- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] xdp: Reset bpf_redirect_info before running a xdp's BPF prog.
by Wang Liang 05 Aug '25

05 Aug '25

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> stable inclusion from stable-v6.6.88 commit 202bca49b7f9ed3c5f5f7bb00adabea6339efe2d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6350 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Ricardo reported a KASAN discovered use after free in v6.6-stable. The syzbot starts a BPF program via xdp_test_run_batch() which assigns ri->tgt_value via dev_hash_map_redirect() and the return code isn't XDP_REDIRECT it looks like nonsense. So the output in bpf_warn_invalid_xdp_action() appears once. Then the TUN driver runs another BPF program (on the same CPU) which returns XDP_REDIRECT without setting ri->tgt_value first. It invokes bpf_trace_printk() to print four characters and obtain the required return value. This is enough to get xdp_do_redirect() invoked which then accesses the pointer in tgt_value which might have been already deallocated. This problem does not affect upstream because since commit 401cb7dae8130 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") the per-CPU variable is referenced via task's task_struct and exists on the stack during NAPI callback. Therefore it is cleared once before the first invocation and remains valid within the RCU section of the NAPI callback. Instead of performing the huge backport of the commit (plus its fix ups) here is an alternative version which only resets the variable in question prior invoking the BPF program. Acked-by: Toke Høiland-Jørgensen <toke(a)kernel.org> Reported-by: Ricardo Cañuelo Navarro <rcn(a)igalia.com> Closes: https://lore.kernel.org/all/20250226-20250204-kasan-slab-use-after-free-rea… Fixes: 97f91a7cf04ff ("bpf: add bpf_redirect_map helper routine") Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/xdp.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/include/net/xdp.h b/include/net/xdp.h index 9b9c7dc25eeb..31698ef493b3 100644 --- a/include/net/xdp.h +++ b/include/net/xdp.h @@ -511,7 +511,14 @@ static __always_inline u32 bpf_prog_run_xdp(const struct bpf_prog *prog, * under local_bh_disable(), which provides the needed RCU protection * for accessing map entries. */ - u32 act = __bpf_prog_run(prog, xdp, BPF_DISPATCHER_FUNC(xdp)); + struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info); + u32 act; + + if (ri->map_id || ri->map_type) { + ri->map_id = 0; + ri->map_type = BPF_MAP_TYPE_UNSPEC; + } + act = __bpf_prog_run(prog, xdp, BPF_DISPATCHER_FUNC(xdp)); if (static_branch_unlikely(&bpf_master_redirect_enabled_key)) { if (act == XDP_TX && netif_is_bond_slave(xdp->rxq->dev)) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport mainline patch
by Wang Liang 05 Aug '25

05 Aug '25

Hangbin Liu (1): bonding: return detailed error when loading native XDP fails Wang Liang (1): bonding: check xdp prog when set bond mode drivers/net/bonding/bond_main.c | 11 +++++++---- drivers/net/bonding/bond_options.c | 3 +++ include/net/bonding.h | 1 + 3 files changed, 11 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
by Yifan Qiao 05 Aug '25

05 Aug '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.16-rc3 commit d8ab68bdb294b09a761e967dad374f2965e1913f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXB6 CVE: CVE-2025-38399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: John Meneghini <jmeneghi(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/target/target_core_pr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index b42193c554fb..2bc849799739 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -1858,7 +1858,9 @@ core_scsi3_decode_spec_i_port( } kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); - core_scsi3_lunacl_undepend_item(dest_se_deve); + + if (dest_se_deve) + core_scsi3_lunacl_undepend_item(dest_se_deve); if (is_local) continue; -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
by Yifan Qiao 05 Aug '25

05 Aug '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.16-rc3 commit d8ab68bdb294b09a761e967dad374f2965e1913f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXB6 CVE: CVE-2025-38399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: John Meneghini <jmeneghi(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/target/target_core_pr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index 49d9167bb263..a9eb6a3e8383 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -1841,7 +1841,9 @@ core_scsi3_decode_spec_i_port( } kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); - core_scsi3_lunacl_undepend_item(dest_se_deve); + + if (dest_se_deve) + core_scsi3_lunacl_undepend_item(dest_se_deve); if (is_local) continue; -- 2.39.2

2 1

[PATCH OLK-6.6] sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog
by Yang Yingliang 05 Aug '25

05 Aug '25

hulk inclusion category: other bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- sdei watchdog needs to be initialized after sdei_init, so commit 1509d06c9c41 ("init: only move down lockup_detector_init() when sdei_watchdog is enabled") move down the lockup_detector_init(). Now Commit 930d8f8dbab9 ("watchdog/perf: adapt the watchdog_perf interface for async model") provide an API lockup_detector_retry_init() for anyone who needs to delayed init lockup detector, so use this API to delay init sdei watchdog. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 10 ++++++++++ drivers/perf/arm_pmuv3.c | 2 +- init/main.c | 7 +------ kernel/watchdog.c | 10 +++++++--- 4 files changed, 19 insertions(+), 10 deletions(-) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index d1ad8c184296..19f47e24fa59 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -183,3 +183,13 @@ int __init sdei_watchdog_hardlockup_probe(void) return 0; } + +static int __init sdei_watchdog_hardlockup_init(void) +{ + /* sdei_watchdog needs to be initialized after sdei_init */ + if (!disable_sdei_nmi_watchdog) + lockup_detector_retry_init(); + + return 0; +} +device_initcall(sdei_watchdog_hardlockup_init) diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c index baa700ab5e03..c51206684863 100644 --- a/drivers/perf/arm_pmuv3.c +++ b/drivers/perf/arm_pmuv3.c @@ -1582,7 +1582,7 @@ static int __init armv8_pmu_driver_init(void) else ret = arm_pmu_acpi_probe(armv8_pmuv3_pmu_init); - if (!ret) + if (!ret && disable_sdei_nmi_watchdog) lockup_detector_retry_init(); return ret; diff --git a/init/main.c b/init/main.c index afead48c58e4..f97f06547078 100644 --- a/init/main.c +++ b/init/main.c @@ -1546,8 +1546,7 @@ static noinline void __init kernel_init_freeable(void) rcu_init_tasks_generic(); do_pre_smp_initcalls(); - if (disable_sdei_nmi_watchdog) - lockup_detector_init(); + lockup_detector_init(); smp_init(); sched_init_smp(); @@ -1558,10 +1557,6 @@ static noinline void __init kernel_init_freeable(void) do_basic_setup(); - /* sdei_watchdog needs to be initialized after sdei_init */ - if (!disable_sdei_nmi_watchdog) - lockup_detector_init(); - kunit_run_all_tests(); wait_for_initramfs(); diff --git a/kernel/watchdog.c b/kernel/watchdog.c index ea5c5f9371b1..6313fe17bca7 100644 --- a/kernel/watchdog.c +++ b/kernel/watchdog.c @@ -986,7 +986,12 @@ static void __init lockup_detector_delay_init(struct work_struct *work) { int ret; - ret = watchdog_hardlockup_probe(); + if (disable_sdei_nmi_watchdog) { + ret = watchdog_hardlockup_probe(); + } else { + ret = sdei_watchdog_hardlockup_probe(); + } + if (ret) { pr_info("Delayed init of the lockup detector failed: %d\n", ret); pr_info("Hard watchdog permanently disabled\n"); @@ -1042,8 +1047,7 @@ void __init lockup_detector_init(void) cpumask_copy(&watchdog_cpumask, housekeeping_cpumask(HK_TYPE_TIMER)); - if ((!disable_sdei_nmi_watchdog && !sdei_watchdog_hardlockup_probe()) || - (disable_sdei_nmi_watchdog && !watchdog_hardlockup_probe())) + if (disable_sdei_nmi_watchdog && !watchdog_hardlockup_probe()) watchdog_hardlockup_available = true; else allow_lockup_detector_init_retry = true; -- 2.25.1

2 1

[PATCH OLK-6.6 v6 00/39] High Performance Container Resource View Isolation -- Stage 2
by GONG Ruiqi 05 Aug '25

05 Aug '25

v6: - Remove bpf_mem_direct_map(). Export direct_pages_count[] and get it via bpf_x86_direct_pages(). v5: - Gather bpf_arm64_cpu_have_feature() into arch/arm64/kernel/bpf-rvi.c v4: - Fix compile failure of bpf_mem_failure() when CONFIG_MEMORY_FAILURE=n - Move iterator target for diskstats & partitions into block/bpf-rvi.c, to avoid unexpected "kABI changes" (actually no) v3: - Optimize swaptotal's estimation and make it a stand-alone function v2: - Remove pidns's refcount from the loadavg global list. - Optimize calculation of swap{total,usage,free} for swap and meminfo - Fix a put_task_struct() missing for bpf_disk_seqf_start() - Remove ineffective build control in samples/bpf/Makefile - Clean up some commented code --- Common supports: bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask() bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc bpf-rvi: cpuacct: Add task_cpuacct() Cpuinfo_arm64: bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc bpf-rvi: arm64: Add cpuinfo_arm64 iterator target bpf-rvi: Add bpf_arch_flags kunc for arm64 samples/bpf: Add iterator program for cpuinfo_arm64 Diskstats: bpf-rvi: block: Add diskstats iterator target bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc samples/bpf: Add iterator program for diskstats Partitions: bpf-rvi: block: Add partitions iterator target bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions samples/bpf: Add iterator program for partitions Loadavg: bpf-rvi: pidns: Calculate loadavg for each pid namespace bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs samples/bpf: Add iterator program for loadavg Uptime: bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc samples/bpf: Add iterator program for uptime Swaps: bpf-rvi: Add bpf_si_memswinfo() kfunc bpf-rvi: Add bpf_page_counter_read() kfunc samples/bpf: Add iterator program for swaps Stat: bpf-rvi: Add bpf_seq_file_append() kfunc bpf-rvi: Add stat-related misc kfuncs bpf-rvi: Add cpu runqueue related kfuncs bpf-rvi: Add kstat_ & kcpustat_ kfuncs bpf-rvi: stat: Add stat iterator target samples/bpf: Add iterator program for stat Meminfo: bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc bpf-rvi: Add bpf_mem_{total,free}cma kfunc bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc bpf-rvi: Add bpf_mem_failure kfunc bpf-rvi: Add bpf_mem_percpu kfunc bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc bpf-rvi: Add bpf_x86_direct_pages kfunc samples/bpf: Add iterator program for meminfo --- GONG Ruiqi (32): bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask() bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc bpf-rvi: cpuacct: Add task_cpuacct() bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc bpf-rvi: arm64: Add cpuinfo_arm64 iterator target bpf-rvi: arm64: Add bpf_arch_flags kunc for arm64 samples/bpf: Add iterator program for cpuinfo_arm64 bpf-rvi: block: Add diskstats iterator target bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc samples/bpf: Add iterator program for diskstats bpf-rvi: block: Add partitions iterator target bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions samples/bpf: Add iterator program for partitions bpf-rvi: pidns: Calculate loadavg for each pid namespace bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs samples/bpf: Add iterator program for loadavg bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc samples/bpf: Add iterator program for uptime bpf-rvi: Add bpf_si_memswinfo() kfunc bpf-rvi: Add bpf_page_counter_read() kfunc samples/bpf: Add iterator program for swaps bpf-rvi: Add bpf_seq_file_append() kfunc bpf-rvi: Add stat-related misc kfuncs bpf-rvi: Add cpu runqueue related kfuncs bpf-rvi: Add kstat_ & kcpustat_ kfuncs bpf-rvi: stat: Add stat iterator target samples/bpf: Add iterator program for stat bpf-rvi: Add bpf_x86_direct_pages kfunc samples/bpf: Add iterator program for meminfo Gu Bowen (7): bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc bpf-rvi: Add bpf_mem_{total,free}cma kfunc bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc bpf-rvi: Add bpf_mem_failure kfunc bpf-rvi: Add bpf_mem_percpu kfunc bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/bpf-rvi.c | 223 ++++++++++++ arch/arm64/kernel/cpuinfo.c | 128 +------ arch/arm64/kernel/hwcap_str.h | 131 +++++++ arch/x86/mm/pat/set_memory.c | 7 + block/Kconfig.iosched | 3 + block/Makefile | 1 + block/blk-cgroup.c | 158 +++++++++ block/bpf-rvi.c | 442 ++++++++++++++++++++++++ block/genhd.c | 3 +- fs/proc/stat.c | 204 +++++++++++ include/linux/cgroup.h | 12 + include/linux/pid.h | 5 + include/linux/pid_namespace.h | 28 ++ kernel/bpf-rvi/Kconfig | 2 + kernel/bpf-rvi/Makefile | 2 +- kernel/bpf-rvi/common_kfuncs.c | 324 +++++++++++++++++ kernel/bpf-rvi/generic_single_iter.c | 3 + kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 18 + kernel/pid.c | 9 + kernel/pid_namespace.c | 130 +++++++ kernel/sched/cpuacct.c | 43 +++ samples/bpf/bpf_rvi_cpuinfo_arm64.bpf.c | 112 ++++++ samples/bpf/bpf_rvi_diskstats.bpf.c | 299 ++++++++++++++++ samples/bpf/bpf_rvi_loadavg.bpf.c | 60 ++++ samples/bpf/bpf_rvi_meminfo.bpf.c | 286 +++++++++++++++ samples/bpf/bpf_rvi_partitions.bpf.c | 42 +++ samples/bpf/bpf_rvi_stat.bpf.c | 220 ++++++++++++ samples/bpf/bpf_rvi_swaps.bpf.c | 138 ++++++++ samples/bpf/bpf_rvi_uptime.bpf.c | 122 +++++++ 31 files changed, 3029 insertions(+), 131 deletions(-) create mode 100644 arch/arm64/kernel/bpf-rvi.c create mode 100644 arch/arm64/kernel/hwcap_str.h create mode 100644 block/bpf-rvi.c create mode 100644 kernel/bpf-rvi/common_kfuncs.c create mode 100644 samples/bpf/bpf_rvi_cpuinfo_arm64.bpf.c create mode 100644 samples/bpf/bpf_rvi_diskstats.bpf.c create mode 100644 samples/bpf/bpf_rvi_loadavg.bpf.c create mode 100644 samples/bpf/bpf_rvi_meminfo.bpf.c create mode 100644 samples/bpf/bpf_rvi_partitions.bpf.c create mode 100644 samples/bpf/bpf_rvi_stat.bpf.c create mode 100644 samples/bpf/bpf_rvi_swaps.bpf.c create mode 100644 samples/bpf/bpf_rvi_uptime.bpf.c -- 2.25.1

2 40

[openeuler:openEuler-1.0-LTS 1743/1743] drivers/md/bcache/acache.c:65:5: warning: no previous prototype for 'acache_open'
by kernel test robot 05 Aug '25

05 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cea2d27f02854c9aba193ad093f873bbda55f449 commit: 1c09f1b02db96b8277226cbe64fe5bbd185a7149 [1743/1743] bcache: add a framework to perform prefetch config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250805/202508050735.PtzXJY7a-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250805/202508050735.PtzXJY7a-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508050735.PtzXJY7a-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/md/bcache/acache.c:65:5: warning: no previous prototype for 'acache_open' [-Wmissing-prototypes] 65 | int acache_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ >> drivers/md/bcache/acache.c:83:5: warning: no previous prototype for 'acache_release' [-Wmissing-prototypes] 83 | int acache_release(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:89:9: warning: no previous prototype for 'read_circ_slice' [-Wmissing-prototypes] 89 | ssize_t read_circ_slice(struct acache_circ *circ, struct acache_info *buf, | ^~~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:224:6: warning: no previous prototype for 'init_acache_circ' [-Wmissing-prototypes] 224 | void init_acache_circ(struct acache_circ **circ, void *startaddr) | ^~~~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:253:5: warning: no previous prototype for 'acache_prefetch_init' [-Wmissing-prototypes] 253 | int acache_prefetch_init(struct acache_device *adev) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:401:20: warning: no previous prototype for 'get_cached_device_by_dev' [-Wmissing-prototypes] 401 | struct cached_dev *get_cached_device_by_dev(dev_t dev) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:414:13: warning: no previous prototype for 'get_bio_by_item' [-Wmissing-prototypes] 414 | struct bio *get_bio_by_item(struct cached_dev *dc, struct acache_info *item) | ^~~~~~~~~~~~~~~ vim +/acache_open +65 drivers/md/bcache/acache.c 63 64 > 65 int acache_open(struct inode *inode, struct file *filp) 66 { 67 struct mem_reg *dev; 68 69 int minor = MINOR(inode->i_rdev); 70 71 if (minor >= ACACHE_NR_DEVS) 72 return -ENODEV; 73 if (atomic_xchg(&acache_opened_dev, 1)) 74 return -EPERM; 75 76 dev = &adev.mem_regionp[minor]; 77 78 filp->private_data = dev; 79 80 return 0; 81 } 82 > 83 int acache_release(struct inode *inode, struct file *filp) 84 { 85 atomic_dec(&acache_opened_dev); 86 return 0; 87 } 88 > 89 ssize_t read_circ_slice(struct acache_circ *circ, struct acache_info *buf, 90 size_t size) 91 { 92 unsigned long first, todo, flags; 93 94 spin_lock_irqsave(&circ->lock, flags); 95 96 todo = CIRC_CNT(circ->head, circ->tail, circ->size); 97 if (todo == 0) { 98 spin_unlock_irqrestore(&circ->lock, flags); 99 return 0; 100 } 101 if (todo > size / sizeof(struct acache_info)) 102 todo = size / sizeof(struct acache_info); 103 104 first = CIRC_CNT_TO_END(circ->head, circ->tail, circ->size); 105 if (first > todo) 106 first = todo; 107 108 memcpy(buf, circ->data + circ->tail, first * sizeof(struct acache_info)); 109 if (first < todo) 110 memcpy(buf + first, circ->data, 111 (todo - first) * sizeof(struct acache_info)); 112 circ->tail = (circ->tail + todo) & (circ->size - 1); 113 114 spin_unlock_irqrestore(&circ->lock, flags); 115 return todo * sizeof(struct acache_info); 116 } 117 118 static ssize_t acache_read(struct file *filp, char __user *buf, 119 size_t size, loff_t *ppos) 120 { 121 long ret, cut; 122 123 if (metadata.conntype != ACACHE_READWRITE_CONN) 124 return -EINVAL; 125 126 if (size > MAX_TRANSFER_SIZE) 127 size = MAX_TRANSFER_SIZE; 128 129 ret = read_circ_slice(adev.acache_info_circ, adev.readbuf, size); 130 if (ret <= 0) 131 return ret; 132 133 cut = copy_to_user(buf, adev.readbuf, size); 134 return ret - cut; 135 } 136 137 int process_one_request(struct acache_info *item); 138 static void prefetch_worker_func(struct work_struct *work) 139 { 140 struct prefetch_worker *sw = 141 container_of(work, struct prefetch_worker, work); 142 143 process_one_request(&sw->s); 144 spin_lock(&adev.prefetch_workers_free_list_lock); 145 list_add_tail(&sw->list, &adev.prefetch_workers_free); 146 spin_unlock(&adev.prefetch_workers_free_list_lock); 147 } 148 149 static int queue_prefetch_item(struct acache_info *s) 150 { 151 struct prefetch_worker *sw; 152 153 spin_lock(&adev.prefetch_workers_free_list_lock); 154 sw = list_first_entry_or_null(&adev.prefetch_workers_free, 155 struct prefetch_worker, list); 156 if (!sw) { 157 spin_unlock(&adev.prefetch_workers_free_list_lock); 158 return -1; 159 } 160 list_del_init(&sw->list); 161 spin_unlock(&adev.prefetch_workers_free_list_lock); 162 163 memcpy(&sw->s, s, sizeof(struct acache_info)); 164 INIT_WORK(&sw->work, prefetch_worker_func); 165 queue_work(adev.wq, &sw->work); 166 return 0; 167 } 168 169 static ssize_t acache_write(struct file *filp, const char __user *buf, 170 size_t size, loff_t *ppos) 171 { 172 long cut; 173 int i; 174 175 if (metadata.conntype != ACACHE_READWRITE_CONN) 176 return -EINVAL; 177 178 if (size > MAX_TRANSFER_SIZE) 179 size = MAX_TRANSFER_SIZE; 180 181 cut = copy_from_user(adev.writebuf, buf, size); 182 for (i = 0; i < (size - cut) / sizeof(struct acache_info); i++) { 183 if (queue_prefetch_item(adev.writebuf + i)) 184 break; 185 } 186 return i * sizeof(struct acache_info); 187 } 188 189 static long acache_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 190 { 191 switch (cmd) { 192 case ACACHE_GET_METADATA: 193 return copy_to_user((struct acache_metadata __user *)arg, 194 &metadata, sizeof(struct acache_metadata)); 195 default: 196 return -EINVAL; 197 } 198 } 199 200 static const struct file_operations acache_fops = { 201 .owner = THIS_MODULE, 202 .read = acache_read, 203 .write = acache_write, 204 .open = acache_open, 205 .release = acache_release, 206 .unlocked_ioctl = acache_ioctl, 207 }; 208 209 void save_circ_item(struct acache_info *data) 210 { 211 unsigned long flags; 212 struct acache_circ *circ = adev.acache_info_circ; 213 214 spin_lock_irqsave(&circ->lock, flags); 215 if (CIRC_SPACE(circ->head, circ->tail, circ->size) >= 1) { 216 memcpy(&circ->data[circ->head], data, sizeof(struct acache_info)); 217 circ->head = (circ->head + 1) & (circ->size - 1); 218 } else { 219 pr_debug("ringbuffer is full; discard new request."); 220 } 221 spin_unlock_irqrestore(&circ->lock, flags); 222 } 223 > 224 void init_acache_circ(struct acache_circ **circ, void *startaddr) 225 { 226 *circ = (struct acache_circ *)startaddr; 227 (*circ)->head = 0; 228 (*circ)->tail = 0; 229 (*circ)->size = ACACHE_CIRC_SIZE; 230 spin_lock_init(&(*circ)->lock); 231 } 232 233 static void acache_free_mem(void) 234 { 235 int i; 236 237 for (i = 0; i < ACACHE_NR_DEVS; i++) 238 vfree(adev.mem_regionp[i].data); 239 240 if (adev.readbuf) { 241 vfree(adev.readbuf); 242 adev.readbuf = NULL; 243 } 244 if (adev.writebuf) { 245 vfree(adev.writebuf); 246 adev.writebuf = NULL; 247 } 248 249 kfree(adev.prefetch_workers); 250 adev.prefetch_workers = NULL; 251 } 252 > 253 int acache_prefetch_init(struct acache_device *adev) 254 { 255 int i; 256 257 if (acache_prefetch_workers <= 0) { 258 pr_err("acache_dev_size should not be less than zero"); 259 return -1; 260 } 261 adev->prefetch_workers = kmalloc_array(acache_prefetch_workers, 262 sizeof(struct prefetch_worker), 263 GFP_KERNEL); 264 if (!adev->prefetch_workers) 265 goto fail_prefetch_workers_alloc; 266 267 INIT_LIST_HEAD(&adev->prefetch_workers_free); 268 spin_lock_init(&adev->prefetch_workers_free_list_lock); 269 for (i = 0; i < acache_prefetch_workers; i++) { 270 spin_lock(&adev->prefetch_workers_free_list_lock); 271 list_add_tail(&adev->prefetch_workers[i].list, 272 &adev->prefetch_workers_free); 273 spin_unlock(&adev->prefetch_workers_free_list_lock); 274 } 275 276 adev->wq = alloc_workqueue("acache_prefetch", WQ_MEM_RECLAIM, 0); 277 if (!adev->wq) 278 goto fail_workqueue_alloc; 279 280 return 0; 281 282 fail_workqueue_alloc: 283 kfree(adev->prefetch_workers); 284 adev->prefetch_workers = NULL; 285 fail_prefetch_workers_alloc: 286 if (adev->wq) 287 destroy_workqueue(adev->wq); 288 return -1; 289 } 290 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1743/1743] arch/x86/kernel/cpu/cacheinfo.c:685:6: warning: no previous prototype for 'cacheinfo_hygon_init_llc_id'
by kernel test robot 05 Aug '25

05 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5c1061eccd6b1d6c12741278240a2b93ff91a0a8 commit: 1a0525a3d6d3c9c8effb3ae49581ef8ef99d8b26 [1743/1743] x86/cpu: Get cache info and setup cache cpumap for Hygon Dhyana config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250805/202508050522.5Dp2I0DP-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250805/202508050522.5Dp2I0DP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508050522.5Dp2I0DP-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/cpu/cacheinfo.c:647:6: warning: no previous prototype for 'cacheinfo_amd_init_llc_id' [-Wmissing-prototypes] 647 | void cacheinfo_amd_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/cpu/cacheinfo.c:685:6: warning: no previous prototype for 'cacheinfo_hygon_init_llc_id' [-Wmissing-prototypes] 685 | void cacheinfo_hygon_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kernel/cpu/cacheinfo.c: In function 'amd_cpuid4': arch/x86/kernel/cpu/cacheinfo.c:249:20: warning: this statement may fall through [-Wimplicit-fallthrough=] 249 | l1 = &l1i; | ~~~^~~~~~ arch/x86/kernel/cpu/cacheinfo.c:250:9: note: here 250 | case 0: | ^~~~ vim +/cacheinfo_hygon_init_llc_id +685 arch/x86/kernel/cpu/cacheinfo.c 684 > 685 void cacheinfo_hygon_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id) 686 { 687 /* 688 * We may have multiple LLCs if L3 caches exist, so check if we 689 * have an L3 cache by looking at the L3 cache CPUID leaf. 690 */ 691 if (!cpuid_edx(0x80000006)) 692 return; 693 694 /* 695 * LLC is at the core complex level. 696 * Core complex ID is ApicId[3] for these processors. 697 */ 698 per_cpu(cpu_llc_id, cpu) = c->apicid >> 3; 699 } 700 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V1] i2c/designware: Fix an initialization issue
by Wang Tao 05 Aug '25

05 Aug '25

From: "Michael J. Ruhl" <michael.j.ruhl(a)intel.com> stable inclusion from stable-v6.6.97 commit 6358cb9c2a31e23b6b51bfcd7fe2b7becaf6b149 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXE9 CVE: CVE-2025-38380 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3d30048958e0d43425f6d4e76565e6249fa71050 upstream. The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the dev context to be initialized. amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx. This could allow an out of bounds access (of msgs). Initialize msg_write_idx before calling i2c_dw_xfer_init(). Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Fixes: 17631e8ca2d3 ("i2c: designware: Add driver support for AMD NAVI GPU") Cc: <stable(a)vger.kernel.org> # v5.13+ Signed-off-by: Michael J. Ruhl <michael.j.ruhl(a)intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org> Link: https://lore.kernel.org/r/20250627143511.489570-1-michael.j.ruhl@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/i2c/busses/i2c-designware-master.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c index 579c668cb78a..042642a93cf2 100644 --- a/drivers/i2c/busses/i2c-designware-master.c +++ b/drivers/i2c/busses/i2c-designware-master.c @@ -327,6 +327,7 @@ static int amd_i2c_dw_xfer_quirk(struct i2c_adapter *adap, struct i2c_msg *msgs, dev->msgs = msgs; dev->msgs_num = num_msgs; + dev->msg_write_idx = 0; i2c_dw_xfer_init(dev); regmap_write(dev->map, DW_IC_INTR_MASK, 0); -- 2.34.1

2 1

[PATCH OLK-6.6 1/2] x86/apic: Provide cpu_primary_thread mask
by Qi Xi 05 Aug '25

05 Aug '25

From: Thomas Gleixner <tglx(a)linutronix.de> commit f54d4434c281f38b975d58de47adeca671beff4f upstream. Make the primary thread tracking CPU mask based in preparation for simpler handling of parallel bootup. Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Michael Kelley <mikelley(a)microsoft.com> Tested-by: Oleksandr Natalenko <oleksandr(a)natalenko.name> Tested-by: Helge Deller <deller(a)gmx.de> # parisc Tested-by: Guilherme G. Piccoli <gpiccoli(a)igalia.com> # Steam Deck Link: https://lore.kernel.org/r/20230512205257.186599880@linutronix.de Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/x86/include/asm/apic.h | 2 -- arch/x86/include/asm/topology.h | 18 ++++++++++++++---- arch/x86/kernel/apic/apic.c | 20 +++++++++----------- arch/x86/kernel/smpboot.c | 11 +++-------- 4 files changed, 26 insertions(+), 25 deletions(-) diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h index 48067af94678..b54aedbfde7e 100644 --- a/arch/x86/include/asm/apic.h +++ b/arch/x86/include/asm/apic.h @@ -503,10 +503,8 @@ extern int default_check_phys_apicid_present(int phys_apicid); #endif /* CONFIG_X86_LOCAL_APIC */ #ifdef CONFIG_SMP -bool apic_id_is_primary_thread(unsigned int id); void apic_smt_update(void); #else -static inline bool apic_id_is_primary_thread(unsigned int id) { return false; } static inline void apic_smt_update(void) { } #endif diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h index 39b3b4a12773..196cfd25d2e4 100644 --- a/arch/x86/include/asm/topology.h +++ b/arch/x86/include/asm/topology.h @@ -31,9 +31,9 @@ * CONFIG_NUMA. */ #include <linux/numa.h> +#include <linux/cpumask.h> #ifdef CONFIG_NUMA -#include <linux/cpumask.h> #include <asm/mpspec.h> #include <asm/percpu.h> @@ -141,8 +141,18 @@ int topology_update_package_map(unsigned int apicid, unsigned int cpu); int topology_update_die_map(unsigned int dieid, unsigned int cpu); int topology_phys_to_logical_pkg(unsigned int pkg); int topology_phys_to_logical_die(unsigned int die, unsigned int cpu); -bool topology_is_primary_thread(unsigned int cpu); -#else +extern struct cpumask __cpu_primary_thread_mask; +#define cpu_primary_thread_mask ((const struct cpumask *)&__cpu_primary_thread_mask) + +/** + * topology_is_primary_thread - Check whether CPU is the primary SMT thread + * @cpu: CPU to check + */ +static inline bool topology_is_primary_thread(unsigned int cpu) +{ + return cpumask_test_cpu(cpu, cpu_primary_thread_mask); +} +#else /* CONFIG_SMP */ #define topology_max_packages() (1) static inline int topology_update_package_map(unsigned int apicid, unsigned int cpu) { return 0; } @@ -153,7 +163,7 @@ static inline int topology_phys_to_logical_die(unsigned int die, unsigned int cpu) { return 0; } static inline int topology_max_die_per_package(void) { return 1; } static inline int topology_max_smt_threads(void) { return 1; } -#endif +#endif /* !CONFIG_SMP */ static inline void arch_fix_phys_package_id(int num, u32 slot) { diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c index 4df7d694369a..b4a476016349 100644 --- a/arch/x86/kernel/apic/apic.c +++ b/arch/x86/kernel/apic/apic.c @@ -2344,20 +2344,16 @@ bool arch_match_cpu_phys_id(int cpu, u64 phys_id) } #ifdef CONFIG_SMP -/** - * apic_id_is_primary_thread - Check whether APIC ID belongs to a primary thread - * @apicid: APIC ID to check - */ -bool apic_id_is_primary_thread(unsigned int apicid) +static void cpu_mark_primary_thread(unsigned int cpu, unsigned int apicid) { - u32 mask; - - if (smp_num_siblings == 1) - return true; /* Isolate the SMT bit(s) in the APICID and check for 0 */ - mask = (1U << (fls(smp_num_siblings) - 1)) - 1; - return !(apicid & mask); + u32 mask = (1U << (fls(smp_num_siblings) - 1)) - 1; + + if (smp_num_siblings == 1 || !(apicid & mask)) + cpumask_set_cpu(cpu, &__cpu_primary_thread_mask); } +#else +static inline void cpu_mark_primary_thread(unsigned int cpu, unsigned int apicid) { } #endif /* @@ -2502,6 +2498,8 @@ int generic_processor_info(int apicid, int version) set_cpu_present(cpu, true); num_processors++; + cpu_mark_primary_thread(cpu, apicid); + return cpu; } diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c index 58f683388fc5..3dde2a6e795b 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -102,6 +102,9 @@ DEFINE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_l2c_shared_map); DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info); EXPORT_PER_CPU_SYMBOL(cpu_info); +/* CPUs which are the primary SMT threads */ +struct cpumask __cpu_primary_thread_mask __read_mostly; + struct mwait_cpu_dead { unsigned int control; unsigned int status; @@ -276,14 +279,6 @@ static void notrace start_secondary(void *unused) cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); } -/** - * topology_is_primary_thread - Check whether CPU is the primary SMT thread - * @cpu: CPU to check - */ -bool topology_is_primary_thread(unsigned int cpu) -{ - return apic_id_is_primary_thread(per_cpu(x86_cpu_to_apicid, cpu)); -} #define topology_is_primary_thread topology_is_primary_thread /** -- 2.33.0

2 2