- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3485/3485] lib/../mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 5d638f251ef64f68766caaeaf41fbe159807b392 [3485/3485] mm: shrinker: add infrastructure for dynamically allocating shrinker config: arm64-randconfig-004-20251208 (https://download.01.org/0day-ci/archive/20251209/202512090019.r12ZqVrM-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 000e46219ba1ee53fc42d35e00c314c2807e8b14) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090019.r12ZqVrM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090019.r12ZqVrM-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from lib/vsprintf.c:50: >> lib/../mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ lib/../mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ 1 warning generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] vim +1522 lib/../mm/internal.h 1513 1514 /* shrinker related functions */ 1515 unsigned long shrink_slab(gfp_t gfp_mask, int nid, struct mem_cgroup *memcg, 1516 int priority); 1517 1518 #ifdef CONFIG_SHRINKER_DEBUG 1519 static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, 1520 const char *fmt, va_list ap) 1521 { > 1522 shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); 1523 1524 return shrinker->name ? 0 : -ENOMEM; 1525 } 1526 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/gmem.c:383:13: warning: unused variable 'nid'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 18b5064b5892580f89d7eca015f884ce10190bac [3493/3493] gmem: hmemcpy should use dma for phy addr config: x86_64-randconfig-161-20251208 (https://download.01.org/0day-ci/archive/20251209/202512090002.kbElJ2I7-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090002.kbElJ2I7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090002.kbElJ2I7-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/gmem.c: In function 'gm_as_attach': >> mm/gmem.c:383:13: warning: unused variable 'nid' [-Wunused-variable] 383 | int nid; | ^~~ vim +/nid +383 mm/gmem.c 380709c322aaa3 Cunshu Ni 2025-11-01 378 380709c322aaa3 Cunshu Ni 2025-11-01 379 int gm_as_attach(struct gm_as *as, struct gm_dev *dev, 380709c322aaa3 Cunshu Ni 2025-11-01 380 bool activate, struct gm_context **out_ctx) 380709c322aaa3 Cunshu Ni 2025-11-01 381 { 380709c322aaa3 Cunshu Ni 2025-11-01 382 struct gm_context *ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 @383 int nid; 380709c322aaa3 Cunshu Ni 2025-11-01 384 380709c322aaa3 Cunshu Ni 2025-11-01 385 ctx = kmem_cache_alloc(gm_ctx_cache, GFP_KERNEL); 380709c322aaa3 Cunshu Ni 2025-11-01 386 if (!ctx) 380709c322aaa3 Cunshu Ni 2025-11-01 387 return -ENOMEM; 380709c322aaa3 Cunshu Ni 2025-11-01 388 380709c322aaa3 Cunshu Ni 2025-11-01 389 ctx->as = as; 380709c322aaa3 Cunshu Ni 2025-11-01 390 ctx->dev = dev; 380709c322aaa3 Cunshu Ni 2025-11-01 391 380709c322aaa3 Cunshu Ni 2025-11-01 392 INIT_LIST_HEAD(&ctx->gm_dev_link); 380709c322aaa3 Cunshu Ni 2025-11-01 393 INIT_LIST_HEAD(&ctx->gm_as_link); 380709c322aaa3 Cunshu Ni 2025-11-01 394 380709c322aaa3 Cunshu Ni 2025-11-01 395 if (!list_empty(&as->gm_ctx_list)) { 380709c322aaa3 Cunshu Ni 2025-11-01 396 struct list_head *old_node; 380709c322aaa3 Cunshu Ni 2025-11-01 397 struct gm_context *old_ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 398 380709c322aaa3 Cunshu Ni 2025-11-01 399 old_node = as->gm_ctx_list.prev; 380709c322aaa3 Cunshu Ni 2025-11-01 400 list_del_init(old_node); 380709c322aaa3 Cunshu Ni 2025-11-01 401 old_ctx = list_entry(old_node, struct gm_context, gm_as_link); 380709c322aaa3 Cunshu Ni 2025-11-01 402 kfree(old_ctx); 380709c322aaa3 Cunshu Ni 2025-11-01 403 } 380709c322aaa3 Cunshu Ni 2025-11-01 404 380709c322aaa3 Cunshu Ni 2025-11-01 405 list_add_tail(&dev->gm_ctx_list, &ctx->gm_dev_link); 380709c322aaa3 Cunshu Ni 2025-11-01 406 list_add_tail(&ctx->gm_as_link, &as->gm_ctx_list); 380709c322aaa3 Cunshu Ni 2025-11-01 407 380709c322aaa3 Cunshu Ni 2025-11-01 408 if (activate) { 380709c322aaa3 Cunshu Ni 2025-11-01 409 /* 380709c322aaa3 Cunshu Ni 2025-11-01 410 * Here we should really have a callback function to perform the context switch 380709c322aaa3 Cunshu Ni 2025-11-01 411 * for the hardware. E.g. in x86 this function is effectively 380709c322aaa3 Cunshu Ni 2025-11-01 412 * flushing the CR3 value. Currently we do not care time-sliced context switch, 380709c322aaa3 Cunshu Ni 2025-11-01 413 * unless someone wants to support it. 380709c322aaa3 Cunshu Ni 2025-11-01 414 */ 380709c322aaa3 Cunshu Ni 2025-11-01 415 dev->current_ctx = ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 416 } 380709c322aaa3 Cunshu Ni 2025-11-01 417 *out_ctx = ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 418 380709c322aaa3 Cunshu Ni 2025-11-01 419 /* 380709c322aaa3 Cunshu Ni 2025-11-01 420 * gm_as_attach will be used to attach device to process address space. 380709c322aaa3 Cunshu Ni 2025-11-01 421 * Handle this case and add hnodes registered by device to process mems_allowed. 380709c322aaa3 Cunshu Ni 2025-11-01 422 */ 18b5064b589258 Ni Cunshu 2025-12-08 423 #ifdef CONFIG_CPUSETS 380709c322aaa3 Cunshu Ni 2025-11-01 424 for_each_node_mask(nid, dev->registered_hnodes) 380709c322aaa3 Cunshu Ni 2025-11-01 425 node_set(nid, current->mems_allowed); 18b5064b589258 Ni Cunshu 2025-12-08 426 #endif 380709c322aaa3 Cunshu Ni 2025-11-01 427 return 0; 380709c322aaa3 Cunshu Ni 2025-11-01 428 } 380709c322aaa3 Cunshu Ni 2025-11-01 429 EXPORT_SYMBOL_GPL(gm_as_attach); 2ce9e864fa288b Cunshu Ni 2025-11-02 430 :::::: The code at line 383 was first introduced by commit :::::: 380709c322aaa306b5ac3c278a0700043f7d33e2 gmem: prepare config, boot parameter, vma flag and basic GMEM related structs :::::: TO: Cunshu Ni <nicunshu(a)huawei.com> :::::: CC: zhangjian <zhangjian496(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] include/linux/string.h:290:33: warning: '__builtin_strncpy' specified bound depends on the length of the source argument
by kernel test robot 08 Dec '25

08 Dec '25

Hi Weili, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: a1666f44c2250f7413e73e2f4c02cb2c01f9e3b0 [3386/3386] crypto: hisilicon/qm - support no-sva feature config: arm64-randconfig-r054-20251208 (https://download.01.org/0day-ci/archive/20251208/202512082302.Kf4xjvAw-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082302.Kf4xjvAw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082302.Kf4xjvAw-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/bitmap.h:9, from include/linux/cpumask.h:12, from include/linux/smp.h:13, from include/linux/lockdep.h:14, from include/linux/mutex.h:17, from include/linux/kernfs.h:13, from include/linux/sysfs.h:17, from include/linux/kobject.h:21, from include/linux/of.h:17, from include/linux/irqdomain.h:35, from include/linux/acpi.h:13, from drivers/crypto/hisilicon/qm.c:4: In function 'strncpy', inlined from 'qm_alloc_uacce' at drivers/crypto/hisilicon/qm.c:2755:2: >> include/linux/string.h:290:33: warning: '__builtin_strncpy' specified bound depends on the length of the source argument [-Wstringop-truncation] 290 | #define __underlying_strncpy __builtin_strncpy | ^ include/linux/string.h:300:16: note: in expansion of macro '__underlying_strncpy' 300 | return __underlying_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~ In function 'strlen', inlined from 'qm_alloc_uacce' at drivers/crypto/hisilicon/qm.c:2748:13: include/linux/string.h:288:33: note: length computed here 288 | #define __underlying_strlen __builtin_strlen | ^ include/linux/string.h:321:24: note: in expansion of macro '__underlying_strlen' 321 | return __underlying_strlen(p); | ^~~~~~~~~~~~~~~~~~~ vim +/__builtin_strncpy +290 include/linux/string.h 47227d27e2fcb0 Daniel Axtens 2020-06-03 268 47227d27e2fcb0 Daniel Axtens 2020-06-03 269 #ifdef CONFIG_KASAN 47227d27e2fcb0 Daniel Axtens 2020-06-03 270 extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr); 47227d27e2fcb0 Daniel Axtens 2020-06-03 271 extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp); 47227d27e2fcb0 Daniel Axtens 2020-06-03 272 extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 273 extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove); 47227d27e2fcb0 Daniel Axtens 2020-06-03 274 extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset); 47227d27e2fcb0 Daniel Axtens 2020-06-03 275 extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat); 47227d27e2fcb0 Daniel Axtens 2020-06-03 276 extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 277 extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen); 47227d27e2fcb0 Daniel Axtens 2020-06-03 278 extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat); 47227d27e2fcb0 Daniel Axtens 2020-06-03 279 extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 280 #else 47227d27e2fcb0 Daniel Axtens 2020-06-03 281 #define __underlying_memchr __builtin_memchr 47227d27e2fcb0 Daniel Axtens 2020-06-03 282 #define __underlying_memcmp __builtin_memcmp 47227d27e2fcb0 Daniel Axtens 2020-06-03 283 #define __underlying_memcpy __builtin_memcpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 284 #define __underlying_memmove __builtin_memmove 47227d27e2fcb0 Daniel Axtens 2020-06-03 285 #define __underlying_memset __builtin_memset 47227d27e2fcb0 Daniel Axtens 2020-06-03 286 #define __underlying_strcat __builtin_strcat 47227d27e2fcb0 Daniel Axtens 2020-06-03 287 #define __underlying_strcpy __builtin_strcpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 288 #define __underlying_strlen __builtin_strlen 47227d27e2fcb0 Daniel Axtens 2020-06-03 289 #define __underlying_strncat __builtin_strncat 47227d27e2fcb0 Daniel Axtens 2020-06-03 @290 #define __underlying_strncpy __builtin_strncpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 291 #endif 47227d27e2fcb0 Daniel Axtens 2020-06-03 292 :::::: The code at line 290 was first introduced by commit :::::: 47227d27e2fcb01a9e8f5958d8997cf47a820afc string.h: fix incompatibility between FORTIFY_SOURCE and KASAN :::::: TO: Daniel Axtens <dja(a)axtens.net> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 08 Dec '25

08 Dec '25

Zicheng Qu (8): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free include/linux/xsched.h | 27 ++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 7 ++ kernel/xsched/cgroup.c | 219 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 18 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 185 insertions(+), 129 deletions(-) -- 2.34.1

2 9

[PATCH OLK-6.6 0/1] Fix UAF issue for mfs
by Hongbo Li 08 Dec '25

08 Dec '25

Fix one UAF issue for mfs. Hongbo Li (1): mfs: Fix UAF problem on event object when enable tracepoint fs/mfs/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] zcopy: Fix NULL pointer dereference while attach conflict with free
by Liu Mingrui 08 Dec '25

08 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBKGM -------------------------------- Add mm_read_lock to avoid conflict between attach and free. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000020300acd7000 [0000000000000000] pgd=0800203008421403, p4d=0800203008421403, pud=0800203008422403, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP CPU: 107 PID: 151805 Comm: ioctl_zcopy_too Kdump: loaded Not tainted 6.6.0-f3180605d2a8 #1 Hardware name: Huawei Taishan 2280 V2/BC82AMDD, BIOS 6.57 05/17/2023 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : attach_pte_range+0x190/0x9a0 [zcopy] lr : attach_pte_range+0xd4/0x9a0 [zcopy] sp : ffff8000be8abb20 x29: ffff8000be8abb80 x28: 0000ffff90e00000 x27: ffffa651cb444d08 x26: 0400000000000001 x25: 0000000000000000 x24: ffff203017961000 x23: 0000ffff87400000 x22: 0010000000000001 x21: fffffc80c05e5840 x20: ffff2020259111d0 x19: ffffa651cb443c40 x18: ffff8000be8ab9b0 x17: 0000000000000000 x16: ffffa651e40182b0 x15: ffffffffffffffbc x14: ffffa651e8b17c58 x13: ffff20301695a000 x12: ffffa651cb444a58 x11: 0000000000000154 x10: 0000ffff91000000 x9 : ffffa651cb43e574 x8 : 0000000000000000 x7 : ffff20300758a880 x6 : 0000000000200000 x5 : ffff203008b1b438 x4 : 0000000000000001 x3 : 00000000000001da x2 : fffffc0000000000 x1 : 0000000000000000 x0 : 00000000000001da Call trace: attach_pte_range+0x190/0x9a0 [zcopy] attach_page_range+0x22c/0x618 [zcopy] attach_pages+0x2b8/0x8b8 [zcopy] zcopy_ioctl+0xe8/0x168 [zcopy] vfs_ioctl+0x3c/0xa8 __se_sys_ioctl+0x12c/0x160 __arm64_sys_ioctl+0x40/0x68 invoke_syscall+0x8c/0x1d0 el0_svc_common.constprop.0+0x64/0x1d0 do_el0_svc+0x54/0xe0 el0_slow_syscall+0x44/0x1e8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x188/0x190 Fixes: 8d543a8e74d5 ("zcopy: Introduce the pageattach interface") Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/misc/zcopy/zcopy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/misc/zcopy/zcopy.c b/drivers/misc/zcopy/zcopy.c index f4c56ce07e66..48c0702b96e5 100644 --- a/drivers/misc/zcopy/zcopy.c +++ b/drivers/misc/zcopy/zcopy.c @@ -709,7 +709,9 @@ static int attach_pages(unsigned long dst_addr, unsigned long src_addr, } trace_attach_page_range_start(dst_mm, src_mm, dst_addr, src_addr, size); + mmap_read_lock(src_mm); ret = attach_page_range(dst_mm, src_mm, dst_addr, src_addr, size); + mmap_read_unlock(src_mm); trace_attach_page_range_end(dst_mm, src_mm, dst_addr, src_addr, ret); unpin_user_pages_dirty_lock(process_pages, pinned_pages, 0); -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] Fix invalid paging request while attach transhugepage to same addr
by Liu Mingrui 08 Dec '25

08 Dec '25

zcopy: Fix invalid paging request while attach transhugepage to same addr Liu Mingrui (1): zcopy: Fix invalid paging request while attach transhugepage to same addr drivers/misc/zcopy/zcopy.c | 96 ++++++++++++++------------------------ 1 file changed, 34 insertions(+), 62 deletions(-) -- 2.25.1

2 2

[PATCH OLK-6.6] KVM: arm64: Check the untrusted offset in FF-A memory share
by Luo Gengkun 08 Dec '25

08 Dec '25

From: Sebastian Ene <sebastianene(a)google.com> stable inclusion from stable-v6.6.118 commit fc3139d9f4c1fe1c7d5f25f99676bd8e9c6a1041 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDATPN CVE: CVE-2025-40266 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 103e17aac09cdd358133f9e00998b75d6c1f1518 upstream. Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel. Signed-off-by: Sebastian Ene <sebastianene(a)google.com> Acked-by: Will Deacon <will(a)kernel.org> Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com Signed-off-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c index 8d21ab904f1a..eacf4ba1d88e 100644 --- a/arch/arm64/kvm/hyp/nvhe/ffa.c +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c @@ -425,7 +425,7 @@ static void __do_ffa_mem_xfer(const u64 func_id, DECLARE_REG(u32, npages_mbz, ctxt, 4); struct ffa_composite_mem_region *reg; struct ffa_mem_region *buf; - u32 offset, nr_ranges; + u32 offset, nr_ranges, checked_offset; int ret = 0; if (addr_mbz || npages_mbz || fraglen > len || @@ -460,7 +460,12 @@ static void __do_ffa_mem_xfer(const u64 func_id, goto out_unlock; } - if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) { + if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) { + ret = FFA_RET_INVALID_PARAMETERS; + goto out_unlock; + } + + if (fraglen < checked_offset) { ret = FFA_RET_INVALID_PARAMETERS; goto out_unlock; } -- 2.34.1

2 1

[PATCH OLK-6.6] NFSD: free copynotify stateid in nfs4_free_ol_stateid()
by Li Lingfeng 08 Dec '25

08 Dec '25

From: Olga Kornievskaia <okorniev(a)redhat.com> stable inclusion from stable-v6.6.117 commit 29fbb3ad4018ca2b0988fbac76f4c694cc6d7e66 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6RK CVE: CVE-2025-40273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream. Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs Reported-by: rtm(a)csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@orac… Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable(a)vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index a813c1123b37..e7c3997a9f5e 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1496,7 +1496,8 @@ static void nfs4_free_ol_stateid(struct nfs4_stid *stid) release_all_access(stp); if (stp->st_stateowner) nfs4_put_stateowner(stp->st_stateowner); - WARN_ON(!list_empty(&stid->sc_cp_list)); + if (!list_empty(&stid->sc_cp_list)) + nfs4_free_cpntf_statelist(stid->sc_client->net, stid); kmem_cache_free(stateid_slab, stid); } -- 2.46.1

2 1

[PATCH OLK-5.10] NFSD: free copynotify stateid in nfs4_free_ol_stateid()
by Li Lingfeng 08 Dec '25

08 Dec '25

From: Olga Kornievskaia <okorniev(a)redhat.com> stable inclusion from stable-v5.10.247 commit 935a2dc8928670bb2c37e21025331e61ec48ccf4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6RK CVE: CVE-2025-40273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream. Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs Reported-by: rtm(a)csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@orac… Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable(a)vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 6c0c5de24cf4..302bbad5cdc6 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1370,7 +1370,8 @@ static void nfs4_free_ol_stateid(struct nfs4_stid *stid) release_all_access(stp); if (stp->st_stateowner) nfs4_put_stateowner(stp->st_stateowner); - WARN_ON(!list_empty(&stid->sc_cp_list)); + if (!list_empty(&stid->sc_cp_list)) + nfs4_free_cpntf_statelist(stid->sc_client->net, stid); kmem_cache_free(stateid_slab, stid); } -- 2.46.1

2 1