- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] comedi: aio_iiro_16: Fix bit shift out of bounds
by Luo Gengkun 18 Aug '25

18 Aug '25

From: Ian Abbott <abbotti(a)mev.co.uk> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTB68 CVE: CVE-2025-38529 Reference: https://lore.kernel.org/all/20250724181646.291939-5-abbotti@mev.co.uk/ -------------------------------- When checking for a supported IRQ number, the following test is used: if ((1 << it->options[1]) & 0xdcfc) { However, `it->options[i]` is an unchecked `int` value from userspace, so the shift amount could be negative or out of bounds. Fix the test by requiring `it->options[1]` to be within bounds before proceeding with the original test. Valid `it->options[1]` values that select the IRQ will be in the range [1,15]. The value 0 explicitly disables the use of interrupts. Fixes: ad7a370c8be4 ("staging: comedi: aio_iiro_16: add command support for change of state detection") Cc: stable(a)vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott <abbotti(a)mev.co.uk> Link: https://lore.kernel.org/r/20250707134622.75403-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/staging/comedi/drivers/aio_iiro_16.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/comedi/drivers/aio_iiro_16.c b/drivers/staging/comedi/drivers/aio_iiro_16.c index fe3876235075..60c9c683906b 100644 --- a/drivers/staging/comedi/drivers/aio_iiro_16.c +++ b/drivers/staging/comedi/drivers/aio_iiro_16.c @@ -178,7 +178,8 @@ static int aio_iiro_16_attach(struct comedi_device *dev, * Digital input change of state interrupts are optionally supported * using IRQ 2-7, 10-12, 14, or 15. */ - if ((1 << it->options[1]) & 0xdcfc) { + if (it->options[1] > 0 && it->options[1] < 16 && + (1 << it->options[1]) & 0xdcfc) { ret = request_irq(it->options[1], aio_iiro_16_cos, 0, dev->board_name, dev); if (ret == 0) -- 2.34.1

2 1

[openeuler:OLK-6.6 2687/2687] kernel/irq/proc.c:334:13: warning: no previous prototype for function 'register_irqchip_proc'
by kernel test robot 18 Aug '25

18 Aug '25

Hi Jinjie, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dc90c923fed4944f134644261022885c12631518 commit: 3053668e6b211924bb67c19d791a5a532eca2ad8 [2687/2687] arm64: Introduce Xint software solution config: x86_64-buildonly-randconfig-2003-20250818 (https://download.01.org/0day-ci/archive/20250818/202508181343.zoaM9lG5-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250818/202508181343.zoaM9lG5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508181343.zoaM9lG5-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/irq/proc.c:334:13: warning: no previous prototype for function 'register_irqchip_proc' [-Wmissing-prototypes] 334 | void __weak register_irqchip_proc(struct irq_desc *desc, void *irqp) { } | ^ kernel/irq/proc.c:334:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 334 | void __weak register_irqchip_proc(struct irq_desc *desc, void *irqp) { } | ^ | static >> kernel/irq/proc.c:335:13: warning: no previous prototype for function 'unregister_irqchip_proc' [-Wmissing-prototypes] 335 | void __weak unregister_irqchip_proc(struct irq_desc *desc) { } | ^ kernel/irq/proc.c:335:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 335 | void __weak unregister_irqchip_proc(struct irq_desc *desc) { } | ^ | static 2 warnings generated. vim +/register_irqchip_proc +334 kernel/irq/proc.c 333 > 334 void __weak register_irqchip_proc(struct irq_desc *desc, void *irqp) { } > 335 void __weak unregister_irqchip_proc(struct irq_desc *desc) { } 336 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2687/2687] arch/x86/events/zhaoxin/uncore.c:2828:6: warning: no previous prototype for function 'kx7000_uncore_cpu_init'
by kernel test robot 18 Aug '25

18 Aug '25

Hi leoliu-oc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 57dc07b15d29507022f36882532a0fe229cf2805 commit: 25fd62f6e8c9636272009dfcbe04fb1a260cbf8d [2687/2687] perf/x86/zhaoxin/uncore: update KX-7000 support config: x86_64-buildonly-randconfig-2003-20250818 (https://download.01.org/0day-ci/archive/20250818/202508181149.ZQroekLv-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250818/202508181149.ZQroekLv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508181149.ZQroekLv-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/x86/events/zhaoxin/uncore.c:3: In file included from arch/x86/events/zhaoxin/uncore.h:3: In file included from include/linux/pci.h:1666: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2235: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ arch/x86/events/zhaoxin/uncore.c:2798:6: warning: no previous prototype for function 'kx5000_uncore_cpu_init' [-Wmissing-prototypes] 2798 | void kx5000_uncore_cpu_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2798:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2798 | void kx5000_uncore_cpu_init(void) | ^ | static arch/x86/events/zhaoxin/uncore.c:2807:6: warning: no previous prototype for function 'kh40000_uncore_cpu_init' [-Wmissing-prototypes] 2807 | void kh40000_uncore_cpu_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2807:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2807 | void kh40000_uncore_cpu_init(void) | ^ | static arch/x86/events/zhaoxin/uncore.c:2812:5: warning: no previous prototype for function 'kh40000_uncore_pci_init' [-Wmissing-prototypes] 2812 | int kh40000_uncore_pci_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2812:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2812 | int kh40000_uncore_pci_init(void) | ^ | static >> arch/x86/events/zhaoxin/uncore.c:2828:6: warning: no previous prototype for function 'kx7000_uncore_cpu_init' [-Wmissing-prototypes] 2828 | void kx7000_uncore_cpu_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2828:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2828 | void kx7000_uncore_cpu_init(void) | ^ | static >> arch/x86/events/zhaoxin/uncore.c:2843:5: warning: no previous prototype for function 'kx7000_uncore_pci_init' [-Wmissing-prototypes] 2843 | int kx7000_uncore_pci_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2843:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2843 | int kx7000_uncore_pci_init(void) | ^ | static >> arch/x86/events/zhaoxin/uncore.c:2851:6: warning: no previous prototype for function 'kx7000_uncore_mmio_init' [-Wmissing-prototypes] 2851 | void kx7000_uncore_mmio_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2851:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2851 | void kx7000_uncore_mmio_init(void) | ^ | static 7 warnings generated. vim +/kx7000_uncore_cpu_init +2828 arch/x86/events/zhaoxin/uncore.c 2827 > 2828 void kx7000_uncore_cpu_init(void) 2829 { 2830 u64 val; 2831 int cpu; 2832 2833 uncore_msr_uncores = kx7000_msr_uncores; 2834 2835 /* clear bit 16 of MSR 0x1877 so that HIF can work normally */ 2836 for_each_present_cpu(cpu) { 2837 rdmsrl_on_cpu(cpu, 0x1877, &val); 2838 val = val & 0xfffffffffffeffffULL; 2839 wrmsrl_on_cpu(cpu, 0x1877, val); 2840 } 2841 } 2842 > 2843 int kx7000_uncore_pci_init(void) 2844 { 2845 uncore_pci_uncores = kx7000_pci_uncores; 2846 uncore_pci_driver = &kx7000_uncore_pci_driver; 2847 2848 return 0; 2849 } 2850 > 2851 void kx7000_uncore_mmio_init(void) 2852 { 2853 uncore_mmio_uncores = kx7000_mmio_uncores; 2854 } 2855 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2687/2687] kernel/power/swap.c:1573: warning: Excess function parameter 'exclusive' description in 'swsusp_close'
by kernel test robot 18 Aug '25

18 Aug '25

Hi Jan, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 57dc07b15d29507022f36882532a0fe229cf2805 commit: 35143f27ceecf215984b938d1fe192e0e66e41b2 [2687/2687] PM: hibernate: Drop unused snapshot_test argument config: x86_64-buildonly-randconfig-2004-20250818 (https://download.01.org/0day-ci/archive/20250818/202508181142.iwn6mk8e-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250818/202508181142.iwn6mk8e-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508181142.iwn6mk8e-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/power/swap.c:544: warning: Function parameter or member 'handle' not described in 'save_image' kernel/power/swap.c:544: warning: Function parameter or member 'snapshot' not described in 'save_image' kernel/power/swap.c:544: warning: Function parameter or member 'nr_to_write' not described in 'save_image' kernel/power/swap.c:891: warning: Function parameter or member 'nr_pages' not described in 'enough_swap' kernel/power/swap.c:1062: warning: Function parameter or member 'handle' not described in 'load_image' kernel/power/swap.c:1062: warning: Function parameter or member 'snapshot' not described in 'load_image' kernel/power/swap.c:1062: warning: Function parameter or member 'nr_to_read' not described in 'load_image' >> kernel/power/swap.c:1573: warning: Excess function parameter 'exclusive' description in 'swsusp_close' vim +1573 kernel/power/swap.c 61159a314bca640 Rafael J. Wysocki 2006-03-23 1566 61159a314bca640 Rafael J. Wysocki 2006-03-23 1567 /** 61159a314bca640 Rafael J. Wysocki 2006-03-23 1568 * swsusp_close - close swap device. 40d84e198b0ae64 Chen Yu 2023-09-06 1569 * @exclusive: Close the resume device which is exclusively opened. 61159a314bca640 Rafael J. Wysocki 2006-03-23 1570 */ 61159a314bca640 Rafael J. Wysocki 2006-03-23 1571 35143f27ceecf21 Jan Kara 2023-11-30 1572 void swsusp_close(void) 61159a314bca640 Rafael J. Wysocki 2006-03-23 @1573 { 7f17d15e3e01aca Jan Kara 2023-11-30 1574 if (IS_ERR(hib_resume_bdev_handle)) { 64ec72a1ece37d9 Joe Perches 2017-09-27 1575 pr_debug("Image device not initialised\n"); 61159a314bca640 Rafael J. Wysocki 2006-03-23 1576 return; 61159a314bca640 Rafael J. Wysocki 2006-03-23 1577 } 61159a314bca640 Rafael J. Wysocki 2006-03-23 1578 7f17d15e3e01aca Jan Kara 2023-11-30 1579 bdev_release(hib_resume_bdev_handle); 61159a314bca640 Rafael J. Wysocki 2006-03-23 1580 } 1b29c1643c0d825 Vivek Goyal 2007-05-02 1581 :::::: The code at line 1573 was first introduced by commit :::::: 61159a314bca6408320c3173c1282c64f5cdaa76 [PATCH] swsusp: separate swap-writing/reading code :::::: TO: Rafael J. Wysocki <rjw(a)sisk.pl> :::::: CC: Linus Torvalds <torvalds(a)g5.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] hugelb: do not sleep during spinlock hugetlb_lock
by Wupeng Ma 18 Aug '25

18 Aug '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICLL1L -------------------------------- Commit 539370f5231b ("hugetlb: drain pcp for movable zone before alloc") try to drain pcp memory during hugepage allocation, however flush_work called by __drain_all_pages may sleep during draining. Fix this by moving this before alloc_pool_huge_page which hugetlb_lock is already unlocked before page allocation. Fixes: 539370f5231b ("hugetlb: drain pcp for movable zone before alloc") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/hugetlb.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 5307e9c2b0538..1369aeab88858 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3035,6 +3035,7 @@ static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, struct page *page; LIST_HEAD(page_list); NODEMASK_ALLOC(nodemask_t, node_alloc_noretry, GFP_KERNEL); + bool drained = false; /* * Bit mask controlling how hard we retry per-node allocations. @@ -3109,14 +3110,6 @@ static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, break; } - /* - * drain pcp for movable zone to increase the success rate for - * hugetlb memory allocation if movable_node enabled - */ - if ((nid != NUMA_NO_NODE) && movable_node_is_enabled() && - count > persistent_huge_pages(h)) - hugetlb_drain_movable_pcp(h, nid); - while (count > persistent_huge_pages(h)) { /* * If this allocation races such that we no longer need the @@ -3128,6 +3121,16 @@ static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, /* yield cpu to avoid soft lockup */ cond_resched(); + /* + * drain pcp for movable zone to increase the success rate + * for hugetlb memory allocation if movable_node enabled + */ + if (!drained && (nid != NUMA_NO_NODE) && + movable_node_is_enabled()) { + hugetlb_drain_movable_pcp(h, nid); + drained = true; + } + ret = alloc_pool_huge_page(h, nodes_allowed, node_alloc_noretry); spin_lock_irq(&hugetlb_lock); -- 2.43.0

2 1

[PATCH OLK-6.6 0/5]Enhance soft hwpoison handling and injection
by Tong Tiangen 18 Aug '25

18 Aug '25

This series aim at the following enhancement - - Let one hwpoison injector, that is, madvise(MADV_HWPOISON) to behave more like as if a real UE occurred. Because the other two injectors such as hwpoison-inject and the 'einj' on x86 can't, and it seems to me we need a better simulation to real UE scenario. - For years, if the kernel is unable to unmap a hwpoisoned page, it send a SIGKILL instead of SIGBUS to prevent user process from potentially accessing the page again. But in doing so, the user process also lose important information: vaddr, for recovery. Fortunately, the kernel already has code to kill process re-accessing a hwpoisoned page, so remove the '!unmap_success' check. - Right now, if a thp page under GUP longterm pin is hwpoisoned, and kernel cannot split the thp page, memory-failure simply ignores the UE and returns. That's not ideal, it could deliver a SIGBUS with useful information for userspace recovery. Jane Chu (5): mm/memory-failure: try to send SIGBUS even if unmap failed mm/madvise: add MF_ACTION_REQUIRED to madvise(MADV_HWPOISON) mm/memory-failure: improve memory failure action_result messages mm/memory-failure: move hwpoison_filter() higher up mm/memory-failure: send SIGBUS in the event of thp split fail include/linux/mm.h | 2 + include/ras/ras_event.h | 2 + mm/madvise.c | 2 +- mm/memory-failure.c | 105 +++++++++++++++++++++++++++++----------- 4 files changed, 81 insertions(+), 30 deletions(-) -- 2.25.1

2 6

[openeuler:OLK-6.6 2687/2687] arch/x86/events/zhaoxin/uncore.c:2761:6: warning: no previous prototype for function 'kx5000_uncore_cpu_init'
by kernel test robot 18 Aug '25

18 Aug '25

Hi leoliu-oc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 08d6c0b8f95e9c676bd9bc28b12d198df722218e commit: dc5b97374ba722156acbdfc4e3adbc69e2dbe7f4 [2687/2687] perf/x86/zhaoxin/uncore: Add KX-7000 support config: x86_64-buildonly-randconfig-2003-20250818 (https://download.01.org/0day-ci/archive/20250818/202508180932.bKWZIbb7-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250818/202508180932.bKWZIbb7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508180932.bKWZIbb7-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/x86/events/zhaoxin/uncore.c:3: In file included from arch/x86/events/zhaoxin/uncore.h:3: In file included from include/linux/pci.h:1663: In file included from include/linux/dmapool.h:14: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> arch/x86/events/zhaoxin/uncore.c:2761:6: warning: no previous prototype for function 'kx5000_uncore_cpu_init' [-Wmissing-prototypes] 2761 | void kx5000_uncore_cpu_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2761:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2761 | void kx5000_uncore_cpu_init(void) | ^ | static >> arch/x86/events/zhaoxin/uncore.c:2770:6: warning: no previous prototype for function 'kh40000_uncore_cpu_init' [-Wmissing-prototypes] 2770 | void kh40000_uncore_cpu_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2770:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2770 | void kh40000_uncore_cpu_init(void) | ^ | static >> arch/x86/events/zhaoxin/uncore.c:2775:5: warning: no previous prototype for function 'kh40000_uncore_pci_init' [-Wmissing-prototypes] 2775 | int kh40000_uncore_pci_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2775 | int kh40000_uncore_pci_init(void) | ^ | static arch/x86/events/zhaoxin/uncore.c:2791:6: warning: no previous prototype for function 'kx8000_uncore_cpu_init' [-Wmissing-prototypes] 2791 | void kx8000_uncore_cpu_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2791:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2791 | void kx8000_uncore_cpu_init(void) | ^ | static arch/x86/events/zhaoxin/uncore.c:2796:5: warning: no previous prototype for function 'kx8000_uncore_pci_init' [-Wmissing-prototypes] 2796 | int kx8000_uncore_pci_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2796:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2796 | int kx8000_uncore_pci_init(void) | ^ | static arch/x86/events/zhaoxin/uncore.c:2804:6: warning: no previous prototype for function 'kx8000_uncore_mmio_init' [-Wmissing-prototypes] 2804 | void kx8000_uncore_mmio_init(void) | ^ arch/x86/events/zhaoxin/uncore.c:2804:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2804 | void kx8000_uncore_mmio_init(void) | ^ | static 7 warnings generated. vim +/kx5000_uncore_cpu_init +2761 arch/x86/events/zhaoxin/uncore.c 2760 > 2761 void kx5000_uncore_cpu_init(void) 2762 { 2763 uncore_msr_uncores = kx5000_msr_uncores; 2764 } 2765 2766 static const struct zhaoxin_uncore_init_fun kx5000_uncore_init __initconst = { 2767 .cpu_init = kx5000_uncore_cpu_init, 2768 }; 2769 > 2770 void kh40000_uncore_cpu_init(void) 2771 { 2772 uncore_msr_uncores = kh40000_msr_uncores; 2773 } 2774 > 2775 int kh40000_uncore_pci_init(void) 2776 { 2777 int ret = kh40000_pci2node_map_init();/*pci_bus to package mapping, do nothing*/ 2778 2779 if (ret) 2780 return ret; 2781 uncore_pci_uncores = kh40000_pci_uncores; 2782 uncore_pci_driver = &kh40000_uncore_pci_driver; 2783 return 0; 2784 } 2785 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2687/2687] mm/madvise.c:297:6: warning: no previous prototype for function 'force_swapin_vma'
by kernel test robot 18 Aug '25

18 Aug '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 08d6c0b8f95e9c676bd9bc28b12d198df722218e commit: 92a0eb9bde6c03412b39f9f3d20968c091ea3b46 [2687/2687] memcg: introduce per-memcg swapin interface config: x86_64-buildonly-randconfig-2003-20250818 (https://download.01.org/0day-ci/archive/20250818/202508180823.hOEzzv8k-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250818/202508180823.hOEzzv8k-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508180823.hOEzzv8k-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/madvise.c:9: In file included from include/linux/mman.h:5: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/madvise.c:21: include/linux/mm_inline.h:46:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 46 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:48:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 48 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ >> mm/madvise.c:297:6: warning: no previous prototype for function 'force_swapin_vma' [-Wmissing-prototypes] 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^ mm/madvise.c:297:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^ | static 4 warnings generated. vim +/force_swapin_vma +297 mm/madvise.c 280 281 #ifdef CONFIG_MEMCG_SWAP_QOS 282 void force_swapin_vma(struct vm_area_struct *vma) 283 { 284 struct file *file = vma->vm_file; 285 286 if (!can_madv_lru_vma(vma)) 287 return; 288 289 if (!file) { 290 walk_page_vma(vma, &swapin_walk_ops, vma); 291 lru_add_drain(); 292 } else if (shmem_mapping(file->f_mapping)) 293 shmem_swapin_range(vma, vma->vm_start, 294 vma->vm_end, file->f_mapping); 295 } 296 #else > 297 void force_swapin_vma(struct vm_area_struct *vma) 298 { 299 } 300 #endif 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf: Reject %p% format string in bprintf-like helpers
by Pu Lehui 18 Aug '25

18 Aug '25

From: Paul Chaignon <paul.chaignon(a)gmail.com> stable inclusion from stable-v6.6.100 commit e7be679124bae8cf4fa6e40d7e1661baddfb3289 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTB66 CVE: CVE-2025-38528 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8242745871f81a3ac37f9f51853d12854fd0b58 ] static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected. Reported-by: syzbot+e2c932aec5c8a6e1d31c(a)syzkaller.appspotmail.com Fixes: 48cac3f4a96d ("bpf: Implement formatted output helpers with bstr_printf") Acked-by: Yonghong Song <yonghong.song(a)linux.dev> Signed-off-by: Paul Chaignon <paul.chaignon(a)gmail.com> Link: https://lore.kernel.org/r/a0e06cc479faec9e802ae51ba5d66420523251ee.17513954… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/helpers.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 780905e24016..41f049ecb5c8 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -885,6 +885,13 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, if (fmt[i] == 'p') { sizeof_cur_arg = sizeof(long); + if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) || + ispunct(fmt[i + 1])) { + if (tmp_buf) + cur_arg = raw_args[num_spec]; + goto nocopy_fmt; + } + if ((fmt[i + 1] == 'k' || fmt[i + 1] == 'u') && fmt[i + 2] == 's') { fmt_ptype = fmt[i + 1]; @@ -892,11 +899,9 @@ int bpf_bprintf_prepare(char *fmt, u32 fmt_size, const u64 *raw_args, goto fmt_str; } - if (fmt[i + 1] == 0 || isspace(fmt[i + 1]) || - ispunct(fmt[i + 1]) || fmt[i + 1] == 'K' || + if (fmt[i + 1] == 'K' || fmt[i + 1] == 'x' || fmt[i + 1] == 's' || fmt[i + 1] == 'S') { - /* just kernel pointers */ if (tmp_buf) cur_arg = raw_args[num_spec]; i++; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] sched: Fix sched tunable parameter range overflow
by Cheng Yu 17 Aug '25

17 Aug '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICSER4 -------------------------------- When recalculating scheduler tunables during CPU hotplug(online/offline), we failed to check and constrain the tunnable parameters within their valid ranges. After repeated operations, this could cause parameters to overflow beyond limits. In extreme cases, sysctl_sched_min_granularity could become 0, which disrupts normal scheduler operation and leads to unexpected behavior. Furthermore, setting sysctl_sched_tunable_scaling when this condition exists triggers a division-by-zero error, resulting in a system crash. Fix this by adding proper range checks and constraints during the tunable recalculation process during CPU hotplug events. Fixes: 0bcdcf28c979 ("sched: Fix missing sched tunable recalculation on cpu add/remove") Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- include/linux/sched/sysctl.h | 5 +++++ kernel/sched/fair.c | 14 +++++++++----- kernel/sysctl.c | 15 +++++++-------- 3 files changed, 21 insertions(+), 13 deletions(-) diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h index ad472760e97d..8a428c10be46 100644 --- a/include/linux/sched/sysctl.h +++ b/include/linux/sched/sysctl.h @@ -32,6 +32,11 @@ extern unsigned int sysctl_sched_min_granularity; extern unsigned int sysctl_sched_wakeup_granularity; extern unsigned int sysctl_sched_child_runs_first; +extern unsigned int min_sched_granularity_ns; +extern unsigned int max_sched_granularity_ns; +extern unsigned int min_wakeup_granularity_ns; +extern unsigned int max_wakeup_granularity_ns; + #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY extern int sysctl_sched_util_low_pct; #endif diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 4a357dce540c..87f905bfcf3e 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -193,11 +193,15 @@ static void update_sysctl(void) { unsigned int factor = get_update_sysctl_factor(); -#define SET_SYSCTL(name) \ - (sysctl_##name = (factor) * normalized_sysctl_##name) - SET_SYSCTL(sched_min_granularity); - SET_SYSCTL(sched_latency); - SET_SYSCTL(sched_wakeup_granularity); +#define SET_SYSCTL(name, min_val, max_val) \ + (sysctl_##name = clamp((factor) * normalized_sysctl_##name, \ + min_val, max_val)) + SET_SYSCTL(sched_min_granularity, + min_sched_granularity_ns, max_sched_granularity_ns); + SET_SYSCTL(sched_latency, + min_sched_granularity_ns, max_sched_granularity_ns); + SET_SYSCTL(sched_wakeup_granularity, + min_wakeup_granularity_ns, max_wakeup_granularity_ns); #undef SET_SYSCTL } diff --git a/kernel/sysctl.c b/kernel/sysctl.c index f64c4495bc54..0d1f07dc7b44 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -329,16 +329,15 @@ static struct ctl_table sysctl_base_table[] = { { } }; -#ifdef CONFIG_SCHED_DEBUG -static int min_sched_granularity_ns = 100000; /* 100 usecs */ -static int max_sched_granularity_ns = NSEC_PER_SEC; /* 1 second */ -static int min_wakeup_granularity_ns; /* 0 usecs */ -static int max_wakeup_granularity_ns = NSEC_PER_SEC; /* 1 second */ -#ifdef CONFIG_SMP +unsigned int min_sched_granularity_ns = 100000; /* 100 usecs */ +unsigned int max_sched_granularity_ns = NSEC_PER_SEC; /* 1 second */ +unsigned int min_wakeup_granularity_ns; /* 0 usecs */ +unsigned int max_wakeup_granularity_ns = NSEC_PER_SEC; /* 1 second */ + +#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SMP) static int min_sched_tunable_scaling = SCHED_TUNABLESCALING_NONE; static int max_sched_tunable_scaling = SCHED_TUNABLESCALING_END-1; -#endif /* CONFIG_SMP */ -#endif /* CONFIG_SCHED_DEBUG */ +#endif #ifdef CONFIG_COMPACTION static int min_extfrag_threshold; -- 2.25.1

2 1