- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3050/3050] drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:345:21: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 28 Oct '25

28 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ab8573e771fc00691b546bfb1b7432ed6b19f9bc commit: 468b0cd7b1e1c131b3ee7d2ea8b96521d3faad8b [3050/3050] net:nebula-matrix:Add S1000 SNIC driver support config: x86_64-randconfig-123-20251028 (https://download.01.org/0day-ci/archive/20251028/202510282211.DtAqTWgc-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251028/202510282211.DtAqTWgc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510282211.DtAqTWgc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:345:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] block:5 @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:345:21: sparse: expected unsigned int [usertype] block:5 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:345:21: sparse: got restricted __le16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:346:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] module:5 @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:346:22: sparse: expected unsigned int [usertype] module:5 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:346:22: sparse: got restricted __le16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:347:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] table:4 @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:347:21: sparse: expected unsigned int [usertype] table:4 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:347:21: sparse: got restricted __le16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:348:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] opcode:8 @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:348:22: sparse: expected unsigned int [usertype] opcode:8 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:348:22: sparse: got restricted __le16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:349:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] param_high @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:349:26: sparse: expected unsigned int [usertype] param_high drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:349:26: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:350:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] param_low @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:350:25: sparse: expected unsigned int [usertype] param_low drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:350:25: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:359:29: sparse: sparse: invalid assignment: |= drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:359:29: sparse: left side has type unsigned int [usertype] :16 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:359:29: sparse: right side has type restricted __le16 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:360:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] send_high @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:360:33: sparse: expected unsigned int [usertype] send_high drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:360:33: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:361:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] send_low @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:361:32: sparse: expected unsigned int [usertype] send_low drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:361:32: sparse: got restricted __le32 [usertype] drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:366:29: sparse: sparse: invalid assignment: |= drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:366:29: sparse: left side has type unsigned int [usertype] :16 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:366:29: sparse: right side has type restricted __le16 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:367:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] recv_high @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:367:33: sparse: expected unsigned int [usertype] recv_high drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:367:33: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:368:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] recv_low @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:368:32: sparse: expected unsigned int [usertype] recv_low drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:368:32: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:479:35: sparse: sparse: cast to restricted __le16 -- >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_sysfs.c:23:12: sparse: sparse: symbol 'nbl_sysfs_qos_name' was not declared. Should it be static? >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_sysfs.c:47:12: sparse: sparse: symbol 'nbl_sysfs_mirror_name' was not declared. Should it be static? -- >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:320:45: sparse: sparse: cast to restricted __be16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:321:45: sparse: sparse: cast to restricted __be16 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:324:41: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:325:41: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:328:41: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:329:41: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:336:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:337:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:338:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:339:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:342:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:343:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:344:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:345:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:349:44: sparse: sparse: cast to restricted __be16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:350:44: sparse: sparse: cast to restricted __be16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:353:44: sparse: sparse: cast to restricted __be16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:354:44: sparse: sparse: cast to restricted __be16 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:832:6: sparse: sparse: symbol 'flow_type_name' was not declared. Should it be static? -- >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:590:71: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] *ip @@ got restricted __be32 * @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:590:71: sparse: expected unsigned int [usertype] *ip drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:590:71: sparse: got restricted __be32 * >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:594:29: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:640:71: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] *ip @@ got restricted __be32 * @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:640:71: sparse: expected unsigned int [usertype] *ip drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:640:71: sparse: got restricted __be32 * drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:644:29: sparse: sparse: cast to restricted __be32 -- drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:49:27: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *notify_addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:49:27: sparse: expected unsigned char [noderef] [usertype] __iomem *notify_addr drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:49:27: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1340:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] len @@ got unsigned short [usertype] len @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1340:22: sparse: expected restricted __le32 [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1340:22: sparse: got unsigned short [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1402:23: sparse: sparse: cast to restricted __le16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1658:39: sparse: sparse: cast to restricted __le16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1760:48: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] *irq_enable_base @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1760:48: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1760:48: sparse: got unsigned char [usertype] *irq_enable_base drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1977:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] len @@ got unsigned int [assigned] size @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1977:22: sparse: expected restricted __le32 [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1977:22: sparse: got unsigned int [assigned] size drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2012:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] len @@ got unsigned int [assigned] size @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2012:30: sparse: expected restricted __le32 [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2012:30: sparse: got unsigned int [assigned] size drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2680:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] len @@ got unsigned int [assigned] [usertype] pkthdr_len @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2680:33: sparse: expected restricted __le32 [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2680:33: sparse: got unsigned int [assigned] [usertype] pkthdr_len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2709:25: sparse: sparse: bad assignment (+=) to restricted __le32 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2862:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] vlan_proto @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2862:36: sparse: expected unsigned short [usertype] vlan_proto drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2862:36: sparse: got restricted __be16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2867:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] vlan_proto @@ got restricted __be16 [usertype] vlan_proto @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2867:36: sparse: expected unsigned short [usertype] vlan_proto drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2867:36: sparse: got restricted __be16 [usertype] vlan_proto >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2871:54: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] vlan_proto @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2871:54: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2871:54: sparse: got unsigned short [usertype] vlan_proto drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3030:40: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3031:32: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3400:24: sparse: sparse: cast to restricted __le16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3562:56: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] *irq_enable_base @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3562:56: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3562:56: sparse: got unsigned char [usertype] *irq_enable_base drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1382:9: sparse: sparse: context imbalance in 'nbl_res_txrx_xmit_xdp_buff' - different lock contexts for basic block drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1520:9: sparse: sparse: context imbalance in 'nbl_res_txrx_xdp_xmit' - different lock contexts for basic block drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1535:9: sparse: sparse: context imbalance in 'nbl_res_txrx_update_xdp_tail_locked' - different lock contexts for basic block drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1581:23: sparse: sparse: restricted __le32 degrades to integer vim +345 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c 327 328 static enum nbl_cmd_status 329 nbl_cmdq_execution_nolock(struct nbl_cmd_queue *queue, 330 struct nbl_cmd_ring *ring, 331 const struct nbl_cmd_hdr *hdr, 332 struct nbl_cmd_desc *desc, 333 const struct nbl_cmd_content *cmd) 334 { 335 struct nbl_phy_ops *phy_ops = NBL_CHAN_MGT_TO_PHY_OPS(queue->chan_mgt); 336 struct nbl_common_info *common = queue->chan_mgt->common; 337 338 /* clean the cmd send queue to reclaim descriptors */ 339 if (nbl_cmdq_clean_sq_ring(queue) == 0) { 340 nbl_err(common, NBL_DEBUG_FLOW, "tc flow cmd send queue full!"); 341 return NBL_CMDQ_CQ_FULL; 342 } 343 344 /* fill descriptor */ > 345 desc->block = cpu_to_le16(hdr->block); > 346 desc->module = cpu_to_le16(hdr->module); > 347 desc->table = cpu_to_le16(hdr->table); > 348 desc->opcode = cpu_to_le16(hdr->opcode); > 349 desc->param_high = cpu_to_le32(NBL_CMDQ_HI_DWORD(cmd->in_params)); > 350 desc->param_low = cpu_to_le32(NBL_CMDQ_LO_DWORD(cmd->in_params)); 351 desc->flags = 0; 352 desc->seq = g_seq_index++; 353 if (g_seq_index == 16) 354 g_seq_index = 0; 355 356 /* data to send */ 357 if (cmd->in_va && cmd->in) { 358 desc->datalen = cmd->in_length + NBL_CMDQ_HALF_DESC_LENGTH; > 359 desc->flags |= cpu_to_le16(NBL_CMDQ_DESC_FLAG_BUF_IN); > 360 desc->send_high = cpu_to_le32(NBL_CMDQ_HI_DWORD(cmd->in)); > 361 desc->send_low = cpu_to_le32(NBL_CMDQ_LO_DWORD(cmd->in)); 362 } 363 364 /* data to receive */ 365 if (cmd->out_va && cmd->out) { > 366 desc->flags |= cpu_to_le16(NBL_CMDQ_DESC_FLAG_BUF_OUT); > 367 desc->recv_high = cpu_to_le32(NBL_CMDQ_HI_DWORD(cmd->out)); > 368 desc->recv_low = cpu_to_le32(NBL_CMDQ_LO_DWORD(cmd->out)); 369 } 370 371 /* update next_to_use */ 372 (ring->next_to_use)++; 373 (ring->doorbell)++; 374 if (ring->next_to_use == ring->count) 375 ring->next_to_use = 0; 376 377 /* wmb for cmdq notify */ 378 wmb(); 379 phy_ops->update_cmdq_tail(NBL_CHAN_MGT_TO_PHY_PRIV(queue->chan_mgt), 380 (ring->doorbell) & NBL_CMDQ_DOORBELL_MASK); 381 return NBL_CMDQ_SUCCESS; 382 } 383 384 static inline enum nbl_cmd_status 385 nbl_cmdq_check_content(const struct nbl_cmd_queue *queue, 386 const struct nbl_cmd_hdr *hdr, 387 const struct nbl_cmd_content *cmd) 388 { 389 enum nbl_cmd_status status = NBL_CMDQ_SUCCESS; 390 391 if ((cmd->in_va && !cmd->in_length) || 392 (!cmd->in_va && cmd->in_length) || 393 (cmd->in_va && cmd->in_length > queue->sq_buf_size)) { 394 status = NBL_CMDQ_CQ_ERR_PARAMS; 395 } 396 397 /* check parameters: the receiving part */ 398 if ((hdr->opcode == NBL_CMD_OP_READ || 399 hdr->opcode == NBL_CMD_OP_SEARCH) && !cmd->out_va) 400 status = NBL_CMDQ_CQ_ERR_PARAMS; 401 402 return status; 403 } 404 405 static inline enum nbl_cmd_status 406 nbl_cmdq_check_interface_error(struct nbl_cmd_desc *desc, 407 struct nbl_common_info *common) 408 { 409 u8 interface_err = 0; 410 enum nbl_cmd_status status = NBL_CMDQ_SUCCESS; 411 412 /* flag error bit: error in firmware cmdq interface */ 413 if (nbl_cmdq_flag_check_interface_error(desc)) { 414 /* mark current desc as done by driver */ 415 nbl_cmdq_flag_mark_cmd_done(desc); 416 417 status = NBL_CMDQ_FAILED; 418 interface_err = (desc->flags >> NBL_CMDQ_DESC_FLAG_IF_ERR_OFT) & 419 NBL_CMDQ_DESC_FLAG_IF_ERR_MASK; 420 switch (interface_err) { 421 case 0b00: 422 /* dma error, re-send command */ 423 /* abort if failed sending command 3 times in a row */ 424 status = NBL_CMDQ_NEED_RESEND; 425 break; 426 case 0b01: 427 /* driver data error, dont re-send */ 428 status = NBL_CMDQ_NOBUF_ERR; 429 break; 430 case 0b10: 431 case 0b11: 432 /* firmware sequence error, reset cmdq */ 433 status = NBL_CMDQ_NEED_RESET; 434 break; 435 default: 436 /* unknown error */ 437 nbl_err(common, NBL_DEBUG_FLOW, 438 "tc flow cmdq unknown error from firmware interface"); 439 break; 440 } 441 } 442 443 return status; 444 } 445 446 static enum nbl_cmd_status 447 nbl_cmdq_fetch_response(struct nbl_cmd_queue *queue, struct nbl_cmd_desc *desc, 448 struct nbl_cmd_content *cmd, struct nbl_cmdq_dma_mem *buffer) 449 { 450 u8 error_code; 451 const char *buf_start; 452 enum nbl_cmd_status status = NBL_CMDQ_SUCCESS; 453 struct nbl_common_info *common = queue->chan_mgt->common; 454 455 /* check descriptor flag error bit for firmware business */ 456 if (nbl_cmdq_flag_check_error(desc)) { 457 status = NBL_CMDQ_FAILED; 458 error_code = desc->errorcode; 459 if (error_code) { 460 nbl_err(common, NBL_DEBUG_FLOW, "tc flow cmdq error code: %d", 461 error_code); 462 } else { 463 nbl_err(common, NBL_DEBUG_FLOW, 464 "tc flow cmdq desc error in flag but no errorcode"); 465 } 466 467 goto fetch_response_end; 468 } 469 470 /* check return buffer flag bit */ 471 if (cmd->out_va && cmd->out && !nbl_cmdq_flag_check_out_buffer(desc)) { 472 nbl_err(common, NBL_DEBUG_FLOW, "tc flow cmdq response buffer bit not matched"); 473 status = NBL_CMDQ_NOBUF_ERR; 474 goto fetch_response_end; 475 } 476 477 /* process out buffer */ 478 if (cmd->out_va && cmd->out && buffer) { > 479 cmd->out_length = le16_to_cpu(desc->datalen) - NBL_CMDQ_HALF_DESC_LENGTH; 480 if (cmd->out_length > queue->sq_buf_size) { 481 nbl_err(common, NBL_DEBUG_FLOW, 482 "tc flow cmdq buffer larger than allowed.\n"); 483 status = NBL_CMDQ_CQ_ERR_BUFFER; 484 goto fetch_response_end; 485 } 486 487 if ((desc->opcode == NBL_CMD_OP_READ || 488 desc->opcode == NBL_CMD_OP_SEARCH) && cmd->out_va) { 489 buf_start = (char *)buffer->va + NBL_CMDQ_HALF_DESC_LENGTH; 490 memcpy(cmd->out_va, buf_start, cmd->out_length); 491 } 492 } 493 494 fetch_response_end: 495 queue->sq_last_status = status; 496 return status; 497 } 498 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V3 00/12] Errata management for VM Live migration
by Jinqian Yang 28 Oct '25

28 Oct '25

v1: https://gitee.com/openeuler/kernel/pulls/18596 v2: https://gitee.com/openeuler/kernel/pulls/18616 v1->v2 changes: 1、Patch#2与Patch#7的KABI修改合并后放到最后一个patch; 2、Patch#5中ERRATUM_1980005的is_midr_in_range_list函数添加static inline; 3、按照主线的合入顺序进行patches的排序。 v2->v3 changes: 1、解决编译错误。 Patch#1 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#2 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#3 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#4 KVM: arm64: Allow userspace to change the implementation ID registers Reference: https://lore.kernel.org/all/20250225005401.679536-1-oliver.upton@linux.dev/ selftest相关未合入 Patch#5 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#6 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#7 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#8 arm64: Make _midr_in_range_list() an exported function Patch#9 smccc/kvm_guest: Enable errata based on implementation CPUs Reference: https://lore.kernel.org/all/20250221140229.12588-1-shameerali.kolothum.thod… selftest相关未合入 Patch#10 smccc: kvm_guest: Fix kernel builds for 32 bit arm Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… 单patch合入 Patch#11 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reference: https://lore.kernel.org/all/20250327163613.2516073-1-oliver.upton@linux.dev/ 单patch合入 Patch#12 KVM: arm64: fix kvm kabi conflict KABI屏蔽, Patch#2与Patch#7引入, 使用KABI_EXTEND屏蔽。 Jinqian Yang (1): KVM: arm64: fix kvm kabi conflict Oliver Upton (3): KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Sebastian Ott (2): KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (6): arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 18 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 40 ++-- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_host.h | 13 ++ arch/arm64/include/uapi/asm/kvm.h | 12 + arch/arm64/kernel/cpu_errata.c | 75 ++++++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/proton-pack.c | 20 +- arch/arm64/kvm/arm.c | 9 + arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 ++- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 ++ arch/arm64/kvm/sys_regs.c | 245 ++++++++++++--------- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/efi/libstub/arm64.c | 17 ++ drivers/firmware/smccc/kvm_guest.c | 66 ++++++ drivers/perf/arm_pmuv3.c | 2 +- drivers/platform/mpam/mpam_devices.c | 6 +- include/linux/arm-smccc.h | 16 ++ include/uapi/linux/kvm.h | 3 + 24 files changed, 447 insertions(+), 167 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Zhao Yipeng 28 Oct '25

28 Oct '25

*** BLURB HERE *** Jan Kara (2): udf: Preserve link count of system files udf: Detect system inodes linked into directory hierarchy fs/udf/inode.c | 16 +++++++++++++--- fs/udf/super.c | 1 + fs/udf/udf_i.h | 3 ++- 3 files changed, 16 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] xfrm: fix slab-use-after-free in decode_session6
by Dong Chenchen 28 Oct '25

28 Oct '25

From: Zhengchao Shao <shaozhengchao(a)huawei.com> stable inclusion from stable-v4.19.293 commit da4cbaa75ed088b6d70db77b9103a27e2359e243 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RFJ CVE: CVE-2023-53500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 53223f2ed1ef5c90dad814daaaefea4e68a933c8 ] When the xfrm device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when the xfrm device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff8881111458ef by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 xfrmi_xmit+0x173/0x1ca0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:intel_idle_hlt+0x23/0x30 Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f ab 00 0f 1f 44 00 00 fb f4 <fa> 44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4 RSP: 0018:ffffc90000197d78 EFLAGS: 00000246 RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5 RDX: 0000000000000001 RSI: ffffffff8d3f8080 RDI: ffffe8ffffd09c50 RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff8d3f8100 R14: 0000000000000001 R15: 0000000000000000 cpuidle_enter_state+0xd3/0x6f0 cpuidle_enter+0x4e/0xa0 do_idle+0x2fe/0x3c0 cpu_startup_entry+0x18/0x20 start_secondary+0x200/0x290 secondary_startup_64_no_verify+0x167/0x16b </TASK> Allocated by task 939: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 inet6_ifa_notify+0x118/0x230 __ipv6_ifa_notify+0x177/0xbe0 addrconf_dad_completed+0x133/0xe00 addrconf_dad_work+0x764/0x1390 process_one_work+0xa32/0x16f0 worker_thread+0x67d/0x10c0 kthread+0x344/0x440 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888111145800 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 239 bytes inside of freed 640-byte region [ffff888111145800, ffff888111145a80) As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets. Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/xfrm/xfrm_interface_core.c net/xfrm/xfrm_interface.c [commit ee9a113ab634 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_interface.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index b08385b70f65..820e85c8be2e 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -354,8 +354,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev) switch (skb->protocol) { case htons(ETH_P_IPV6): - xfrm_decode_session(skb, &fl, AF_INET6); memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + xfrm_decode_session(skb, &fl, AF_INET6); if (!dst) { fl.u.ip6.flowi6_oif = dev->ifindex; fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; @@ -369,8 +369,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev) } break; case htons(ETH_P_IP): - xfrm_decode_session(skb, &fl, AF_INET); memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + xfrm_decode_session(skb, &fl, AF_INET); if (!dst) { struct rtable *rt; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] notifiers: Add oops check in blocking_notifier_call_chain()
by Yi Yang 28 Oct '25

28 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3W9Y ------------------ In hrtimer_interrupt(), interrupts are disabled when acquiring a spinlock, which subsequently triggers an oops. During the oops call chain, blocking_notifier_call_chain() invokes _cond_resched, ultimately leading to a hard lockup. Call Stack: #0 [ffff8a317f6c3ac0] __cond_resched at ffffffffa10d29a6 #1 [ffff8a317f6c3ad8] _cond_resched at ffffffffa17292cf #2 [ffff8a317f6c3ae8] down_read at ffffffffa1728022 #3 [ffff8a317f6c3b00] __blocking_notifier_call_chain at ffffffffa10c5c37 #4 [ffff8a317f6c3b40] blocking_notifier_call_chain at ffffffffa10c5c86 #5 [ffff8a317f6c3b50] fb_notifier_call_chain at ffffffffa13c83eb #6 [ffff8a317f6c3b60] fb_blank at ffffffffa13c88eb #7 [ffff8a317f6c3ba0] fbcon_blank at ffffffffa13d4a4b #8 [ffff8a317f6c3ca0] do_unblank_screen at ffffffffa144cb30 #9 [ffff8a317f6c3cc0] unblank_screen at ffffffffa144cbf0 If the system is in an oops state, use down_read_trylock instead of a blocking lock acquisition. If the trylock fails, skip executing the notifier callbacks to avoid potential deadlocks or unsafe operations during the oops handling process. Fixes: fe9d4f576324 ("Add kernel/notifier.c") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- kernel/notifier.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/kernel/notifier.c b/kernel/notifier.c index d2aecd64b109..29e1f5d51f12 100644 --- a/kernel/notifier.c +++ b/kernel/notifier.c @@ -318,10 +318,20 @@ int __blocking_notifier_call_chain(struct blocking_notifier_head *nh, * is, we re-check the list after having taken the lock anyway: */ if (rcu_access_pointer(nh->head)) { - down_read(&nh->rwsem); - ret = notifier_call_chain(&nh->head, val, v, nr_to_call, - nr_calls); - up_read(&nh->rwsem); + if (!oops_in_progress) { + down_read(&nh->rwsem); + ret = notifier_call_chain(&nh->head, val, v, + nr_to_call, nr_calls); + up_read(&nh->rwsem); + } else { + if (down_read_trylock(&nh->rwsem)) { + ret = notifier_call_chain(&nh->head, val, + v, nr_to_call, nr_calls); + up_read(&nh->rwsem); + } else { + ret = NOTIFY_BAD; + } + } } return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53648
by Yuan Can 28 Oct '25

28 Oct '25

Su Hui (2): ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer ALSA: ac97: Fix possible error value of *rac97 sound/pci/ac97/ac97_codec.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) -- 2.22.0

2 3

[PATCH OLK-5.10 0/3] Fix CVE-2025-39993
by Yi Yang 28 Oct '25

28 Oct '25

1.media: imon: Fix race getting ictx->lock 2.media: imon: grab lock earlier in imon_ir_change_protocol() 3.media: rc: fix races with imon_disconnect() Larshin Sergey (1): media: rc: fix races with imon_disconnect() Ricardo Ribalda (1): media: imon: Fix race getting ictx->lock Tetsuo Handa (1): media: imon: grab lock earlier in imon_ir_change_protocol() drivers/media/rc/imon.c | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 V2 00/12] Errata management for VM Live migration
by Jinqian Yang 28 Oct '25

28 Oct '25

v1: https://gitee.com/openeuler/kernel/pulls/18596 v1->v2 changes: 1、Patch#2与Patch#7的KABI修改合并后放到最后一个patch; 2、Patch#5中ERRATUM_1980005的is_midr_in_range_list函数添加static inline; 3、按照主线的合入顺序进行patches的排序。 Patch#1 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#2 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#3 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#4 KVM: arm64: Allow userspace to change the implementation ID registers Reference: https://lore.kernel.org/all/20250225005401.679536-1-oliver.upton@linux.dev/ selftest相关未合入 Patch#5 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#6 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#7 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#8 arm64: Make _midr_in_range_list() an exported function Patch#9 smccc/kvm_guest: Enable errata based on implementation CPUs Reference: https://lore.kernel.org/all/20250221140229.12588-1-shameerali.kolothum.thod… selftest相关未合入 Patch#10 smccc: kvm_guest: Fix kernel builds for 32 bit arm Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… 单patch合入 Patch#11 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reference: https://lore.kernel.org/all/20250327163613.2516073-1-oliver.upton@linux.dev/ 单patch合入 Patch#12 KVM: arm64: fix kvm kabi conflict KABI屏蔽, Patch#2与Patch#7引入, 使用KABI_EXTEND屏蔽。 Jinqian Yang (1): KVM: arm64: fix kvm kabi conflict Oliver Upton (3): KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Sebastian Ott (2): KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (6): arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 18 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 40 ++-- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_host.h | 13 ++ arch/arm64/include/uapi/asm/kvm.h | 12 + arch/arm64/kernel/cpu_errata.c | 75 ++++++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/proton-pack.c | 20 +- arch/arm64/kvm/arm.c | 9 + arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 ++- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 ++ arch/arm64/kvm/sys_regs.c | 245 ++++++++++++--------- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/efi/libstub/arm64.c | 17 ++ drivers/firmware/smccc/kvm_guest.c | 66 ++++++ drivers/perf/arm_pmuv3.c | 2 +- drivers/platform/mpam/mpam_devices.c | 6 +- include/linux/arm-smccc.h | 16 ++ include/uapi/linux/kvm.h | 3 + 24 files changed, 447 insertions(+), 167 deletions(-) -- 2.33.0

2 13

[PATCH openEuler-1.0-LTS 1/2] ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
by Yuan Can 28 Oct '25

28 Oct '25

From: Su Hui <suhui(a)nfschina.com> stable inclusion from stable-v4.19.291 commit e4cccff1e7ab6ea30995b6fbbb007d02647e025c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VHK CVE: CVE-2023-53648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 79597c8bf64ca99eab385115743131d260339da5 ] smatch error: sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error: we previously assumed 'rac97' could be null (see line 2072) remove redundant assignment, return error if rac97 is NULL. Fixes: da3cec35dd3c ("ALSA: Kill snd_assert() in sound/pci/*") Signed-off-by: Su Hui <suhui(a)nfschina.com> Link: https://lore.kernel.org/r/20230615021732.1972194-1-suhui@nfschina.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/pci/ac97/ac97_codec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c index fee9ffecd584..202f8bc0a78a 100644 --- a/sound/pci/ac97/ac97_codec.c +++ b/sound/pci/ac97/ac97_codec.c @@ -2026,8 +2026,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, .dev_disconnect = snd_ac97_dev_disconnect, }; - if (rac97) - *rac97 = NULL; + if (!rac97) + return -EINVAL; if (snd_BUG_ON(!bus || !template)) return -EINVAL; if (snd_BUG_ON(template->num >= 4)) -- 2.22.0

2 3

[PATCH OLK-6.6] mm: fix __count_zid_vm_events when CONFIG_ZONE_EXTMEM is enabled
by Jinjiang Tu 28 Oct '25

28 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3R2F -------------------------------- FOR_ALL_ZONES macro doesn't define for ZONE_EXTMEM, thus vm_event_states doesn't contain PGALLOC, ALLOCSTALL, and PGSCAN_SKIP slots for ZONE_EXTMEM. As a result, __count_zid_vm_events() counts wrongly. pgalloc_device in /proc/vmstat will show the count of PGALLOC_MOVABLE, for example. Normally, we should add ZONE_EXTMEM in FOR_ALL_ZONES macro to add slots for ZONE_EXTMEM. But it will break kabi. To fix without breaking kabi, skip counting ZONE_EXTMEM items, and offset 1 slot for zones after ZONE_EXTMEM to count in the correct slots. Fixes: 6097ddd1df0a ("mm: add ZONE_EXTMEM for future extension to avoid kabi broken") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/vmstat.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/include/linux/vmstat.h b/include/linux/vmstat.h index d783d5a27352..5493c84b0d45 100644 --- a/include/linux/vmstat.h +++ b/include/linux/vmstat.h @@ -131,8 +131,27 @@ static inline void vm_events_fold_cpu(int cpu) #define count_vm_vma_lock_event(x) do {} while (0) #endif +/* + * FOR_ALL_ZONES macro doesn't define for ZONE_EXTMEM, thus + * vm_event_states doesn't contain slots of ZONE_EXTMEM, leading + * to count ZONE_MOVABLE and ZONE_DEVICE items to wrong slots. + * + * To fix without breaking kabi, skip counting ZONE_EXTMEM items, + * and offset 1 slot for zones after ZONE_EXTMEM to count in the + * correct slots. + */ +#ifndef CONFIG_ZONE_EXTMEM #define __count_zid_vm_events(item, zid, delta) \ __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) +#else +#define __count_zid_vm_events(item, zid, delta) \ + do { \ + if (zid < ZONE_EXTMEM) \ + __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta); \ + else if (zid > ZONE_EXTMEM) \ + __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid - 1, delta); \ + } while (0) +#endif /* * Zone and node-based page accounting with per cpu differentials. -- 2.43.0

2 1