ./include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:6: error: no previous prototype for function 'sxe_hw_no_snoop_disable' [-Werror,-Wmissing-prototypes] 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for function 'sxe_hw_uc_addr_pool_del' [-Werror,-Wmissing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for function 'sxe_hw_uc_addr_pool_enable' [-Werror,-Wmissing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for function 'sxe_hw_nic_reset' [-Werror,-Wmissing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for function 'sxe_hw_pf_rst_done_set' [-Werror,-Wmissing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for function 'sxe_hw_pending_irq_read_clear' [-Werror,-Wmissing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for function 'sxe_hw_pending_irq_write_clear' [-Werror,-Wmissing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for function 'sxe_hw_irq_cause_get' [-Werror,-Wmissing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for function 'sxe_hw_ring_irq_auto_disable' [-Werror,-Wmissing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for function 'sxe_hw_irq_general_reg_set' [-Werror,-Wmissing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for function 'sxe_hw_irq_general_reg_get' [-Werror,-Wmissing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for function 'sxe_hw_event_irq_map' [-Werror,-Wmissing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for function 'sxe_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for function 'sxe_hw_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. .. vim +/sxe_debugfs_entries_init +432 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c 431 > 432 void sxe_debugfs_entries_init(struct sxe_adapter *adapter) 433 { 434 struct dentry *dir; 435 const char *name = pci_name(adapter->pdev); 436 437 adapter->debugfs_entries = debugfs_create_dir(name, sxe_debugfs_root); 438 dir = debugfs_create_file("reg_ops", 0600, adapter->debugfs_entries, 439 adapter, &sxe_debugfs_reg_ops_fops); 440 if (!dir || dir == ERR_PTR(-ENODEV)) 441 LOG_INFO_BDF("debugfs:reg_ops file create failed\n"); 442 443 dir = debugfs_create_file("netdev_ops", 0600, adapter->debugfs_entries, 444 adapter, &sxe_debugfs_netdev_ops_fops); 445 if (!dir || dir == ERR_PTR(-ENODEV)) 446 LOG_INFO_BDF("debugfs:netdev_ops file create failed\n"); 447 448 dir = debugfs_create_file("hw_stats", 0400, adapter->debugfs_entries, 449 adapter, &sxe_debugfs_hw_stats_fops); 450 if (!dir || dir == ERR_PTR(-ENODEV)) 451 LOG_INFO_BDF("debugfs:hw_stats file create failed\n"); 452 453 dir = debugfs_create_file("sfp_info", 0400, adapter->debugfs_entries, 454 adapter, &sxe_debugfs_sfp_info_fops); 455 if (!dir || dir == ERR_PTR(-ENODEV)) 456 LOG_INFO_BDF("debugfs:sfp_info file create failed\n"); 457 } 458 > 459 void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) 460 { 461 debugfs_remove_recursive(adapter->debugfs_entries); 462 adapter->debugfs_entries = NULL; 463 } 464 > 465 void sxe_debugfs_init(void) 466 { 467 sxe_debugfs_root = debugfs_create_dir(SXE_DRV_NAME, NULL); 468 } 469 > 470 void sxe_debugfs_exit(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] ./include/linux/iommu.h:2001:40: warning: 'struct iommu_plb_gather' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: d46a4bd5bdfd7f1d6e2fa159398df4c54345070c [3493/3493] iommu/ummu-core: introduce iommu sva permission operation config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082342.kZY4UVlP-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082342.kZY4UVlP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082342.kZY4UVlP-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/fork.c:101: >> ./include/linux/iommu.h:2001:40: warning: 'struct iommu_plb_gather' declared inside parameter list will not be visible outside of this definition or declaration 2001 | struct iommu_plb_gather *plb_gather) {} | ^~~~~~~~~~~~~~~~ vim +2001 ./include/linux/iommu.h 1993 1994 static inline int iommu_sva_ungrant(struct iommu_sva *sva, void *va, 1995 size_t size, void *cookie) 1996 { 1997 return -EOPNOTSUPP; 1998 } 1999 static inline void iommu_plb_sync_all(struct iommu_domain *domain) {} 2000 static inline void iommu_plb_sync(struct iommu_domain *domain, > 2001 struct iommu_plb_gather *plb_gather) {} -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] drivers/acpi/cppc_acpi.c:1530: warning: Function parameter or member 'auto_act_window' not described in 'cppc_set_auto_act_window'
by kernel test robot 09 Dec '25

09 Dec '25

Hi heppen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: 6d474065f368e21b77526a5c30f5a1aed017142a [3386/3386] ACPI: CPPC: Add three register ABIs config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082313.2Za1o7Qf-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082313.2Za1o7Qf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082313.2Za1o7Qf-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/acpi/cppc_acpi.c:450: warning: Function parameter or member 'cpc_pptr' not described in '__acpi_get_psd_map' drivers/acpi/cppc_acpi.c:700: warning: Function parameter or member 'pcc_ss_id' not described in 'pcc_data_alloc' >> drivers/acpi/cppc_acpi.c:1530: warning: Function parameter or member 'auto_act_window' not described in 'cppc_set_auto_act_window' >> drivers/acpi/cppc_acpi.c:1530: warning: Excess function parameter 'enable' description in 'cppc_set_auto_act_window' >> drivers/acpi/cppc_acpi.c:1541: warning: Function parameter or member 'cpunum' not described in 'cppc_get_auto_act_window' >> drivers/acpi/cppc_acpi.c:1541: warning: Function parameter or member 'auto_act_window' not described in 'cppc_get_auto_act_window' >> drivers/acpi/cppc_acpi.c:1541: warning: Excess function parameter 'cpu' description in 'cppc_get_auto_act_window' >> drivers/acpi/cppc_acpi.c:1541: warning: Excess function parameter 'enable' description in 'cppc_get_auto_act_window' >> drivers/acpi/cppc_acpi.c:1552: warning: Function parameter or member 'auto_sel' not described in 'cppc_get_auto_sel' >> drivers/acpi/cppc_acpi.c:1552: warning: Excess function parameter 'enable' description in 'cppc_get_auto_sel' >> drivers/acpi/cppc_acpi.c:1575: warning: Function parameter or member 'epp_val' not described in 'cppc_set_epp' >> drivers/acpi/cppc_acpi.c:1575: warning: Excess function parameter 'enable' description in 'cppc_set_epp' drivers/acpi/cppc_acpi.c:1716: warning: Function parameter or member 'cpu_num' not described in 'cppc_get_transition_latency' vim +1530 drivers/acpi/cppc_acpi.c 1523 1524 /** 1525 * cppc_set_auto_act_window - Write autonomous act window register. 1526 * @cpu : CPU to which to write register. 1527 * @enable : the desired value of autonomous act window register to be updated. 1528 */ 1529 int cppc_set_auto_act_window(int cpu, u64 auto_act_window) > 1530 { 1531 return cppc_set_reg(cpu, AUTO_ACT_WINDOW, auto_act_window); 1532 } 1533 EXPORT_SYMBOL_GPL(cppc_set_auto_act_window); 1534 1535 /** 1536 * cppc_get_auto_act_window - Read autonomous act window register. 1537 * @cpu : CPU to which to write register. 1538 * @enable : the desired value of autonomous act window register to be updated. 1539 */ 1540 int cppc_get_auto_act_window(int cpunum, u64 *auto_act_window) > 1541 { 1542 return cppc_get_reg(cpunum, AUTO_ACT_WINDOW, auto_act_window); 1543 } 1544 EXPORT_SYMBOL_GPL(cppc_get_auto_act_window); 1545 1546 /** 1547 * cppc_get_auto_sel - Read autonomous selection register. 1548 * @cpunum : CPU to which to write register. 1549 * @enable : the desired value of autonomous selection resiter to be updated. 1550 */ 1551 int cppc_get_auto_sel(int cpunum, u64 *auto_sel) > 1552 { 1553 return cppc_get_reg(cpunum, AUTO_SEL_ENABLE, auto_sel); 1554 } 1555 EXPORT_SYMBOL_GPL(cppc_get_auto_sel); 1556 1557 1558 /** 1559 * cppc_set_auto_sel - Write autonomous selection register. 1560 * @cpu : CPU to which to write register. 1561 * @enable : the desired value of autonomous selection resiter to be updated. 1562 */ 1563 int cppc_set_auto_sel(int cpu, bool enable) 1564 { 1565 return cppc_set_reg(cpu, AUTO_SEL_ENABLE, enable); 1566 } 1567 EXPORT_SYMBOL_GPL(cppc_set_auto_sel); 1568 1569 /** 1570 * cppc_set_epp - Write energe perf register. 1571 * @cpu : CPU to which to write register. 1572 * @enable : the desired value of energe perf register to be updated. 1573 */ 1574 int cppc_set_epp(int cpu, u64 epp_val) > 1575 { 1576 return cppc_set_reg(cpu, ENERGY_PERF, epp_val); 1577 } 1578 EXPORT_SYMBOL_GPL(cppc_set_epp); 1579 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] arch/x86/kernel/cpu/proc.c:63:5: warning: no previous prototype for 'show_cpuinfo'
by kernel test robot 09 Dec '25

09 Dec '25

Hi GONG, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 9d3b0e8891b8b3450a7cd6d1367946a1c69e4eb9 [3493/3493] bpf: Add cpuinfo_x86 iterator target config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082137.XtPdHfzc-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082137.XtPdHfzc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082137.XtPdHfzc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kernel/cpu/proc.c:63:5: warning: no previous prototype for 'show_cpuinfo' [-Wmissing-prototypes] 63 | int show_cpuinfo(struct seq_file *m, void *v) | ^~~~~~~~~~~~ vim +/show_cpuinfo +63 arch/x86/kernel/cpu/proc.c 62 > 63 int show_cpuinfo(struct seq_file *m, void *v) 64 { 65 struct cpuinfo_x86 *c = v; 66 unsigned int cpu; 67 int i; 68 69 cpu = c->cpu_index; 70 seq_printf(m, "processor\t: %u\n" 71 "vendor_id\t: %s\n" 72 "cpu family\t: %d\n" 73 "model\t\t: %u\n" 74 "model name\t: %s\n", 75 cpu, 76 c->x86_vendor_id[0] ? c->x86_vendor_id : "unknown", 77 c->x86, 78 c->x86_model, 79 c->x86_model_id[0] ? c->x86_model_id : "unknown"); 80 81 if (c->x86_stepping || c->cpuid_level >= 0) 82 seq_printf(m, "stepping\t: %d\n", c->x86_stepping); 83 else 84 seq_puts(m, "stepping\t: unknown\n"); 85 if (c->microcode) 86 seq_printf(m, "microcode\t: 0x%x\n", c->microcode); 87 88 if (cpu_has(c, X86_FEATURE_TSC)) { 89 unsigned int freq = arch_freq_get_on_cpu(cpu); 90 91 seq_printf(m, "cpu MHz\t\t: %u.%03u\n", freq / 1000, (freq % 1000)); 92 } 93 94 /* Cache size */ 95 if (c->x86_cache_size) 96 seq_printf(m, "cache size\t: %u KB\n", c->x86_cache_size); 97 98 show_cpuinfo_core(m, c, cpu); 99 show_cpuinfo_misc(m, c); 100 101 seq_puts(m, "flags\t\t:"); 102 for (i = 0; i < 32*NCAPINTS; i++) 103 if (cpu_has(c, i) && x86_cap_flags[i] != NULL) { 104 if (c->x86_vendor == X86_VENDOR_HYGON) 105 seq_printf(m, " %s", i == X86_FEATURE_SEV ? "csv" : 106 (i == X86_FEATURE_SEV_ES ? "csv2" : 107 x86_cap_flags[i])); 108 else 109 seq_printf(m, " %s", x86_cap_flags[i]); 110 } 111 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] arch/x86/mm/kasan_init_64.c:128:15: warning: variable 'p' set but not used
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: 68ee705da160d123656dcbf9ebd449fb77b54bc0 [3386/3386] scripts: kernel-doc: Fix syntax error due to undeclared args variable config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082005.aJ6IUacC-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082005.aJ6IUacC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082005.aJ6IUacC-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/mm/kasan_init_64.c: In function 'kasan_populate_pgd': >> arch/x86/mm/kasan_init_64.c:128:15: warning: variable 'p' set but not used [-Wunused-but-set-variable] 128 | void *p; | ^ arch/x86/mm/kasan_init_64.c: In function 'kasan_shallow_populate_pgds': arch/x86/mm/kasan_init_64.c:270:15: warning: variable 'p' set but not used [-Wunused-but-set-variable] 270 | void *p; | ^ -- lib/test_blackhole_dev.c: In function 'test_blackholedev_init': >> lib/test_blackhole_dev.c:32:24: warning: variable 'ethh' set but not used [-Wunused-but-set-variable] 32 | struct ethhdr *ethh; | ^~~~ -- >> drivers/acpi/cppc_acpi.c:450: warning: Function parameter or member 'cpc_pptr' not described in '__acpi_get_psd_map' drivers/acpi/cppc_acpi.c:700: warning: Function parameter or member 'pcc_ss_id' not described in 'pcc_data_alloc' drivers/acpi/cppc_acpi.c:1566: warning: Function parameter or member 'cpu_num' not described in 'cppc_get_transition_latency' -- >> net/netfilter/nf_tables_api.c:9162: warning: Function parameter or member 'preg' not described in 'nft_parse_register' vim +/p +128 arch/x86/mm/kasan_init_64.c 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 124 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 125 static void __init kasan_populate_pgd(pgd_t *pgd, unsigned long addr, 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 126 unsigned long end, int nid) 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 127 { 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 @128 void *p; 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 129 p4d_t *p4d; 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 130 unsigned long next; 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 131 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 132 if (pgd_none(*pgd)) { 0d39e2669d7b0f Andrey Ryabinin 2018-01-10 133 p = early_alloc(PAGE_SIZE, nid, true); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 134 pgd_populate(&init_mm, pgd, p); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 135 } 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 136 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 137 p4d = p4d_offset(pgd, addr); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 138 do { 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 139 next = p4d_addr_end(addr, end); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 140 kasan_populate_p4d(p4d, addr, next, nid); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 141 } while (p4d++, addr = next, addr != end); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 142 } 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 143 :::::: The code at line 128 was first introduced by commit :::::: 2aeb07365bcd489620f71390a7d2031cd4dfb83e x86/mm/kasan: Don't use vmemmap_populate() to initialize shadow :::::: TO: Andrey Ryabinin <aryabinin(a)virtuozzo.com> :::::: CC: Ingo Molnar <mingo(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] drivers/ata/ahci_zhaoxin_sgpio.c:31:5: warning: no previous prototype for 'ahci_wait_em_reset'
by kernel test robot 09 Dec '25

09 Dec '25

Hi leoliu-oc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: fb43492008c11fe89e510dd63383a2d37ea3cf8e [3493/3493] ata: ahci: Add support for AHCI SGPIO Enclosure Management config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512081930.DAECHxia-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081930.DAECHxia-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081930.DAECHxia-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ata/ahci_zhaoxin_sgpio.c:31:5: warning: no previous prototype for 'ahci_wait_em_reset' [-Wmissing-prototypes] 31 | int ahci_wait_em_reset(struct sgpio_zhaoxin *sgpio_zhaoxin, u32 retry) | ^~~~~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:55:6: warning: no previous prototype for 'ahci_zhaoxin_set_em_sgpio' [-Wmissing-prototypes] 55 | void ahci_zhaoxin_set_em_sgpio(struct sgpio_zhaoxin *sgpio_zhaoxin) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:99:6: warning: no previous prototype for 'ahci_zhaoxin_set_em_sgpio_gpmode' [-Wmissing-prototypes] 99 | void ahci_zhaoxin_set_em_sgpio_gpmode(struct sgpio_zhaoxin *sgpio_zhaoxin) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:601:6: warning: no previous prototype for 'set_em_messages' [-Wmissing-prototypes] 601 | void set_em_messages(struct sgpio_zhaoxin *sgpio_zhaoxin) | ^~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:621:5: warning: no previous prototype for 'add_sgpio_zhaoxin' [-Wmissing-prototypes] 621 | int add_sgpio_zhaoxin(void) | ^~~~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:673:6: warning: no previous prototype for 'remove_sgpio_zhaoxin' [-Wmissing-prototypes] 673 | void remove_sgpio_zhaoxin(void) | ^~~~~~~~~~~~~~~~~~~~ vim +/ahci_wait_em_reset +31 drivers/ata/ahci_zhaoxin_sgpio.c 25 26 static unsigned int zhaoxin_em_type __read_mostly = AHCI_EM_MSG_LED_MODE; /*LED protocol*/ 27 module_param(zhaoxin_em_type, int, 0644); 28 MODULE_PARM_DESC(zhaoxin_em_type, 29 "AHCI Enclosure Management Message type control (1 = led on, 2 = sgpio on,3 = sgpio gp on)"); 30 > 31 int ahci_wait_em_reset(struct sgpio_zhaoxin *sgpio_zhaoxin, u32 retry) 32 { 33 void __iomem *mmio = sgpio_zhaoxin->mmio; 34 u32 em_ctl; 35 36 if (!sgpio_zhaoxin || retry == 0) { 37 pr_err("In ahci wait em reset, invalid param\n"); 38 return -EINVAL; 39 } 40 41 while (retry--) { /*EM_CTL needs reset at least 64ms*/ 42 em_ctl = readl(mmio + HOST_EM_CTL); 43 if (em_ctl & EM_CTL_RST) 44 usleep_range(10000, 20000); /*EM_CTL still in reset, usleep 10ms*/ 45 else 46 break; 47 48 if (!retry) 49 pr_err("Wait for EM_CTL reset, time out\n"); 50 } 51 52 return 0; 53 } 54 > 55 void ahci_zhaoxin_set_em_sgpio(struct sgpio_zhaoxin *sgpio_zhaoxin) 56 { 57 void __iomem *mmio = sgpio_zhaoxin->mmio; 58 void __iomem *em_mmio = mmio + SGPIO_OFFSET; 59 60 u32 read; 61 62 sgpio_zhaoxin->sgpio_reg.cfg_0.enable = 1; 63 64 sgpio_zhaoxin->sgpio_reg.cfg_1.blink_gen_a = 0x7; 65 sgpio_zhaoxin->sgpio_reg.cfg_1.blink_gen_b = 0x3; 66 sgpio_zhaoxin->sgpio_reg.cfg_1.blink_gen_c = 0x0; 67 sgpio_zhaoxin->sgpio_reg.cfg_1.stretch_act_on = 0; 68 sgpio_zhaoxin->sgpio_reg.cfg_1.stretch_act_off = 0; 69 sgpio_zhaoxin->sgpio_reg.cfg_1.max_act_on = 2; 70 sgpio_zhaoxin->sgpio_reg.cfg_1.force_act_off = 1; 71 72 sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.sload = 0xf; 73 sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.count = 0x0; 74 75 sgpio_zhaoxin->sgpio_reg.transmit_0.sgpio_tx_0 = 0; 76 sgpio_zhaoxin->sgpio_reg.transmit_1.sgpio_tx_1 = 0; 77 sgpio_zhaoxin->sgpio_reg.gp_transmit_reg.sgpio_tx_gp = 0; 78 79 sgpio_zhaoxin->sgpio_reg.receive_reg.sgpio_rx = 0x07070707; 80 sgpio_zhaoxin->sgpio_reg.gp_receive_reg.sgpio_rx_gp = 0; 81 82 /*Setup SGPIO type*/ 83 read = readl(mmio + sgpio_zhaoxin->em_loc); 84 read = read | SGPIO_MESSAGE_HEAD; /*LED register MSG_HEAD, select SGPIO*/ 85 writel(read, mmio + sgpio_zhaoxin->em_loc); 86 87 /*Setup gp mode*/ 88 writel(sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.sgpio_tx_gp_cfg, em_mmio + 0x38); 89 90 /*Initial SGPIO CFG1*/ 91 writel(sgpio_zhaoxin->sgpio_reg.cfg_1.sgpio_cfg_1, em_mmio + 0x4); 92 93 /*Initial SGPIO CFG0*/ 94 read = readl(em_mmio); 95 read |= sgpio_zhaoxin->sgpio_reg.cfg_0.sgpio_cfg_0; 96 writel(read, em_mmio); 97 } 98 > 99 void ahci_zhaoxin_set_em_sgpio_gpmode(struct sgpio_zhaoxin *sgpio_zhaoxin) 100 { 101 void __iomem *mmio = sgpio_zhaoxin->mmio; 102 void __iomem *em_mmio = mmio + SGPIO_OFFSET; 103 u32 read; 104 105 sgpio_zhaoxin->sgpio_reg.cfg_0.enable = 1; 106 107 sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.sload = 0xf; 108 sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.count = 0xff; 109 110 sgpio_zhaoxin->sgpio_reg.transmit_0.sgpio_tx_0 = 0; 111 sgpio_zhaoxin->sgpio_reg.transmit_1.sgpio_tx_1 = 0; 112 sgpio_zhaoxin->sgpio_reg.gp_transmit_reg.sgpio_tx_gp = 0; 113 114 sgpio_zhaoxin->sgpio_reg.receive_reg.sgpio_rx = 0; 115 sgpio_zhaoxin->sgpio_reg.gp_receive_reg.sgpio_rx_gp = 0xff0f0000; 116 117 /*Setup SGPIO type*/ 118 read = readl(mmio + sgpio_zhaoxin->em_loc); 119 read |= SGPIO_MESSAGE_HEAD; 120 writel(read, mmio + sgpio_zhaoxin->em_loc); 121 122 /*Setup gp mode*/ 123 writel(sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.sgpio_tx_gp_cfg, em_mmio + 0x38); 124 125 /*Enable SGPIO*/ 126 writel(sgpio_zhaoxin->sgpio_reg.cfg_0.sgpio_cfg_0, em_mmio); 127 } 128 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3485/3485] drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c:281:57: warning: diagnostic behavior may be improved by adding the 'format(printf, 1, 2)' attribute to the declaration of 'kbox_dump_printk_info'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: cd2978286f40089fcd83f74ffdff733bfbe1e52a [3485/3485] Huawei BMA: Adding Huawei BMA driver: host_kbox_drv config: loongarch-allyesconfig (https://download.01.org/0day-ci/archive/20251209/202512090240.NdebMvOZ-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 000e46219ba1ee53fc42d35e00c314c2807e8b14) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090240.NdebMvOZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090240.NdebMvOZ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c:20: In file included from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h:21: In file included from include/linux/netdevice.h:38: In file included from include/net/net_namespace.h:43: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/loongarch/include/asm/cacheflush.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c:281:57: warning: diagnostic behavior may be improved by adding the 'format(printf, 1, 2)' attribute to the declaration of 'kbox_dump_printk_info' [-Wmissing-format-attribute] 281 | num = vsnprintf(tmp_buf, sizeof(tmp_buf) - 1, fmt, args); | ^ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.h:30:6: note: 'kbox_dump_printk_info' declared here 30 | int kbox_dump_printk_info(const char *fmt, ...); | ^ 6 warnings generated. -- In file included from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.c:20: In file included from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h:21: In file included from include/linux/netdevice.h:38: In file included from include/net/net_namespace.h:43: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/loongarch/include/asm/cacheflush.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.c:85:57: warning: diagnostic behavior may be improved by adding the 'format(printf, 1, 2)' attribute to the declaration of 'kbox_dump_painc_info' [-Wmissing-format-attribute] 85 | num = vsnprintf(tmp_buf, sizeof(tmp_buf) - 1, fmt, args); | ^ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.h:21:5: note: 'kbox_dump_painc_info' declared here 21 | int kbox_dump_painc_info(const char *fmt, ...); | ^ 6 warnings generated. vim +281 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c 270 271 int kbox_dump_printk_info(const char *fmt, ...) 272 { 273 va_list args; 274 int num = 0; 275 char tmp_buf[TMP_BUF_SIZE] = { }; 276 277 if (g_printk_init_ok != KBOX_TRUE) 278 return 0; 279 280 va_start(args, fmt); > 281 num = vsnprintf(tmp_buf, sizeof(tmp_buf) - 1, fmt, args); 282 if (num >= 0) 283 (void)kbox_duplicate_printk_info(tmp_buf, num); 284 285 va_end(args); 286 287 return num; 288 } 289 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3485/3485] lib/../mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 5d638f251ef64f68766caaeaf41fbe159807b392 [3485/3485] mm: shrinker: add infrastructure for dynamically allocating shrinker config: arm64-randconfig-004-20251208 (https://download.01.org/0day-ci/archive/20251209/202512090019.r12ZqVrM-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 000e46219ba1ee53fc42d35e00c314c2807e8b14) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090019.r12ZqVrM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090019.r12ZqVrM-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from lib/vsprintf.c:50: >> lib/../mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ lib/../mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ 1 warning generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] vim +1522 lib/../mm/internal.h 1513 1514 /* shrinker related functions */ 1515 unsigned long shrink_slab(gfp_t gfp_mask, int nid, struct mem_cgroup *memcg, 1516 int priority); 1517 1518 #ifdef CONFIG_SHRINKER_DEBUG 1519 static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, 1520 const char *fmt, va_list ap) 1521 { > 1522 shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); 1523 1524 return shrinker->name ? 0 : -ENOMEM; 1525 } 1526 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/gmem.c:383:13: warning: unused variable 'nid'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 18b5064b5892580f89d7eca015f884ce10190bac [3493/3493] gmem: hmemcpy should use dma for phy addr config: x86_64-randconfig-161-20251208 (https://download.01.org/0day-ci/archive/20251209/202512090002.kbElJ2I7-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090002.kbElJ2I7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090002.kbElJ2I7-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/gmem.c: In function 'gm_as_attach': >> mm/gmem.c:383:13: warning: unused variable 'nid' [-Wunused-variable] 383 | int nid; | ^~~ vim +/nid +383 mm/gmem.c 380709c322aaa3 Cunshu Ni 2025-11-01 378 380709c322aaa3 Cunshu Ni 2025-11-01 379 int gm_as_attach(struct gm_as *as, struct gm_dev *dev, 380709c322aaa3 Cunshu Ni 2025-11-01 380 bool activate, struct gm_context **out_ctx) 380709c322aaa3 Cunshu Ni 2025-11-01 381 { 380709c322aaa3 Cunshu Ni 2025-11-01 382 struct gm_context *ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 @383 int nid; 380709c322aaa3 Cunshu Ni 2025-11-01 384 380709c322aaa3 Cunshu Ni 2025-11-01 385 ctx = kmem_cache_alloc(gm_ctx_cache, GFP_KERNEL); 380709c322aaa3 Cunshu Ni 2025-11-01 386 if (!ctx) 380709c322aaa3 Cunshu Ni 2025-11-01 387 return -ENOMEM; 380709c322aaa3 Cunshu Ni 2025-11-01 388 380709c322aaa3 Cunshu Ni 2025-11-01 389 ctx->as = as; 380709c322aaa3 Cunshu Ni 2025-11-01 390 ctx->dev = dev; 380709c322aaa3 Cunshu Ni 2025-11-01 391 380709c322aaa3 Cunshu Ni 2025-11-01 392 INIT_LIST_HEAD(&ctx->gm_dev_link); 380709c322aaa3 Cunshu Ni 2025-11-01 393 INIT_LIST_HEAD(&ctx->gm_as_link); 380709c322aaa3 Cunshu Ni 2025-11-01 394 380709c322aaa3 Cunshu Ni 2025-11-01 395 if (!list_empty(&as->gm_ctx_list)) { 380709c322aaa3 Cunshu Ni 2025-11-01 396 struct list_head *old_node; 380709c322aaa3 Cunshu Ni 2025-11-01 397 struct gm_context *old_ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 398 380709c322aaa3 Cunshu Ni 2025-11-01 399 old_node = as->gm_ctx_list.prev; 380709c322aaa3 Cunshu Ni 2025-11-01 400 list_del_init(old_node); 380709c322aaa3 Cunshu Ni 2025-11-01 401 old_ctx = list_entry(old_node, struct gm_context, gm_as_link); 380709c322aaa3 Cunshu Ni 2025-11-01 402 kfree(old_ctx); 380709c322aaa3 Cunshu Ni 2025-11-01 403 } 380709c322aaa3 Cunshu Ni 2025-11-01 404 380709c322aaa3 Cunshu Ni 2025-11-01 405 list_add_tail(&dev->gm_ctx_list, &ctx->gm_dev_link); 380709c322aaa3 Cunshu Ni 2025-11-01 406 list_add_tail(&ctx->gm_as_link, &as->gm_ctx_list); 380709c322aaa3 Cunshu Ni 2025-11-01 407 380709c322aaa3 Cunshu Ni 2025-11-01 408 if (activate) { 380709c322aaa3 Cunshu Ni 2025-11-01 409 /* 380709c322aaa3 Cunshu Ni 2025-11-01 410 * Here we should really have a callback function to perform the context switch 380709c322aaa3 Cunshu Ni 2025-11-01 411 * for the hardware. E.g. in x86 this function is effectively 380709c322aaa3 Cunshu Ni 2025-11-01 412 * flushing the CR3 value. Currently we do not care time-sliced context switch, 380709c322aaa3 Cunshu Ni 2025-11-01 413 * unless someone wants to support it. 380709c322aaa3 Cunshu Ni 2025-11-01 414 */ 380709c322aaa3 Cunshu Ni 2025-11-01 415 dev->current_ctx = ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 416 } 380709c322aaa3 Cunshu Ni 2025-11-01 417 *out_ctx = ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 418 380709c322aaa3 Cunshu Ni 2025-11-01 419 /* 380709c322aaa3 Cunshu Ni 2025-11-01 420 * gm_as_attach will be used to attach device to process address space. 380709c322aaa3 Cunshu Ni 2025-11-01 421 * Handle this case and add hnodes registered by device to process mems_allowed. 380709c322aaa3 Cunshu Ni 2025-11-01 422 */ 18b5064b589258 Ni Cunshu 2025-12-08 423 #ifdef CONFIG_CPUSETS 380709c322aaa3 Cunshu Ni 2025-11-01 424 for_each_node_mask(nid, dev->registered_hnodes) 380709c322aaa3 Cunshu Ni 2025-11-01 425 node_set(nid, current->mems_allowed); 18b5064b589258 Ni Cunshu 2025-12-08 426 #endif 380709c322aaa3 Cunshu Ni 2025-11-01 427 return 0; 380709c322aaa3 Cunshu Ni 2025-11-01 428 } 380709c322aaa3 Cunshu Ni 2025-11-01 429 EXPORT_SYMBOL_GPL(gm_as_attach); 2ce9e864fa288b Cunshu Ni 2025-11-02 430 :::::: The code at line 383 was first introduced by commit :::::: 380709c322aaa306b5ac3c278a0700043f7d33e2 gmem: prepare config, boot parameter, vma flag and basic GMEM related structs :::::: TO: Cunshu Ni <nicunshu(a)huawei.com> :::::: CC: zhangjian <zhangjian496(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] include/linux/string.h:290:33: warning: '__builtin_strncpy' specified bound depends on the length of the source argument
by kernel test robot 08 Dec '25

08 Dec '25

Hi Weili, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: a1666f44c2250f7413e73e2f4c02cb2c01f9e3b0 [3386/3386] crypto: hisilicon/qm - support no-sva feature config: arm64-randconfig-r054-20251208 (https://download.01.org/0day-ci/archive/20251208/202512082302.Kf4xjvAw-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082302.Kf4xjvAw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082302.Kf4xjvAw-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/bitmap.h:9, from include/linux/cpumask.h:12, from include/linux/smp.h:13, from include/linux/lockdep.h:14, from include/linux/mutex.h:17, from include/linux/kernfs.h:13, from include/linux/sysfs.h:17, from include/linux/kobject.h:21, from include/linux/of.h:17, from include/linux/irqdomain.h:35, from include/linux/acpi.h:13, from drivers/crypto/hisilicon/qm.c:4: In function 'strncpy', inlined from 'qm_alloc_uacce' at drivers/crypto/hisilicon/qm.c:2755:2: >> include/linux/string.h:290:33: warning: '__builtin_strncpy' specified bound depends on the length of the source argument [-Wstringop-truncation] 290 | #define __underlying_strncpy __builtin_strncpy | ^ include/linux/string.h:300:16: note: in expansion of macro '__underlying_strncpy' 300 | return __underlying_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~ In function 'strlen', inlined from 'qm_alloc_uacce' at drivers/crypto/hisilicon/qm.c:2748:13: include/linux/string.h:288:33: note: length computed here 288 | #define __underlying_strlen __builtin_strlen | ^ include/linux/string.h:321:24: note: in expansion of macro '__underlying_strlen' 321 | return __underlying_strlen(p); | ^~~~~~~~~~~~~~~~~~~ vim +/__builtin_strncpy +290 include/linux/string.h 47227d27e2fcb0 Daniel Axtens 2020-06-03 268 47227d27e2fcb0 Daniel Axtens 2020-06-03 269 #ifdef CONFIG_KASAN 47227d27e2fcb0 Daniel Axtens 2020-06-03 270 extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr); 47227d27e2fcb0 Daniel Axtens 2020-06-03 271 extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp); 47227d27e2fcb0 Daniel Axtens 2020-06-03 272 extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 273 extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove); 47227d27e2fcb0 Daniel Axtens 2020-06-03 274 extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset); 47227d27e2fcb0 Daniel Axtens 2020-06-03 275 extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat); 47227d27e2fcb0 Daniel Axtens 2020-06-03 276 extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 277 extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen); 47227d27e2fcb0 Daniel Axtens 2020-06-03 278 extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat); 47227d27e2fcb0 Daniel Axtens 2020-06-03 279 extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 280 #else 47227d27e2fcb0 Daniel Axtens 2020-06-03 281 #define __underlying_memchr __builtin_memchr 47227d27e2fcb0 Daniel Axtens 2020-06-03 282 #define __underlying_memcmp __builtin_memcmp 47227d27e2fcb0 Daniel Axtens 2020-06-03 283 #define __underlying_memcpy __builtin_memcpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 284 #define __underlying_memmove __builtin_memmove 47227d27e2fcb0 Daniel Axtens 2020-06-03 285 #define __underlying_memset __builtin_memset 47227d27e2fcb0 Daniel Axtens 2020-06-03 286 #define __underlying_strcat __builtin_strcat 47227d27e2fcb0 Daniel Axtens 2020-06-03 287 #define __underlying_strcpy __builtin_strcpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 288 #define __underlying_strlen __builtin_strlen 47227d27e2fcb0 Daniel Axtens 2020-06-03 289 #define __underlying_strncat __builtin_strncat 47227d27e2fcb0 Daniel Axtens 2020-06-03 @290 #define __underlying_strncpy __builtin_strncpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 291 #endif 47227d27e2fcb0 Daniel Axtens 2020-06-03 292 :::::: The code at line 290 was first introduced by commit :::::: 47227d27e2fcb01a9e8f5958d8997cf47a820afc string.h: fix incompatibility between FORTIFY_SOURCE and KASAN :::::: TO: Daniel Axtens <dja(a)axtens.net> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 08 Dec '25

08 Dec '25

Zicheng Qu (8): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free include/linux/xsched.h | 27 ++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 7 ++ kernel/xsched/cgroup.c | 219 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 18 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 185 insertions(+), 129 deletions(-) -- 2.34.1

2 9

[PATCH OLK-6.6 0/1] Fix UAF issue for mfs
by Hongbo Li 08 Dec '25

08 Dec '25

Fix one UAF issue for mfs. Hongbo Li (1): mfs: Fix UAF problem on event object when enable tracepoint fs/mfs/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] zcopy: Fix NULL pointer dereference while attach conflict with free
by Liu Mingrui 08 Dec '25

08 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBKGM -------------------------------- Add mm_read_lock to avoid conflict between attach and free. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000020300acd7000 [0000000000000000] pgd=0800203008421403, p4d=0800203008421403, pud=0800203008422403, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP CPU: 107 PID: 151805 Comm: ioctl_zcopy_too Kdump: loaded Not tainted 6.6.0-f3180605d2a8 #1 Hardware name: Huawei Taishan 2280 V2/BC82AMDD, BIOS 6.57 05/17/2023 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : attach_pte_range+0x190/0x9a0 [zcopy] lr : attach_pte_range+0xd4/0x9a0 [zcopy] sp : ffff8000be8abb20 x29: ffff8000be8abb80 x28: 0000ffff90e00000 x27: ffffa651cb444d08 x26: 0400000000000001 x25: 0000000000000000 x24: ffff203017961000 x23: 0000ffff87400000 x22: 0010000000000001 x21: fffffc80c05e5840 x20: ffff2020259111d0 x19: ffffa651cb443c40 x18: ffff8000be8ab9b0 x17: 0000000000000000 x16: ffffa651e40182b0 x15: ffffffffffffffbc x14: ffffa651e8b17c58 x13: ffff20301695a000 x12: ffffa651cb444a58 x11: 0000000000000154 x10: 0000ffff91000000 x9 : ffffa651cb43e574 x8 : 0000000000000000 x7 : ffff20300758a880 x6 : 0000000000200000 x5 : ffff203008b1b438 x4 : 0000000000000001 x3 : 00000000000001da x2 : fffffc0000000000 x1 : 0000000000000000 x0 : 00000000000001da Call trace: attach_pte_range+0x190/0x9a0 [zcopy] attach_page_range+0x22c/0x618 [zcopy] attach_pages+0x2b8/0x8b8 [zcopy] zcopy_ioctl+0xe8/0x168 [zcopy] vfs_ioctl+0x3c/0xa8 __se_sys_ioctl+0x12c/0x160 __arm64_sys_ioctl+0x40/0x68 invoke_syscall+0x8c/0x1d0 el0_svc_common.constprop.0+0x64/0x1d0 do_el0_svc+0x54/0xe0 el0_slow_syscall+0x44/0x1e8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x188/0x190 Fixes: 8d543a8e74d5 ("zcopy: Introduce the pageattach interface") Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/misc/zcopy/zcopy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/misc/zcopy/zcopy.c b/drivers/misc/zcopy/zcopy.c index f4c56ce07e66..48c0702b96e5 100644 --- a/drivers/misc/zcopy/zcopy.c +++ b/drivers/misc/zcopy/zcopy.c @@ -709,7 +709,9 @@ static int attach_pages(unsigned long dst_addr, unsigned long src_addr, } trace_attach_page_range_start(dst_mm, src_mm, dst_addr, src_addr, size); + mmap_read_lock(src_mm); ret = attach_page_range(dst_mm, src_mm, dst_addr, src_addr, size); + mmap_read_unlock(src_mm); trace_attach_page_range_end(dst_mm, src_mm, dst_addr, src_addr, ret); unpin_user_pages_dirty_lock(process_pages, pinned_pages, 0); -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] Fix invalid paging request while attach transhugepage to same addr
by Liu Mingrui 08 Dec '25

08 Dec '25

zcopy: Fix invalid paging request while attach transhugepage to same addr Liu Mingrui (1): zcopy: Fix invalid paging request while attach transhugepage to same addr drivers/misc/zcopy/zcopy.c | 96 ++++++++++++++------------------------ 1 file changed, 34 insertions(+), 62 deletions(-) -- 2.25.1

2 2

[PATCH OLK-6.6] KVM: arm64: Check the untrusted offset in FF-A memory share
by Luo Gengkun 08 Dec '25

08 Dec '25

From: Sebastian Ene <sebastianene(a)google.com> stable inclusion from stable-v6.6.118 commit fc3139d9f4c1fe1c7d5f25f99676bd8e9c6a1041 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDATPN CVE: CVE-2025-40266 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 103e17aac09cdd358133f9e00998b75d6c1f1518 upstream. Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel. Signed-off-by: Sebastian Ene <sebastianene(a)google.com> Acked-by: Will Deacon <will(a)kernel.org> Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com Signed-off-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c index 8d21ab904f1a..eacf4ba1d88e 100644 --- a/arch/arm64/kvm/hyp/nvhe/ffa.c +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c @@ -425,7 +425,7 @@ static void __do_ffa_mem_xfer(const u64 func_id, DECLARE_REG(u32, npages_mbz, ctxt, 4); struct ffa_composite_mem_region *reg; struct ffa_mem_region *buf; - u32 offset, nr_ranges; + u32 offset, nr_ranges, checked_offset; int ret = 0; if (addr_mbz || npages_mbz || fraglen > len || @@ -460,7 +460,12 @@ static void __do_ffa_mem_xfer(const u64 func_id, goto out_unlock; } - if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) { + if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) { + ret = FFA_RET_INVALID_PARAMETERS; + goto out_unlock; + } + + if (fraglen < checked_offset) { ret = FFA_RET_INVALID_PARAMETERS; goto out_unlock; } -- 2.34.1

2 1

[PATCH OLK-6.6] NFSD: free copynotify stateid in nfs4_free_ol_stateid()
by Li Lingfeng 08 Dec '25

08 Dec '25

From: Olga Kornievskaia <okorniev(a)redhat.com> stable inclusion from stable-v6.6.117 commit 29fbb3ad4018ca2b0988fbac76f4c694cc6d7e66 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6RK CVE: CVE-2025-40273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream. Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs Reported-by: rtm(a)csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@orac… Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable(a)vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index a813c1123b37..e7c3997a9f5e 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1496,7 +1496,8 @@ static void nfs4_free_ol_stateid(struct nfs4_stid *stid) release_all_access(stp); if (stp->st_stateowner) nfs4_put_stateowner(stp->st_stateowner); - WARN_ON(!list_empty(&stid->sc_cp_list)); + if (!list_empty(&stid->sc_cp_list)) + nfs4_free_cpntf_statelist(stid->sc_client->net, stid); kmem_cache_free(stateid_slab, stid); } -- 2.46.1

2 1

[PATCH OLK-5.10] NFSD: free copynotify stateid in nfs4_free_ol_stateid()
by Li Lingfeng 08 Dec '25

08 Dec '25

From: Olga Kornievskaia <okorniev(a)redhat.com> stable inclusion from stable-v5.10.247 commit 935a2dc8928670bb2c37e21025331e61ec48ccf4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6RK CVE: CVE-2025-40273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream. Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs Reported-by: rtm(a)csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@orac… Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable(a)vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 6c0c5de24cf4..302bbad5cdc6 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1370,7 +1370,8 @@ static void nfs4_free_ol_stateid(struct nfs4_stid *stid) release_all_access(stp); if (stp->st_stateowner) nfs4_put_stateowner(stp->st_stateowner); - WARN_ON(!list_empty(&stid->sc_cp_list)); + if (!list_empty(&stid->sc_cp_list)) + nfs4_free_cpntf_statelist(stid->sc_client->net, stid); kmem_cache_free(stateid_slab, stid); } -- 2.46.1

2 1

[PATCH OLK-6.6 0/6] xsched: XCU Partition
by Zicheng Qu 08 Dec '25

08 Dec '25

Zicheng Qu (6): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation include/linux/xsched.h | 27 ++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 7 ++ kernel/xsched/cgroup.c | 219 +++++++++++++++++++++----------------- 4 files changed, 179 insertions(+), 105 deletions(-) -- 2.34.1

2 7

[openeuler:OLK-6.6 3485/3485] mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc'
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b3214ddbe58a44bd3829617668a8d301c8f1994e commit: 5d638f251ef64f68766caaeaf41fbe159807b392 [3485/3485] mm: shrinker: add infrastructure for dynamically allocating shrinker config: arm64-randconfig-004-20251208 (https://download.01.org/0day-ci/archive/20251208/202512081644.0Feaab8s-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 000e46219ba1ee53fc42d35e00c314c2807e8b14) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081644.0Feaab8s-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081644.0Feaab8s-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/secretmem.c:26: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ 1 warning generated. -- In file included from mm/page_alloc.c:59: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/page_alloc.c:7210:20: warning: unused function 'has_unaccepted_memory' [-Wunused-function] 7210 | static inline bool has_unaccepted_memory(void) | ^~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. -- In file included from mm/shrinker.c:7: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ >> mm/shrinker.c:565:53: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 3)' attribute to the declaration of 'shrinker_alloc' [-Wmissing-format-attribute] 565 | err = shrinker_debugfs_name_alloc(shrinker, fmt, ap); | ^ include/linux/shrinker.h:111:18: note: 'shrinker_alloc' declared here 111 | struct shrinker *shrinker_alloc(unsigned int flags, const char *fmt, ...); | ^ 2 warnings generated. -- In file included from mm/list_lru.c:16: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/list_lru.c:98:20: warning: unused function 'list_lru_memcg_aware' [-Wunused-function] 98 | static inline bool list_lru_memcg_aware(struct list_lru *lru) | ^~~~~~~~~~~~~~~~~~~~ 2 warnings generated. -- In file included from mm/madvise.c:37: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/madvise.c:285:6: warning: no previous prototype for function 'force_swapin_vma' [-Wmissing-prototypes] 285 | void force_swapin_vma(struct vm_area_struct *vma) | ^ mm/madvise.c:285:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 285 | void force_swapin_vma(struct vm_area_struct *vma) | ^ | static 2 warnings generated. -- In file included from mm/memblock.c:23: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/memblock.c:1444:20: warning: no previous prototype for function 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] 1444 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ mm/memblock.c:1444:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1444 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ | static 2 warnings generated. -- In file included from mm/mempolicy.c:111: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/mempolicy.c:1123:25: warning: variable 'vma' set but not used [-Wunused-but-set-variable] 1123 | struct vm_area_struct *vma; | ^ mm/mempolicy.c:2959:25: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 2959 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ 3 warnings generated. -- In file included from mm/memory.c:93: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/memory.c:5512:17: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 5512 | int flags = 0, nr_pages; | ^ 2 warnings generated. -- In file included from mm/shmem.c:43: mm/swap.h:66:19: error: call to undeclared function 'swp_offset'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 66 | pgoff_t offset = swp_offset(entry); | ^ In file included from mm/shmem.c:58: include/linux/mman.h:158:9: warning: division by zero is undefined [-Wdivision-by-zero] 158 | _calc_vm_trans(flags, MAP_SYNC, VM_SYNC ) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/mman.h:136:21: note: expanded from macro '_calc_vm_trans' 136 | : ((x) & (bit1)) / ((bit1) / (bit2)))) | ^ ~~~~~~~~~~~~~~~~~ include/linux/mman.h:159:9: warning: division by zero is undefined [-Wdivision-by-zero] 159 | _calc_vm_trans(flags, MAP_STACK, VM_NOHUGEPAGE) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/mman.h:136:21: note: expanded from macro '_calc_vm_trans' 136 | : ((x) & (bit1)) / ((bit1) / (bit2)))) | ^ ~~~~~~~~~~~~~~~~~ In file included from mm/shmem.c:68: include/linux/swapops.h:107:23: error: static declaration of 'swp_offset' follows non-static declaration 107 | static inline pgoff_t swp_offset(swp_entry_t entry) | ^ mm/swap.h:66:19: note: previous implicit declaration is here 66 | pgoff_t offset = swp_offset(entry); | ^ In file included from mm/shmem.c:86: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/shmem.c:1747:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 1747 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ mm/shmem.c:1877:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 1877 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ 5 warnings and 2 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] vim +1522 mm/internal.h 1513 1514 /* shrinker related functions */ 1515 unsigned long shrink_slab(gfp_t gfp_mask, int nid, struct mem_cgroup *memcg, 1516 int priority); 1517 1518 #ifdef CONFIG_SHRINKER_DEBUG 1519 static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, 1520 const char *fmt, va_list ap) 1521 { > 1522 shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); 1523 1524 return shrinker->name ? 0 : -ENOMEM; 1525 } 1526 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] vfs: Don't leak disconnected dentries on umount
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.246 commit 20863bb7fbb016379f8227122edfabc5c799bc79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID4A7Q CVE: CVE-2025-40105 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56094ad3eaa21e6621396cc33811d8f72847a834 ] When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path(). It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are "leaked". Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous "Busy inodes after unmount" bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well. Reported-by: syzbot+1d79ebe5383fc016cf07(a)syzkaller.appspotmail.com Fixes: f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> [ relocated DCACHE_DISCONNECTED propagation from d_alloc_parallel() to d_alloc() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/dcache.c [6a8c6793785d ("fs/dcache.c: avoid panic while lockref of dentry overflow") introduces conflicts, which does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dcache.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/dcache.c b/fs/dcache.c index d36bb8fc2c41..a316a1b2e144 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1884,6 +1884,8 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) __dget_dlock(parent); dentry->d_parent = parent; list_add(&dentry->d_child, &parent->d_subdirs); + if (parent->d_flags & DCACHE_DISCONNECTED) + dentry->d_flags |= DCACHE_DISCONNECTED; spin_unlock(&parent->d_lock); out: return dentry; -- 2.39.2

2 1

[PATCH OLK-5.10] fs/proc: fix uaf in proc_readdir_de()
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Wei Yang <albinwyang(a)tencent.com> stable inclusion from stable-v5.10.247 commit c81d0385500446efe48c305bbb83d47f2ae23a50 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6QZ CVE: CVE-2025-40271 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 895b4c0c79b092d732544011c3cecaf7322c36a1 upstream. Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com Signed-off-by: Wei Yang <albinwyang(a)tencent.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: wangzijie <wangzijie1(a)honor.com> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/proc/generic.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 7b6d9c77b425..643e7d4dc59d 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -693,6 +693,12 @@ void pde_put(struct proc_dir_entry *pde) } } +static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent) +{ + rb_erase(&pde->subdir_node, &parent->subdir); + RB_CLEAR_NODE(&pde->subdir_node); +} + /* * Remove a /proc entry and free it if it's not currently in use. */ @@ -715,7 +721,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) WARN(1, "removing permanent /proc entry '%s'", de->name); de = NULL; } else { - rb_erase(&de->subdir_node, &parent->subdir); + pde_erase(de, parent); if (S_ISDIR(de->mode)) parent->nlink--; } @@ -759,7 +765,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) root->parent->name, root->name); return -EINVAL; } - rb_erase(&root->subdir_node, &parent->subdir); + pde_erase(root, parent); de = root; while (1) { @@ -771,7 +777,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) next->parent->name, next->name); return -EINVAL; } - rb_erase(&next->subdir_node, &de->subdir); + pde_erase(next, de); de = next; continue; } -- 2.39.2

2 1

[PATCH OLK-5.10] fs: Prevent file descriptor table allocations exceeding INT_MAX
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Sasha Levin <sashal(a)kernel.org> stable inclusion from stable-v5.10.241 commit f95638a8f22eba307dceddf5aef9ae2326bbcf98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICXMCD CVE: CVE-2025-39756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 04a2c4b4511d186b0fce685da21085a5d4acd370 upstream. When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include <unistd.h> #include <sys/resource.h> int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request. Fixes: 9cfe015aa424 ("get rid of NR_OPEN and introduce a sysctl_nr_open") Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Link: https://lore.kernel.org/20250629074021.1038845-1-sashal@kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/file.c b/fs/file.c index 0558890fe20c..246ee67dd10e 100644 --- a/fs/file.c +++ b/fs/file.c @@ -126,6 +126,21 @@ static struct fdtable * alloc_fdtable(unsigned int nr) if (unlikely(nr > sysctl_nr_open)) nr = ((sysctl_nr_open - 1) | (BITS_PER_LONG - 1)) + 1; + /* + * Check if the allocation size would exceed INT_MAX. kvmalloc_array() + * and kvmalloc() will warn if the allocation size is greater than + * INT_MAX, as filp_cachep objects are not __GFP_NOWARN. + * + * This can happen when sysctl_nr_open is set to a very high value and + * a process tries to use a file descriptor near that limit. For example, + * if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what + * systemd typically sets it to - then trying to use a file descriptor + * close to that value will require allocating a file descriptor table + * that exceeds 8GB in size. + */ + if (unlikely(nr > INT_MAX / sizeof(struct file *))) + return ERR_PTR(-EMFILE); + fdt = kmalloc(sizeof(struct fdtable), GFP_KERNEL_ACCOUNT); if (!fdt) goto out; -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2025-40190
by Zizhi Wo 08 Dec '25

08 Dec '25

Fix CVE-2025-40190 Ahmet Eray Karadag (1): ext4: guard against EA inode refcount underflow in xattr update Wojciech Gładysz (1): ext4: nested locking for xattr inode fs/ext4/xattr.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] fs/proc: fix uaf in proc_readdir_de()
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Wei Yang <albinwyang(a)tencent.com> stable inclusion from stable-v5.4.302 commit 1d1596d68a6f11d28f677eedf6cf5b17dbfeb491 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6QZ CVE: CVE-2025-40271 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 895b4c0c79b092d732544011c3cecaf7322c36a1 ] Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com Signed-off-by: Wei Yang <albinwyang(a)tencent.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: wangzijie <wangzijie1(a)honor.com> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/proc/generic.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index d8b3c6a7173f..c6495decf1ed 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -670,6 +670,12 @@ void pde_put(struct proc_dir_entry *pde) } } +static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent) +{ + rb_erase(&pde->subdir_node, &parent->subdir); + RB_CLEAR_NODE(&pde->subdir_node); +} + /* * Remove a /proc entry and free it if it's not currently in use. */ @@ -688,7 +694,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) de = pde_subdir_find(parent, fn, len); if (de) { - rb_erase(&de->subdir_node, &parent->subdir); + pde_erase(de, parent); if (S_ISDIR(de->mode)) { parent->nlink--; } @@ -726,13 +732,13 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) write_unlock(&proc_subdir_lock); return -ENOENT; } - rb_erase(&root->subdir_node, &parent->subdir); + pde_erase(root, parent); de = root; while (1) { next = pde_subdir_first(de); if (next) { - rb_erase(&next->subdir_node, &de->subdir); + pde_erase(next, de); de = next; continue; } -- 2.39.2

2 1

[PATCH OLK-5.10 0/1] zcopy: Fix invalid paging request while attach transhugepage to same addr
by Liu Mingrui 08 Dec '25

08 Dec '25

Fix invalid paging request while attach transhugepage to same addr Liu Mingrui (1): zcopy: Fix invalid paging request while attach transhugepage to same addr drivers/misc/zcopy/zcopy.c | 68 +++++++++++++++++++------------------- 1 file changed, 34 insertions(+), 34 deletions(-) -- 2.25.1

2 2

[PATCH OLK-6.6 0/3] arm64/mpam: Reset mbwu_state while creating new monitor group
by Zeng Heng 08 Dec '25

08 Dec '25

Zeng Heng (3): arm64/mpam: Reset mbwu_state while creating new monitor group arm64/mpam: Remove the redundant prev_val member variable arm64/mpam: Need to reset MPAM component when umounting resctrl drivers/platform/mpam/mpam_devices.c | 9 +-------- drivers/platform/mpam/mpam_internal.h | 3 --- drivers/platform/mpam/mpam_resctrl.c | 3 ++- 3 files changed, 3 insertions(+), 12 deletions(-) -- 2.25.1

2 4

[openeuler:OLK-6.6 3485/3485] drivers/media/v4l2-core/v4l2-subdev.c:2253:17: error: implicit declaration of function 'v4l2_subdev_get_locked_active_state'
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 79aa4f2e99baed837a6933aa6b1a852197d30b91 commit: c1be6d998806425f28600e867a8e9a2dd9bac741 [3485/3485] media: subdev: Add v4l2_subdev_is_streaming() config: x86_64-randconfig-003-20251208 (https://download.01.org/0day-ci/archive/20251208/202512081445.4S7Y9xWG-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081445.4S7Y9xWG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081445.4S7Y9xWG-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/media/v4l2-core/v4l2-subdev.c: In function 'v4l2_subdev_is_streaming': >> drivers/media/v4l2-core/v4l2-subdev.c:2253:17: error: implicit declaration of function 'v4l2_subdev_get_locked_active_state' [-Wimplicit-function-declaration] 2253 | state = v4l2_subdev_get_locked_active_state(sd); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/media/v4l2-core/v4l2-subdev.c:2253:15: error: assignment to 'struct v4l2_subdev_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 2253 | state = v4l2_subdev_get_locked_active_state(sd); | ^ vim +/v4l2_subdev_get_locked_active_state +2253 drivers/media/v4l2-core/v4l2-subdev.c 2242 2243 bool v4l2_subdev_is_streaming(struct v4l2_subdev *sd) 2244 { 2245 struct v4l2_subdev_state *state; 2246 2247 if (!v4l2_subdev_has_op(sd, pad, enable_streams)) 2248 return sd->s_stream_enabled; 2249 2250 if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS)) 2251 return !!sd->enabled_pads; 2252 > 2253 state = v4l2_subdev_get_locked_active_state(sd); 2254 2255 for (unsigned int i = 0; i < state->stream_configs.num_configs; ++i) { 2256 const struct v4l2_subdev_stream_config *cfg; 2257 2258 cfg = &state->stream_configs.configs[i]; 2259 2260 if (cfg->enabled) 2261 return true; 2262 } 2263 2264 return false; 2265 } 2266 EXPORT_SYMBOL_GPL(v4l2_subdev_is_streaming); 2267 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Fix unexpected behavior in resctrl mounting
by Quanmin Yan 08 Dec '25

08 Dec '25

When mounting resctrl, some options that should be present are not shown in the mount list. Additionally, there is a lack of validation for the effectiveness of mount parameters when mounting resctrl. This patch set fixes the aforementioned unexpected behavior during resctrl mounting. Quanmin Yan (2): fs/resctrl: Fix resctrl mount options display in mount list fs/resctrl: Prevent mounting with unsupported options fs/resctrl/rdtgroup.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) -- 2.43.0

2 3

[openeuler:OLK-6.6 3482/3482] kernel/xsched/cgroup.c:30:21: sparse: sparse: symbol 'root_xcg' was not declared. Should it be static?
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 79aa4f2e99baed837a6933aa6b1a852197d30b91 commit: 43bbefc53356009d3603faa2c6e6a2858f724e4d [3482/3482] xsched: Add XCU control group implementation and its backend in xsched CFS config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251208/202512081339.m9dijSrU-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081339.m9dijSrU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081339.m9dijSrU-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/xsched/cgroup.c:30:21: sparse: sparse: symbol 'root_xcg' was not declared. Should it be static? >> kernel/xsched/cgroup.c:368:6: sparse: sparse: symbol 'xcu_move_task' was not declared. Should it be static? kernel/xsched/cgroup.c:368:6: sparse: sparse: context imbalance in 'xcu_move_task' - different lock contexts for basic block vim +/root_xcg +30 kernel/xsched/cgroup.c 28 29 static struct xsched_group root_xsched_group; > 30 struct xsched_group *root_xcg = &root_xsched_group; 31 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ext4: xattr: fix null pointer deref in ext4_raw_inode()
by Yongjian Sun 08 Dec '25

08 Dec '25

From: Karina Yankevich <k.yankevich(a)omp.ru> mainline inclusion from mainline-v6.19-rc1 commit b97cb7d6a051aa6ebd57906df0e26e9e36c26d14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB04G Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED), iloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all() lacks error checking, this will lead to a null pointer dereference in ext4_raw_inode(), called right after ext4_get_inode_loc(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c8e008b60492 ("ext4: ignore xattrs past end") Cc: stable(a)kernel.org Signed-off-by: Karina Yankevich <k.yankevich(a)omp.ru> Reviewed-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Message-ID: <20251022093253.3546296-1-k.yankevich(a)omp.ru> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/xattr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 3e5efa68698e..fd44b8c0c4af 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1133,7 +1133,11 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent, if (block_csum) end = (void *)bh->b_data + bh->b_size; else { - ext4_get_inode_loc(parent, &iloc); + err = ext4_get_inode_loc(parent, &iloc); + if (err) { + EXT4_ERROR_INODE(parent, "parent inode loc (error %d)", err); + return; + } end = (void *)ext4_raw_inode(&iloc) + EXT4_SB(parent->i_sb)->s_inode_size; } -- 2.39.2

2 1

[PATCH OLK-6.6] ext4: xattr: fix null pointer deref in ext4_raw_inode()
by Yongjian Sun 08 Dec '25

08 Dec '25

From: Karina Yankevich <k.yankevich(a)omp.ru> mainline inclusion from mainline-v6.19-rc1 commit b97cb7d6a051aa6ebd57906df0e26e9e36c26d14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB04G Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If ext4_get_inode_loc() fails (e.g. if it returns -EFSCORRUPTED), iloc.bh will remain set to NULL. Since ext4_xattr_inode_dec_ref_all() lacks error checking, this will lead to a null pointer dereference in ext4_raw_inode(), called right after ext4_get_inode_loc(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c8e008b60492 ("ext4: ignore xattrs past end") Cc: stable(a)kernel.org Signed-off-by: Karina Yankevich <k.yankevich(a)omp.ru> Reviewed-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Message-ID: <20251022093253.3546296-1-k.yankevich(a)omp.ru> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/xattr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index 6ef8820625b9..5009fdcfe150 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1184,7 +1184,11 @@ ext4_xattr_inode_dec_ref_all(handle_t *handle, struct inode *parent, if (block_csum) end = (void *)bh->b_data + bh->b_size; else { - ext4_get_inode_loc(parent, &iloc); + err = ext4_get_inode_loc(parent, &iloc); + if (err) { + EXT4_ERROR_INODE(parent, "parent inode loc (error %d)", err); + return; + } end = (void *)ext4_raw_inode(&iloc) + EXT4_SB(parent->i_sb)->s_inode_size; } -- 2.39.2

2 1

[openeuler:OLK-6.6 3482/3482] kernel/xsched/cfs.c:22:6: sparse: sparse: symbol 'xs_rq_add' was not declared. Should it be static?
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: 024b851138509252da4531dc2e69b1e8df50fd3b [3482/3482] xsched: Add xsched CFS class config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251208/202512081156.izr1Nkua-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081156.izr1Nkua-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081156.izr1Nkua-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/xsched/cfs.c:22:6: sparse: sparse: symbol 'xs_rq_add' was not declared. Should it be static? >> kernel/xsched/cfs.c:45:6: sparse: sparse: symbol 'xs_rq_remove' was not declared. Should it be static? >> kernel/xsched/cfs.c:159:6: sparse: sparse: symbol 'rq_init_fair' was not declared. Should it be static? >> kernel/xsched/cfs.c:164:6: sparse: sparse: symbol 'xse_init_fair' was not declared. Should it be static? >> kernel/xsched/cfs.c:169:6: sparse: sparse: symbol 'xse_deinit_fair' was not declared. Should it be static? vim +/xs_rq_add +22 kernel/xsched/cfs.c 18 19 #define CFS_INNER_RQ_EMPTY(cfs_xse) \ 20 ((cfs_xse)->xruntime == XSCHED_TIME_INF) 21 > 22 void xs_rq_add(struct xsched_entity_cfs *xse) 23 { 24 struct xsched_rq_cfs *cfs_rq = xse->cfs_rq; 25 struct rb_node **link = &cfs_rq->ctx_timeline.rb_root.rb_node; 26 struct rb_node *parent = NULL; 27 struct xsched_entity_cfs *entry; 28 bool leftmost = true; 29 30 while (*link) { 31 parent = *link; 32 entry = rb_entry(parent, struct xsched_entity_cfs, run_node); 33 if (xse->xruntime <= entry->xruntime) { 34 link = &parent->rb_left; 35 } else { 36 link = &parent->rb_right; 37 leftmost = false; 38 } 39 } 40 41 rb_link_node(&xse->run_node, parent, link); 42 rb_insert_color_cached(&xse->run_node, &cfs_rq->ctx_timeline, leftmost); 43 } 44 > 45 void xs_rq_remove(struct xsched_entity_cfs *xse) 46 { 47 struct xsched_rq_cfs *cfs_rq = xse->cfs_rq; 48 49 rb_erase_cached(&xse->run_node, &cfs_rq->ctx_timeline); 50 } 51 52 /** 53 * xs_cfs_rq_update() - Update entity's runqueue position with new xruntime 54 */ 55 static void xs_cfs_rq_update(struct xsched_entity_cfs *xse_cfs, u64 new_xrt) 56 { 57 xs_rq_remove(xse_cfs); 58 xse_cfs->xruntime = new_xrt; 59 xs_rq_add(xse_cfs); 60 } 61 62 static inline struct xsched_entity_cfs * 63 xs_pick_first(struct xsched_rq_cfs *cfs_rq) 64 { 65 struct xsched_entity_cfs *xse_cfs; 66 struct rb_node *left = rb_first_cached(&cfs_rq->ctx_timeline); 67 68 if (!left) 69 return NULL; 70 71 xse_cfs = rb_entry(left, struct xsched_entity_cfs, run_node); 72 return xse_cfs; 73 } 74 75 /** 76 * xs_update() - Account xruntime and runtime metrics. 77 * @xse_cfs: Point to CFS scheduling entity. 78 * @delta: Execution time in last period 79 */ 80 static void xs_update(struct xsched_entity_cfs *xse_cfs, u64 delta) 81 { 82 u64 new_xrt = xse_cfs->xruntime + delta * xse_cfs->weight; 83 84 xs_cfs_rq_update(xse_cfs, new_xrt); 85 xse_cfs->sum_exec_runtime += delta; 86 } 87 88 /* 89 * Xsched Fair class methods 90 * For rq manipulation we rely on root runqueue lock already acquired in core. 91 * Access xsched_group_xcu_priv requires no locks because one thread per XCU. 92 */ 93 static void dequeue_ctx_fair(struct xsched_entity *xse) 94 { 95 struct xsched_cu *xcu = xse->xcu; 96 struct xsched_entity_cfs *first; 97 struct xsched_entity_cfs *xse_cfs = &xse->cfs; 98 99 xs_rq_remove(xse_cfs); 100 101 first = xs_pick_first(&xcu->xrq.cfs); 102 xcu->xrq.cfs.min_xruntime = (first) ? first->xruntime : XSCHED_TIME_INF; 103 } 104 105 /** 106 * enqueue_ctx_fair() - Add context to the runqueue 107 * @xse: xsched entity of context 108 * @xcu: executor 109 * 110 * In contrary to enqueue_task it is called once on context init. 111 * Although groups reside in tree, their nodes not counted in nr_running. 112 * The xruntime of a group xsched entitry represented by min xruntime inside. 113 */ 114 static void enqueue_ctx_fair(struct xsched_entity *xse, struct xsched_cu *xcu) 115 { 116 struct xsched_entity_cfs *first; 117 struct xsched_rq_cfs *rq; 118 struct xsched_entity_cfs *xse_cfs = &xse->cfs; 119 120 rq = xse_cfs->cfs_rq = &xcu->xrq.cfs; 121 122 /* If no XSE of only empty groups */ 123 if (xs_pick_first(rq) == NULL || rq->min_xruntime == XSCHED_TIME_INF) 124 rq->min_xruntime = xse_cfs->xruntime; 125 else 126 xse_cfs->xruntime = max(xse_cfs->xruntime, rq->min_xruntime); 127 128 xs_rq_add(xse_cfs); 129 130 first = xs_pick_first(&xcu->xrq.cfs); 131 xcu->xrq.cfs.min_xruntime = (first) ? first->xruntime : XSCHED_TIME_INF; 132 } 133 134 static struct xsched_entity *pick_next_ctx_fair(struct xsched_cu *xcu) 135 { 136 struct xsched_entity_cfs *xse; 137 struct xsched_rq_cfs *rq = &xcu->xrq.cfs; 138 139 xse = xs_pick_first(rq); 140 if (!xse) 141 return NULL; 142 143 return container_of(xse, struct xsched_entity, cfs); 144 } 145 146 static inline bool 147 xs_should_preempt_fair(struct xsched_entity *xse) 148 { 149 return (atomic_read(&xse->submitted_one_kick) >= XSCHED_CFS_KICK_SLICE); 150 } 151 152 static void put_prev_ctx_fair(struct xsched_entity *xse) 153 { 154 struct xsched_entity_cfs *prev = &xse->cfs; 155 156 xs_update(prev, xse->last_exec_runtime); 157 } 158 > 159 void rq_init_fair(struct xsched_cu *xcu) 160 { 161 xcu->xrq.cfs.ctx_timeline = RB_ROOT_CACHED; 162 } 163 > 164 void xse_init_fair(struct xsched_entity *xse) 165 { 166 xse->cfs.weight = XSCHED_CFS_WEIGHT_DFLT; 167 } 168 > 169 void xse_deinit_fair(struct xsched_entity *xse) 170 { 171 /* TODO Cgroup exit */ 172 } 173 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] mm/numa_remote: fix wild-memory-access in numa_remote_hugetlb_nowatermark
by Jinjiang Tu 08 Dec '25

08 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDB01L ---------------------------------------- NUMA_NO_NODE will be passed to numa_remote_hugetlb_nowatermark() if we echo xx > /proc/sys/vm/nr_hugepages. When hugetlb_nowatermark is enabled, numa_remote_hugetlb_nowatermark() will trigger wild-memory-access. To fix it, check nid whether is NUMA_NO_NODE before calling numa_remote_hugetlb_nowatermark(). Fixes: 3a1587ef612c ("mm/numa_remote: introduce hugetlb_nowatermark mode for remote node") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index b00dda9db0c9..1a98b599c0b0 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3944,7 +3944,7 @@ static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, /* yield cpu to avoid soft lockup */ cond_resched(); - if (numa_remote_hugetlb_nowatermark(nid) && !drained && (nid != NUMA_NO_NODE)) { + if ((nid != NUMA_NO_NODE) && numa_remote_hugetlb_nowatermark(nid) && !drained) { hugetlb_drain_remote_pcp(h, nid); drained = true; } -- 2.43.0

2 1

[PATCH OLK-5.10] KVM: arm64: Prevent access to vCPU events before init
by Pu Lehui 08 Dec '25

08 Dec '25

From: Oliver Upton <oliver.upton(a)linux.dev> mainline inclusion from mainline-v6.18-rc2 commit 0aa1b76fe1429629215a7c79820e4b96233ac4a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID4A6U CVE: CVE-2025-40102 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection: kernel BUG at arch/arm64/kvm/inject_fault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr : pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4 __kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4 __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000) Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state. Cc: stable(a)vger.kernel.org # 6.17 Fixes: b7b27facc7b5 ("arm/arm64: KVM: Add KVM_GET/SET_VCPU_EVENTS") Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/kvm/arm.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 72d298e696fa..afcad77b581a 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -1532,6 +1532,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, case KVM_GET_VCPU_EVENTS: { struct kvm_vcpu_events events; + if (!kvm_vcpu_initialized(vcpu)) + return -ENOEXEC; + if (kvm_arm_vcpu_get_events(vcpu, &events)) return -EINVAL; @@ -1543,6 +1546,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, case KVM_SET_VCPU_EVENTS: { struct kvm_vcpu_events events; + if (!kvm_vcpu_initialized(vcpu)) + return -ENOEXEC; + if (copy_from_user(&events, argp, sizeof(events))) return -EFAULT; -- 2.34.1

2 1

[PATCH OLK-5.10] vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
by Pu Lehui 08 Dec '25

08 Dec '25

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.17-rc5 commit 6ead38147ebb813f08be6ea8ef547a0e4c09559a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVU CVE: CVE-2025-39851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN deployments where learning is disabled. However, when learning is enabled, an incoming packet might try to refresh an FDB entry that points to an FDB nexthop group and therefore does not have a remote. Such packets should be dropped, but they are only dropped after dereferencing the non-existent remote, resulting in a NPD [1] which can be reproduced using [2]. Fix by dropping such packets earlier. Remove the misleading comment from first_remote_rcu(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_snoop+0x98/0x1e0 [...] Call Trace: <TASK> vxlan_encap_bypass+0x209/0x240 encap_bypass_if_local+0xb1/0x100 vxlan_xmit_one+0x1375/0x17e0 vxlan_xmit+0x6b4/0x15f0 dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip address add 192.0.2.2/32 dev lo ip nexthop add id 1 via 192.0.2.3 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 12345 localbypass ip link add name vx1 up type vxlan id 10020 local 192.0.2.2 dstport 54321 learning bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 192.0.2.2 port 54321 vni 10020 bridge fdb add 00:aa:bb:cc:dd:ee dev vx1 self static nhid 10 mausezahn vx0 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 1 -q Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Reported-by: Marlin Cremers <mcremers(a)cloudbear.nl> Reviewed-by: Petr Machata <petrm(a)nvidia.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://patch.msgid.link/20250901065035.159644-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/vxlan/vxlan_core.c drivers/net/vxlan/vxlan_private.h [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/vxlan/vxlan_core.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c index 75ebdb79587d..4775161c50aa 100644 --- a/drivers/net/vxlan/vxlan_core.c +++ b/drivers/net/vxlan/vxlan_core.c @@ -173,9 +173,7 @@ static inline struct hlist_head *vs_head(struct net *net, __be16 port) return &vn->sock_list[hash_32(ntohs(port), PORT_HASH_BITS)]; } -/* First remote destination for a forwarding entry. - * Guaranteed to be non-NULL because remotes are never deleted. - */ +/* First remote destination for a forwarding entry. */ static inline struct vxlan_rdst *first_remote_rcu(struct vxlan_fdb *fdb) { if (rcu_access_pointer(fdb->nh)) @@ -1502,6 +1500,10 @@ static bool vxlan_snoop(struct net_device *dev, if (likely(f)) { struct vxlan_rdst *rdst = first_remote_rcu(f); + /* Don't override an fdb with nexthop with a learnt entry */ + if (rcu_access_pointer(f->nh)) + return true; + if (likely(vxlan_addr_equal(&rdst->remote_ip, src_ip) && rdst->remote_ifindex == ifindex)) return false; @@ -1510,10 +1512,6 @@ static bool vxlan_snoop(struct net_device *dev, if (f->state & (NUD_PERMANENT | NUD_NOARP)) return true; - /* Don't override an fdb with nexthop with a learnt entry */ - if (rcu_access_pointer(f->nh)) - return true; - if (net_ratelimit()) netdev_info(dev, "%pM migrated from %pIS to %pIS\n", -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] arm64/mpam: Reset mbwu_state while creating new monitor group
by Zeng Heng 08 Dec '25

08 Dec '25

Zeng Heng (3): arm64/mpam: Reset mbwu_state while creating new monitor group arm64/mpam: Remove the redundant prev_val member variable arm64/mpam: Need to reset MPAM component when umounting resctrl drivers/platform/mpam/mpam_devices.c | 9 +-------- drivers/platform/mpam/mpam_internal.h | 3 --- drivers/platform/mpam/mpam_resctrl.c | 3 ++- 3 files changed, 3 insertions(+), 12 deletions(-) -- 2.25.1

2 4

[openeuler:OLK-6.6 3482/3482] kernel/xsched/rt.c:207:6: sparse: sparse: symbol 'rq_init_rt' was not declared. Should it be static?
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: 832ec54e11a079d968d8f23780ab455b1537b214 [3482/3482] xsched: Add xsched RT class config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251208/202512080850.XFeNdf38-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512080850.XFeNdf38-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512080850.XFeNdf38-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/xsched/rt.c:207:6: sparse: sparse: symbol 'rq_init_rt' was not declared. Should it be static? >> kernel/xsched/rt.c:218:6: sparse: sparse: symbol 'xse_init_rt' was not declared. Should it be static? >> kernel/xsched/rt.c:228:6: sparse: sparse: symbol 'xse_deinit_rt' was not declared. Should it be static? -- kernel/xsched/core.c:189:5: sparse: sparse: symbol 'xsched_xse_set_class' was not declared. Should it be static? >> kernel/xsched/core.c:497:12: sparse: sparse: symbol 'xsched_sched_init' was not declared. Should it be static? vim +/rq_init_rt +207 kernel/xsched/rt.c 206 > 207 void rq_init_rt(struct xsched_cu *xcu) 208 { 209 int prio = 0; 210 211 xcu->xrq.rt.nr_running = 0; 212 213 for_each_xse_prio(prio) { 214 INIT_LIST_HEAD(&xcu->xrq.rt.rq[prio]); 215 } 216 } 217 > 218 void xse_init_rt(struct xsched_entity *xse) 219 { 220 struct tgid_prio *map = tgid_prio_find(xse->tgid); 221 222 xse->rt.prio = (map) ? map->prio : XSE_PRIO_DFLT; 223 XSCHED_DEBUG("Xse init: set priority=%d.\n", xse->rt.prio); 224 xse->rt.timeslice = XSCHED_RT_TIMESLICE; 225 INIT_LIST_HEAD(&xse->rt.list_node); 226 } 227 > 228 void xse_deinit_rt(struct xsched_entity *xse) 229 { 230 struct tgid_prio *map = tgid_prio_find(xse->tgid); 231 232 if (map) { 233 tgid_prio_delete(xse->tgid); 234 XSCHED_DEBUG("Map deleted: tgid=%d\n", xse->tgid); 235 } 236 } 237 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3482/3482] kernel/xsched/core.c:189:5: sparse: sparse: symbol 'xsched_xse_set_class' was not declared. Should it be static?
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: 76c15076abcb100f7c1204bd1ef0ec55128d6546 [3482/3482] xsched: Add basic scheduler core support config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251208/202512080744.dk0pGz73-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512080744.dk0pGz73-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512080744.dk0pGz73-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/xsched/core.c:189:5: sparse: sparse: symbol 'xsched_xse_set_class' was not declared. Should it be static? vim +/xsched_xse_set_class +189 kernel/xsched/core.c 188 > 189 int xsched_xse_set_class(struct xsched_entity *xse) 190 { 191 struct xsched_class *sched = xsched_first_class; 192 193 xse->class = sched; 194 return 0; 195 } 196 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3482/3482] kernel/xsched/vstream.c:94:18: sparse: sparse: symbol 'xcu_find' was not declared. Should it be static?
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: 8dde1f2e6bf6049bf69c9f510349c698e0aba49d [3482/3482] xsched: Introduce vstream management config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251208/202512080518.RsQU37Pq-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512080518.RsQU37Pq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512080518.RsQU37Pq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/xsched/vstream.c:94:18: sparse: sparse: symbol 'xcu_find' was not declared. Should it be static? vim +/xcu_find +94 kernel/xsched/vstream.c 93 > 94 struct xsched_cu *xcu_find(uint32_t type, 95 uint32_t dev_id, uint32_t channel_id) 96 { 97 struct xcu_group *group = NULL; 98 99 /* Find xcu by type. */ 100 group = xcu_group_find(xcu_group_root, type); 101 if (group == NULL) { 102 XSCHED_ERR("Fail to find type group.\n"); 103 return NULL; 104 } 105 106 /* Find device id group. */ 107 group = xcu_group_find(group, dev_id); 108 if (group == NULL) { 109 XSCHED_ERR("Fail to find device group.\n"); 110 return NULL; 111 } 112 /* Find channel id group. */ 113 group = xcu_group_find(group, channel_id); 114 if (group == NULL) { 115 XSCHED_ERR("Fail to find channel group.\n"); 116 return NULL; 117 } 118 119 XSCHED_DEBUG("XCU found: type=%u, dev_id=%u, chan_id=%u.\n", 120 type, dev_id, channel_id); 121 122 return group->xcu; 123 } 124 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3482/3482] drivers/xcu/xcu_group.c:41:5: sparse: sparse: symbol '__xcu_group_attach' was not declared. Should it be static?
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: b7261a251299bfdababe53a848084af2ecfcc1ae [3482/3482] xcu: Add base NPU driver support config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251208/202512080408.Kma3SOA7-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512080408.Kma3SOA7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512080408.Kma3SOA7-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/xcu/xcu_group.c:25:18: sparse: sparse: symbol 'xsched_cu_mgr' was not declared. Should it be static? >> drivers/xcu/xcu_group.c:41:5: sparse: sparse: symbol '__xcu_group_attach' was not declared. Should it be static? vim +/__xcu_group_attach +41 drivers/xcu/xcu_group.c 40 > 41 int __xcu_group_attach(struct xcu_group *new_group, 42 struct xcu_group *previous_group) 43 { 44 int id = new_group->id; 45 46 if (id == -1) 47 id = idr_alloc(&previous_group->next_layer, new_group, 0, 48 INT_MAX, GFP_KERNEL); 49 else 50 id = idr_alloc(&previous_group->next_layer, new_group, id, 51 id + 1, GFP_KERNEL); 52 53 if (id < 0) { 54 XSCHED_ERR("Fail to attach xcu_group: id conflict @ %s\n", 55 __func__); 56 return -EEXIST; 57 } 58 new_group->id = id; 59 new_group->previous_layer = previous_group; 60 61 return 0; 62 } 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3482/3482] drivers/misc/zcopy/zcopy.c:621:51: sparse: sparse: incorrect type in argument 2 (different address spaces)
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: 0305a09f222b7b94b01e478948f09ef95e9afda2 [3482/3482] zcopy: Introduce the pageattach interface config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251208/202512080059.AtMf7DsU-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512080059.AtMf7DsU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512080059.AtMf7DsU-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/misc/zcopy/zcopy.c:621:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got void * @@ drivers/misc/zcopy/zcopy.c:621:51: sparse: expected void const [noderef] __user *from drivers/misc/zcopy/zcopy.c:621:51: sparse: got void * vim +621 drivers/misc/zcopy/zcopy.c 611 612 static long zcopy_ioctl(struct file *file, unsigned int type, unsigned long ptr) 613 { 614 long ret = 0; 615 616 switch (type) { 617 case IO_ATTACH: 618 { 619 struct zcopy_ioctl_pswap ctx; 620 > 621 if (copy_from_user((void *)&ctx, (void *)ptr, 622 sizeof(struct zcopy_ioctl_pswap))) { 623 ret = -EFAULT; 624 break; 625 } 626 ret = attach_pages(ctx.dst_addr, ctx.src_addr, ctx.dst_pid, 627 ctx.src_pid, ctx.size); 628 break; 629 } 630 default: 631 break; 632 } 633 634 return ret; 635 } 636 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3482/3482] drivers/crypto/ccp/hygon/ccp-mdev.c:243:23: sparse: sparse: cast to restricted __le32
by kernel test robot 07 Dec '25

07 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: 592817a30ddc0ef43c7f5b5fe906ae37cf3bea3b [3482/3482] crypto: ccp: add ccp-mdev functionality to the ccp module. config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251207/202512071819.8VAvTIH6-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251207/202512071819.8VAvTIH6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512071819.8VAvTIH6-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/crypto/ccp/hygon/ccp-mdev.c:243:23: sparse: sparse: cast to restricted __le32 >> drivers/crypto/ccp/hygon/ccp-mdev.c:1144:13: sparse: sparse: symbol 'ccp_pin_memory' was not declared. Should it be static? vim +243 drivers/crypto/ccp/hygon/ccp-mdev.c 239 240 static int handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset, 241 u8 *buf, u32 count) 242 { > 243 u32 tmp_val = le32_to_cpu(*(u32 *)buf); 244 struct pci_dev *pdev = NULL; 245 int ret = -EINVAL; 246 247 if (!mdev_state || !mdev_state->iommu) { 248 pr_err("ccp: invalid mdev_state.\n"); 249 return ret; 250 } 251 252 pdev = mdev_state->iommu->pdev; 253 254 if (count == 1) 255 ret = pci_user_write_config_byte(pdev, offset, tmp_val); 256 else if (count == 2) 257 ret = pci_user_write_config_word(pdev, offset, tmp_val); 258 else if (count == 4) 259 ret = pci_user_write_config_dword(pdev, offset, tmp_val); 260 261 return ret; 262 } 263 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3482/3482] drivers/firmware/ubios_uvb/odf/odf_get_fdt.c:29:54: sparse: sparse: incorrect type in argument 1 (different base types)
by kernel test robot 07 Dec '25

07 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: c477b8f076e2b3385ad93a517136b0066a691813 [3482/3482] ubios_uvb: support CIS framework receive function config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251207/202512071326.3J4mASYn-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251207/202512071326.3J4mASYn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512071326.3J4mASYn-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/firmware/ubios_uvb/odf/odf_get_fdt.c:29:54: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected restricted __be32 const [usertype] *p @@ got unsigned int const [usertype] * @@ drivers/firmware/ubios_uvb/odf/odf_get_fdt.c:29:54: sparse: expected restricted __be32 const [usertype] *p drivers/firmware/ubios_uvb/odf/odf_get_fdt.c:29:54: sparse: got unsigned int const [usertype] * -- >> drivers/firmware/ubios_uvb/odf/odf_trans.c:28:6: sparse: sparse: symbol 'free_cis_info' was not declared. Should it be static? -- >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:23:1: sparse: sparse: symbol 'cis_register_lock' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:26:6: sparse: sparse: symbol 'ubios_prepare_output_data' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:45:5: sparse: sparse: symbol 'get_cis_group_info' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:87:22: sparse: sparse: symbol 'search_local_cis_func_node' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:163:31: sparse: sparse: symbol 'uvb_occupy_window' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:225:6: sparse: sparse: symbol 'uvb_free_wd_obtain' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:233:5: sparse: sparse: symbol 'uvb_free_window' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:298:5: sparse: sparse: symbol 'uvb_fill_window' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:323:5: sparse: sparse: symbol 'uvb_poll_window_call' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:345:5: sparse: sparse: symbol 'uvb_poll_window_call_sync' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:362:5: sparse: sparse: symbol 'uvb_get_output_data' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:384:6: sparse: sparse: symbol 'free_io_param_with_buffer' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:394:5: sparse: sparse: symbol 'cis_call_uvb' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_info_process.c:465:5: sparse: sparse: symbol 'cis_call_uvb_sync' was not declared. Should it be static? -- >> drivers/firmware/ubios_uvb/cis/uvb_info_process.c:129:6: sparse: sparse: symbol 'search_local_receiver_id' was not declared. Should it be static? -- >> drivers/firmware/ubios_uvb/cis/cis_core.c:25:5: sparse: sparse: symbol 'create_uvb_poll_window_thread' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_core.c:38:6: sparse: sparse: symbol 'uvb_poll_window_thread_stop' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_core.c:86:5: sparse: sparse: symbol 'init_uvb' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_core.c:111:5: sparse: sparse: symbol 'init_global_vars' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_core.c:120:5: sparse: sparse: symbol 'init_cis_table' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_core.c:130:6: sparse: sparse: symbol 'free_global_vars' was not declared. Should it be static? >> drivers/firmware/ubios_uvb/cis/cis_core.c:136:6: sparse: sparse: symbol 'uninit_uvb' was not declared. Should it be static? vim +29 drivers/firmware/ubios_uvb/odf/odf_get_fdt.c 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 13 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 14 int odf_get_fdt_ubiostbl(u64 *phys_addr, char *tbl) 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 15 { 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 16 int node, len; 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 17 const void *prop; 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 18 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 19 node = fdt_path_offset(initial_boot_params, "/chosen"); 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 20 if (node < 0) { 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 21 pr_err("failed to get device tree chosen node\n"); 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 22 return -EINVAL; 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 23 } 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 24 prop = fdt_getprop(initial_boot_params, node, tbl, &len); 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 25 if (!prop) { 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 26 pr_err("failed to get property\n"); 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 27 return -EINVAL; 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 28 } 9c3097dcbec30d drivers/ubios_uvb/odf/odf_get_fdt.c Anonymous_Z 2025-11-04 @29 *phys_addr = (len == 4) ? (u64)be32_to_cpup((const u32 *)prop) : :::::: The code at line 29 was first introduced by commit :::::: 9c3097dcbec30da54bc5082cb3236b300770993d ubios_uvb: support parse ubios information by dtb :::::: TO: Anonymous_Z <zhangrui182(a)huawei.com> :::::: CC: t30009442 <tangce1(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3482/3482] arch/arm64/kernel/virtcca_cvm_guest.c:77:16: sparse: sparse: symbol 'cvm_spin_cpumask' was not declared. Should it be static?
by kernel test robot 07 Dec '25

07 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4b48fa45408a2757255bdd0c640c1f693b424fe4 commit: da1164d1b52edbba7cf637423e626b0647388b23 [3482/3482] Add IPI direct inject method for virtCCA CVM. config: arm64-randconfig-r111-20251206 (https://download.01.org/0day-ci/archive/20251207/202512070750.e8G4R9UF-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251207/202512070750.e8G4R9UF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512070750.e8G4R9UF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/arm64/kernel/virtcca_cvm_guest.c:23:1: sparse: sparse: symbol 'cvm_tsi_present' was not declared. Should it be static? >> arch/arm64/kernel/virtcca_cvm_guest.c:77:16: sparse: sparse: symbol 'cvm_spin_cpumask' was not declared. Should it be static? arch/arm64/kernel/virtcca_cvm_guest.c:87:16: sparse: sparse: context imbalance in 'soft_ipi_passthrough_store' - wrong count at exit vim +/cvm_spin_cpumask +77 arch/arm64/kernel/virtcca_cvm_guest.c 76 > 77 struct cpumask cvm_spin_cpumask; 78 static DEFINE_SPINLOCK(ipi_passthrough_lock); 79 DEFINE_PER_CPU(unsigned int, virtcca_unpark_idle_notify); 80 DEFINE_PER_CPU(unsigned int, virtcca_park_idle_state); 81 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0