- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] CVE-2025-37997
by Zhang Changzhong 05 Nov '25

05 Nov '25

Jozsef Kadlecsik (1): netfilter: ipset: fix region locking in hash types Zhen Ni (1): netfilter: ipset: Remove unused htable_bits in macro ahash_region net/netfilter/ipset/ip_set_hash_gen.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- 2.9.5

2 3

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:250:27: warning: no previous prototype for 'bpf_mem_commit_limit'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b2b8512ca97108929f3aca5405875d91577b8c80 commit: 7aa850a9126f0acd994e09afe54bb0200214e068 [3098/3098] bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511052033.01T6CrLU-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511052033.01T6CrLU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511052033.01T6CrLU-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:28:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 28 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:37:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 37 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:42:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 42 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:56:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 56 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:85:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 85 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:95:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 95 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:105:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 105 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:119:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 119 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:125:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 125 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:130:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 130 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:135:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 135 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:140:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 140 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:146:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 146 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:151:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 151 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:156:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 156 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:165:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 165 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:170:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 170 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:175:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 175 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:181:27: warning: no previous prototype for 'bpf_mem_totalcma' [-Wmissing-prototypes] 181 | __bpf_kfunc unsigned long bpf_mem_totalcma(void) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:186:27: warning: no previous prototype for 'bpf_mem_freecma' [-Wmissing-prototypes] 186 | __bpf_kfunc unsigned long bpf_mem_freecma(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:201:17: warning: no previous prototype for 'bpf_hugetlb_report_meminfo' [-Wmissing-prototypes] 201 | __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:234:27: warning: no previous prototype for 'bpf_mem_failure' [-Wmissing-prototypes] 234 | __bpf_kfunc unsigned long bpf_mem_failure(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:245:27: warning: no previous prototype for 'bpf_mem_percpu' [-Wmissing-prototypes] 245 | __bpf_kfunc unsigned long bpf_mem_percpu(void) | ^~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:250:27: warning: no previous prototype for 'bpf_mem_commit_limit' [-Wmissing-prototypes] 250 | __bpf_kfunc unsigned long bpf_mem_commit_limit(void) | ^~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:254:27: warning: no previous prototype for 'bpf_mem_committed' [-Wmissing-prototypes] 254 | __bpf_kfunc unsigned long bpf_mem_committed(void) | ^~~~~~~~~~~~~~~~~ vim +/bpf_mem_commit_limit +250 kernel/bpf-rvi/common_kfuncs.c 199 200 #ifdef CONFIG_HUGETLB_PAGE > 201 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 202 { 203 struct hstate *h; 204 unsigned long total = 0; 205 206 if (!hugepages_supported()) 207 return -1; 208 209 for_each_hstate(h) { 210 unsigned long count = h->nr_huge_pages; 211 212 total += huge_page_size(h) * count; 213 214 if (h == &default_hstate) { 215 hugepage_info->total = count; 216 hugepage_info->free = h->free_huge_pages; 217 hugepage_info->rsvd = h->resv_huge_pages; 218 hugepage_info->surp = h->surplus_huge_pages; 219 hugepage_info->size = huge_page_size(h) / SZ_1K; 220 } 221 } 222 223 hugepage_info->hugetlb = total / SZ_1K; 224 return 0; 225 } 226 #else 227 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 228 { 229 return -1; 230 } 231 #endif 232 233 #ifdef CONFIG_MEMORY_FAILURE > 234 __bpf_kfunc unsigned long bpf_mem_failure(void) 235 { 236 return atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10); 237 } 238 #else 239 __bpf_kfunc unsigned long bpf_mem_failure(void) 240 { 241 return 0; 242 } 243 #endif 244 245 __bpf_kfunc unsigned long bpf_mem_percpu(void) 246 { 247 return pcpu_nr_pages(); 248 } 249 > 250 __bpf_kfunc unsigned long bpf_mem_commit_limit(void) 251 { 252 return vm_commit_limit(); 253 } > 254 __bpf_kfunc unsigned long bpf_mem_committed(void) 255 { 256 return vm_memory_committed(); 257 } 258 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] Bluetooth: hci_core: Disable works on hci_unregister_dev
by Zhang Changzhong 05 Nov '25

05 Nov '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.12-rc5 commit 989fa5171f005ecf63440057218d8aeb1795287d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICZL5V CVE: CVE-2024-58241 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable. Fixes: 0d151a103775 ("Bluetooth: hci_core: cancel all works upon hci_unregister_dev()") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_sync.c [commit 78db544b5d27 ("Bluetooth: hci_core: Remove le_restart_scan work") and f2d897753586 ("Bluetooth: hci_sync: Remove remaining dependencies of hci_request") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/bluetooth/hci_core.c | 24 +++++++++++++++--------- net/bluetooth/hci_sync.c | 15 +++++++++++---- 2 files changed, 26 insertions(+), 13 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index c5e3ae5..4b4e3579 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1638,12 +1638,12 @@ void hci_adv_instances_clear(struct hci_dev *hdev) struct adv_info *adv_instance, *n; if (hdev->adv_instance_timeout) { - cancel_delayed_work(&hdev->adv_instance_expire); + disable_delayed_work(&hdev->adv_instance_expire); hdev->adv_instance_timeout = 0; } list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { - cancel_delayed_work_sync(&adv_instance->rpa_expired_cb); + disable_delayed_work_sync(&adv_instance->rpa_expired_cb); list_del(&adv_instance->list); kfree(adv_instance); } @@ -2670,11 +2670,11 @@ void hci_unregister_dev(struct hci_dev *hdev) list_del(&hdev->list); write_unlock(&hci_dev_list_lock); - cancel_work_sync(&hdev->rx_work); - cancel_work_sync(&hdev->cmd_work); - cancel_work_sync(&hdev->tx_work); - cancel_work_sync(&hdev->power_on); - cancel_work_sync(&hdev->error_reset); + disable_work_sync(&hdev->rx_work); + disable_work_sync(&hdev->cmd_work); + disable_work_sync(&hdev->tx_work); + disable_work_sync(&hdev->power_on); + disable_work_sync(&hdev->error_reset); hci_cmd_sync_clear(hdev); @@ -2781,8 +2781,14 @@ static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err) { bt_dev_dbg(hdev, "err 0x%2.2x", err); - cancel_delayed_work_sync(&hdev->cmd_timer); - cancel_delayed_work_sync(&hdev->ncmd_timer); + if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { + disable_delayed_work_sync(&hdev->cmd_timer); + disable_delayed_work_sync(&hdev->ncmd_timer); + } else { + cancel_delayed_work_sync(&hdev->cmd_timer); + cancel_delayed_work_sync(&hdev->ncmd_timer); + } + atomic_set(&hdev->cmd_cnt, 1); hci_cmd_sync_cancel_sync(hdev, err); diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index e086f29..9d31b78 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -5158,10 +5158,17 @@ int hci_dev_close_sync(struct hci_dev *hdev) bt_dev_dbg(hdev, ""); - cancel_delayed_work(&hdev->power_off); - cancel_delayed_work(&hdev->ncmd_timer); - cancel_delayed_work(&hdev->le_scan_disable); - cancel_delayed_work(&hdev->le_scan_restart); + if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { + disable_delayed_work(&hdev->power_off); + disable_delayed_work(&hdev->ncmd_timer); + disable_delayed_work(&hdev->le_scan_disable); + disable_delayed_work(&hdev->le_scan_restart); + } else { + cancel_delayed_work(&hdev->power_off); + cancel_delayed_work(&hdev->ncmd_timer); + cancel_delayed_work(&hdev->le_scan_disable); + cancel_delayed_work(&hdev->le_scan_restart); + } hci_request_cancel_all(hdev); -- 2.9.5

2 1

[PATCH OLK-6.6 0/2] CVE-2025-39925
by Zhang Changzhong 05 Nov '25

05 Nov '25

Tetsuo Handa (2): can: j1939: implement NETDEV_UNREGISTER notification handler can: j1939: add missing calls in NETDEV_UNREGISTER notification handler net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 +++++ net/can/j1939/socket.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 55 insertions(+) -- 2.9.5

2 3

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:244:27: warning: no previous prototype for 'bpf_mem_percpu'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 534b306a9ab27f36c465a7c90a32a1b4ff3a641c commit: af34a7a840fd24a050a5fee8ea4dcfad963f3abc [3098/3098] bpf-rvi: Add bpf_mem_percpu kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511051816.mAnFluwr-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051816.mAnFluwr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051816.mAnFluwr-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:27:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 27 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:36:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 36 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:41:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 41 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:55:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 55 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:84:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 84 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:94:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 94 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:104:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 104 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:118:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 118 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:124:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 124 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:129:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 129 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:134:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 134 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:139:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 139 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:145:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 145 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:150:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 150 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:155:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 155 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:164:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 164 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:169:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 169 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:174:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 174 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:180:27: warning: no previous prototype for 'bpf_mem_totalcma' [-Wmissing-prototypes] 180 | __bpf_kfunc unsigned long bpf_mem_totalcma(void) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:185:27: warning: no previous prototype for 'bpf_mem_freecma' [-Wmissing-prototypes] 185 | __bpf_kfunc unsigned long bpf_mem_freecma(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:200:17: warning: no previous prototype for 'bpf_hugetlb_report_meminfo' [-Wmissing-prototypes] 200 | __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:233:27: warning: no previous prototype for 'bpf_mem_failure' [-Wmissing-prototypes] 233 | __bpf_kfunc unsigned long bpf_mem_failure(void) | ^~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:244:27: warning: no previous prototype for 'bpf_mem_percpu' [-Wmissing-prototypes] 244 | __bpf_kfunc unsigned long bpf_mem_percpu(void) | ^~~~~~~~~~~~~~ vim +/bpf_mem_percpu +244 kernel/bpf-rvi/common_kfuncs.c 184 > 185 __bpf_kfunc unsigned long bpf_mem_freecma(void) 186 { 187 return global_zone_page_state(NR_FREE_CMA_PAGES); 188 } 189 190 struct bpf_mem_hugepage { 191 unsigned long total; 192 unsigned long free; 193 unsigned long rsvd; 194 unsigned long surp; 195 unsigned long size; 196 unsigned long hugetlb; 197 }; 198 199 #ifdef CONFIG_HUGETLB_PAGE 200 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 201 { 202 struct hstate *h; 203 unsigned long total = 0; 204 205 if (!hugepages_supported()) 206 return -1; 207 208 for_each_hstate(h) { 209 unsigned long count = h->nr_huge_pages; 210 211 total += huge_page_size(h) * count; 212 213 if (h == &default_hstate) { 214 hugepage_info->total = count; 215 hugepage_info->free = h->free_huge_pages; 216 hugepage_info->rsvd = h->resv_huge_pages; 217 hugepage_info->surp = h->surplus_huge_pages; 218 hugepage_info->size = huge_page_size(h) / SZ_1K; 219 } 220 } 221 222 hugepage_info->hugetlb = total / SZ_1K; 223 return 0; 224 } 225 #else 226 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 227 { 228 return -1; 229 } 230 #endif 231 232 #ifdef CONFIG_MEMORY_FAILURE 233 __bpf_kfunc unsigned long bpf_mem_failure(void) 234 { 235 return atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10); 236 } 237 #else 238 __bpf_kfunc unsigned long bpf_mem_failure(void) 239 { 240 return 0; 241 } 242 #endif 243 > 244 __bpf_kfunc unsigned long bpf_mem_percpu(void) 245 { 246 return pcpu_nr_pages(); 247 } 248 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] PM: sleep: core: Clear power.must_resume in noirq suspend error path
by Xinyu Zheng 05 Nov '25

05 Nov '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.18-rc1 commit be82483d1b60baf6747884bd74cb7de484deaf76 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4AQL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- If system suspend is aborted in the "noirq" phase (for instance, due to an error returned by one of the device callbacks), power.is_noirq_suspended will not be set for some devices and device_resume_noirq() will return early for them. Consequently, noirq resume callbacks will not run for them at all because the noirq suspend callbacks have not run for them yet. If any of them has power.must_resume set and late suspend has been skipped for it (due to power.smart_suspend), early resume should be skipped for it either, or its state may become inconsistent (for instance, if the early resume assumes that it will always follow noirq resume). Make that happen by clearing power.must_resume in device_resume_noirq() for devices with power.is_noirq_suspended clear that have been left in suspend by device_suspend_late(), which will subsequently cause device_resume_early() to leave the device in suspend and avoid changing its state. Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowla… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Ulf Hansson <ulf.hansson(a)linaro.org> Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki Conflicts: drivers/base/power/main.c [context conflict and function rename] Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/base/power/main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c index fe7506aae13c..703de8f203a6 100644 --- a/drivers/base/power/main.c +++ b/drivers/base/power/main.c @@ -625,8 +625,20 @@ static int device_resume_noirq(struct device *dev, pm_message_t state, bool asyn if (dev->power.syscore || dev->power.direct_complete) goto Out; - if (!dev->power.is_noirq_suspended) + if (!dev->power.is_noirq_suspended) { + /* + * This means that system suspend has been aborted in the noirq + * phase before invoking the noirq suspend callback for the + * device, so if device_suspend_late() has left it in suspend, + * device_resume_early() should leave it in suspend either in + * case the early resume of it depends on the noirq resume that + * has not run. + */ + if (dev_pm_smart_suspend_and_suspended(dev)) + dev->power.must_resume = false; + goto Out; + } dpm_wait_for_superior(dev, async); -- 2.34.1

2 1

[PATCH OLK-6.6] mm: swap: check for stable address space before operating on the VMA
by Ze Zuo 05 Nov '25

05 Nov '25

From: Charan Teja Kalla <charan.kalla(a)oss.qualcomm.com> mainline inclusion from mainline-v6.18-rc1 commit 1367da7eb875d01102d2ed18654b24d261ff5393 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID22QV CVE: CVE-2025-39992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is possible to hit a zero entry while traversing the vmas in unuse_mm() called from swapoff path and accessing it causes the OOPS: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000446--> Loading the memory from offset 0x40 on the XA_ZERO_ENTRY as address. Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault The issue is manifested from the below race between the fork() on a process and swapoff: fork(dup_mmap()) swapoff(unuse_mm) --------------- ----------------- 1) Identical mtree is built using __mt_dup(). 2) copy_pte_range()--> copy_nonpresent_pte(): The dst mm is added into the mmlist to be visible to the swapoff operation. 3) Fatal signal is sent to the parent process(which is the current during the fork) thus skip the duplication of the vmas and mark the vma range with XA_ZERO_ENTRY as a marker for this process that helps during exit_mmap(). 4) swapoff is tried on the 'mm' added to the 'mmlist' as part of the 2. 5) unuse_mm(), that iterates through the vma's of this 'mm' will hit the non-NULL zero entry and operating on this zero entry as a vma is resulting into the oops. The proper fix would be around not exposing this partially-valid tree to others when droping the mmap lock, which is being solved with [1]. A simpler solution would be checking for MMF_UNSTABLE, as it is set if mm_struct is not fully initialized in dup_mmap(). Thanks to Liam/Lorenzo/David for all the suggestions in fixing this issue. Link: https://lkml.kernel.org/r/20250924181138.1762750-1-charan.kalla@oss.qualcom… Link: https://lore.kernel.org/all/20250815191031.3769540-1-Liam.Howlett@oracle.co… [1] Fixes: d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") Signed-off-by: Charan Teja Kalla <charan.kalla(a)oss.qualcomm.com> Suggested-by: David Hildenbrand <david(a)redhat.com> Cc: Baoquan He <bhe(a)redhat.com> Cc: Barry Song <baohua(a)kernel.org> Cc: Chris Li <chrisl(a)kernel.org> Cc: Kairui Song <kasong(a)tencent.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Nhat Pham <nphamcs(a)gmail.com> Cc: Peng Zhang <zhangpeng.00(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/swapfile.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/swapfile.c b/mm/swapfile.c index 5e77c6417ec6..3c98e0447994 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -2190,6 +2190,8 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type) VMA_ITERATOR(vmi, mm, 0); mmap_read_lock(mm); + if (check_stable_address_space(mm)) + goto unlock; for_each_vma(vmi, vma) { if (vma->anon_vma && !is_vm_hugetlb_page(vma)) { ret = unuse_vma(vma, type); @@ -2199,6 +2201,7 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type) cond_resched(); } +unlock: mmap_read_unlock(mm); return ret; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] CVE-2025-39910
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-39910 Alexander Gordeev (1): kasan: avoid sleepable page allocation from atomic context Andrey Konovalov (1): kasan: use unchecked __memset internally Uladzislau Rezki (Sony) (1): mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() include/linux/kasan.h | 6 +-- mm/kasan/report.c | 4 +- mm/kasan/shadow.c | 111 ++++++++++++++++++++++++++++++++++++------ mm/vmalloc.c | 8 +-- 4 files changed, 105 insertions(+), 24 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/2] CVE-2025-38627
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-38627 Zhiguo Niu (2): f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic fs/f2fs/compress.c | 76 +++++++++++++++++++++++----------------------- fs/f2fs/f2fs.h | 2 ++ 2 files changed, 40 insertions(+), 38 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
by Ze Zuo 05 Nov '25

05 Nov '25

From: Manuel Andreas <manuel.andreas(a)tum.de> mainline inclusion from mainline-v6.16-rc1 commit 5a53249d149f48b558368c5338b9921b76a12f8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD7K CVE: CVE-2025-38469 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports > 1). After the kmalloc_array(), the error paths need to go through the "out" label, but the call to kvm_read_guest_virt() does not. Fixes: 92c58965e965 ("KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly") Reviewed-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Manuel Andreas <manuel.andreas(a)tum.de> [Adjusted commit message. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- arch/x86/kvm/xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index 0ea6016ad132..eb62e05e8e63 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -1260,7 +1260,7 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, if (kvm_read_guest_virt(vcpu, (gva_t)sched_poll.ports, ports, sched_poll.nr_ports * sizeof(*ports), &e)) { *r = -EFAULT; - return true; + goto out; } for (i = 0; i < sched_poll.nr_ports; i++) { -- 2.25.1

2 1