- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2455/2455] ERROR: modpost: "fg_console" [drivers/video/fbdev/ls2k500sfb.ko] undefined!
by kernel test robot 04 Jul '25

04 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 673b27ee13cb811b3f418669e6826b95459c32f4 commit: 8248d42b7c5f4338a54f26d8efebec8614b43466 [2455/2455] fbdev: add ls2k500sfb driver for ls2k500 bmc. config: arm64-randconfig-001-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041220.xQnKLHix-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041220.xQnKLHix-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507041220.xQnKLHix-lkp@intel.com/ All errors (new ones prefixed by >>, old ones prefixed by <<): WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/block/xen-blkback/xen-blkback.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mfd/pcf50633-gpio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mfd/qcom-pm8008.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/host/nvme.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvme/host/nvme-tcp.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mtd/chips/cfi_util.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mtd/chips/cfi_cmdset_0020.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/mdio/mdio-aspeed.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ath/wcn36xx/wcn36xx.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/broadcom/brcm80211/brcmfmac/wcc/brcmfmac-wcc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/brcmfmac-cyw.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/broadcom/brcm80211/brcmfmac/bca/brcmfmac-bca.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wlcore/wlcore.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wlcore/wlcore_spi.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wlcore/wlcore_sdio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wl12xx/wl12xx.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wl1251/wl1251_spi.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/wireless/ti/wl1251/wl1251_sdio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/arcnet.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/rfc1201.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/arc-rawmode.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/capmode.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/arcnet/com90io.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/ppp/ppp_generic.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/ppp/ppp_async.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/net/ppp/bsd_comp.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/atm/iphase.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/atm/eni.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firewire/firewire-uapi-test.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/host/ohci-exynos.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/serial/usb_debug.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/serial/mxuport.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/gadget/function/usb_f_uvc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/mon/usbmon.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/class/usbtmc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/usb/chipidea/ci_hdrc_msm.o WARNING: modpost: drivers/rtc/rtc-at91rm9200: section mismatch in reference: at91_rtc_driver+0x8 (section: .data) -> at91_rtc_remove (section: .exit.text) WARNING: modpost: drivers/rtc/rtc-mv: section mismatch in reference: mv_rtc_driver+0x8 (section: .data) -> mv_rtc_remove (section: .exit.text) WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/rtc/rtc-omap.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/rtc/rtc-rc5t583.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/i2c/busses/i2c-pxa.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/tuners/tda9887.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/common/videobuf2/videobuf2-dvb.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/common/uvc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/pci/ttpci/budget-core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/dvb-frontends/au8522_decoder.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/v4l2-core/v4l2-async.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/media/v4l2-core/v4l2-fwnode.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/host/of_mmc_spi.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/host/tmio_mmc_core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/host/renesas_sdhi_core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/core/mmc_core.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/core/pwrseq_simple.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/core/pwrseq_sd8787.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/mmc/core/sdio_uart.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/leds/flash/leds-rt4505.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firmware/google/coreboot_table.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firmware/google/cbmem.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/firmware/google/vpd-sysfs.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/crypto/xilinx/zynqmp-aes-gcm.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/crypto/intel/keembay/keembay-ocs-hcu.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/crypto/atmel-sha204a.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/wlan-ng/prism2_usb.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/rtl8192e/rtllib.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/rtl8192e/rtllib_crypt_ccmp.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/rtl8192e/rtllib_crypt_tkip.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/staging/fbtft/fbtft.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/devfreq/governor_simpleondemand.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/perf/marvell_cn10k_ddr_pmu.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/hwtracing/intel_th/intel_th_msu_sink.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/nvmem/nvmem_u-boot-env.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/siox/siox-bus-gpio.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/interconnect/imx/imx8mn-interconnect.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/iio/adc/ingenic-adc.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/iio/adc/xilinx-ams.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/iio/buffer/kfifo_buf.o WARNING: modpost: drivers/hwtracing/coresight/coresight-etm4x: section mismatch in reference: etm4x_amba_driver+0x98 (section: .data) -> etm4_remove_amba (section: .exit.text) WARNING: modpost: drivers/hwtracing/coresight/coresight-etm4x: section mismatch in reference: etm4_platform_driver+0x8 (section: .data) -> etm4_remove_platform_dev (section: .exit.text) WARNING: modpost: missing MODULE_DESCRIPTION() in net/core/dev_addr_lists_test.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/netfilter/nft_fib.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv4/netfilter/iptable_raw.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv4/ipip.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv4/udp_diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv4/raw_diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/xfrm/xfrm_user.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/unix/unix_diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv6/netfilter/nf_reject_ipv6.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv6/ah6.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv6/esp6.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/ipv6/mip6.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/bridge/netfilter/ebtables.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/bridge/netfilter/ebtable_broute.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/bridge/netfilter/ebtable_filter.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/bridge/netfilter/ebtable_nat.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/atm/lec.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/tipc/diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/xdp/xsk_diag.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/6lowpan/6lowpan.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/nfc/nfc_digital.o WARNING: modpost: missing MODULE_DESCRIPTION() in net/hsr/hsr.o >> ERROR: modpost: "fg_console" [drivers/video/fbdev/ls2k500sfb.ko] undefined! -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
by Wang Hai 04 Jul '25

04 Jul '25

From: Saurabh Sengar <ssengar(a)linux.microsoft.com> stable inclusion from stable-v4.19.257 commit b692c238ddfa61f00d97c4c1f021425d132ba96f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG945 CVE: CVE-2022-49986 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d957e7ffb2c72410bcc1a514153a46719255a5da upstream. storvsc_error_wq workqueue should not be marked as WQ_MEM_RECLAIM as it doesn't need to make forward progress under memory pressure. Marking this workqueue as WQ_MEM_RECLAIM may cause deadlock while flushing a non-WQ_MEM_RECLAIM workqueue. In the current state it causes the following warning: [ 14.506347] ------------[ cut here ]------------ [ 14.506354] workqueue: WQ_MEM_RECLAIM storvsc_error_wq_0:storvsc_remove_lun is flushing !WQ_MEM_RECLAIM events_freezable_power_:disk_events_workfn [ 14.506360] WARNING: CPU: 0 PID: 8 at <-snip->kernel/workqueue.c:2623 check_flush_dependency+0xb5/0x130 [ 14.506390] CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.4.0-1086-azure #91~18.04.1-Ubuntu [ 14.506391] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 14.506393] Workqueue: storvsc_error_wq_0 storvsc_remove_lun [ 14.506395] RIP: 0010:check_flush_dependency+0xb5/0x130 <-snip-> [ 14.506408] Call Trace: [ 14.506412] __flush_work+0xf1/0x1c0 [ 14.506414] __cancel_work_timer+0x12f/0x1b0 [ 14.506417] ? kernfs_put+0xf0/0x190 [ 14.506418] cancel_delayed_work_sync+0x13/0x20 [ 14.506420] disk_block_events+0x78/0x80 [ 14.506421] del_gendisk+0x3d/0x2f0 [ 14.506423] sr_remove+0x28/0x70 [ 14.506427] device_release_driver_internal+0xef/0x1c0 [ 14.506428] device_release_driver+0x12/0x20 [ 14.506429] bus_remove_device+0xe1/0x150 [ 14.506431] device_del+0x167/0x380 [ 14.506432] __scsi_remove_device+0x11d/0x150 [ 14.506433] scsi_remove_device+0x26/0x40 [ 14.506434] storvsc_remove_lun+0x40/0x60 [ 14.506436] process_one_work+0x209/0x400 [ 14.506437] worker_thread+0x34/0x400 [ 14.506439] kthread+0x121/0x140 [ 14.506440] ? process_one_work+0x400/0x400 [ 14.506441] ? kthread_park+0x90/0x90 [ 14.506443] ret_from_fork+0x35/0x40 [ 14.506445] ---[ end trace 2d9633159fdc6ee7 ]--- Link: https://lore.kernel.org/r/1659628534-17539-1-git-send-email-ssengar@linux.m… Fixes: 436ad9413353 ("scsi: storvsc: Allow only one remove lun work item to be issued per lun") Reviewed-by: Michael Kelley <mikelley(a)microsoft.com> Signed-off-by: Saurabh Sengar <ssengar(a)linux.microsoft.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/scsi/storvsc_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c index 0c2ba075bc71..f3701b4e374b 100644 --- a/drivers/scsi/storvsc_drv.c +++ b/drivers/scsi/storvsc_drv.c @@ -1856,11 +1856,11 @@ static int storvsc_probe(struct hv_device *device, /* * Set the error handler work queue. */ host_dev->handle_error_wq = alloc_ordered_workqueue("storvsc_error_wq_%d", - WQ_MEM_RECLAIM, + 0, host->host_no); if (!host_dev->handle_error_wq) goto err_out2; INIT_WORK(&host_dev->host_scan_work, storvsc_host_scan); /* Register the HBA and start the scsi bus scan */ -- 2.17.1

2 1

[PATCH OLK-5.10] KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT
by Li Nan 04 Jul '25

04 Jul '25

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v6.0-rc1 commit 6c6ab524cfae0799e55c82b2c1d61f1af0156f8d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG6WR Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Treat the NX bit as valid when using NPT, as KVM will set the NX bit when the NX huge page mitigation is enabled (mindblowing) and trigger the WARN that fires on reserved SPTE bits being set. KVM has required NX support for SVM since commit b26a71a1a5b9 ("KVM: SVM: Refuse to load kvm_amd if NX support is not available") for exactly this reason, but apparently it never occurred to anyone to actually test NPT with the mitigation enabled. ------------[ cut here ]------------ spte = 0x800000018a600ee7, level = 2, rsvd bits = 0x800f0000001fe000 WARNING: CPU: 152 PID: 15966 at arch/x86/kvm/mmu/spte.c:215 make_spte+0x327/0x340 [kvm] Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 10.48.0 01/27/2022 RIP: 0010:make_spte+0x327/0x340 [kvm] Call Trace: <TASK> tdp_mmu_map_handle_target_level+0xc3/0x230 [kvm] kvm_tdp_mmu_map+0x343/0x3b0 [kvm] direct_page_fault+0x1ae/0x2a0 [kvm] kvm_tdp_page_fault+0x7d/0x90 [kvm] kvm_mmu_page_fault+0xfb/0x2e0 [kvm] npf_interception+0x55/0x90 [kvm_amd] svm_invoke_exit_handler+0x31/0xf0 [kvm_amd] svm_handle_exit+0xf6/0x1d0 [kvm_amd] vcpu_enter_guest+0xb6d/0xee0 [kvm] ? kvm_pmu_trigger_event+0x6d/0x230 [kvm] vcpu_run+0x65/0x2c0 [kvm] kvm_arch_vcpu_ioctl_run+0x355/0x610 [kvm] kvm_vcpu_ioctl+0x551/0x610 [kvm] __se_sys_ioctl+0x77/0xc0 __x64_sys_ioctl+0x1d/0x20 do_syscall_64+0x44/0xa0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> ---[ end trace 0000000000000000 ]--- Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-Id: <20220723013029.1753623-1-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Li Nan <linan122(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c47500c4791d..0fee502a5f29 100755 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -4779,7 +4779,7 @@ reset_tdp_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, if (boot_cpu_is_amd()) __reset_rsvds_bits_mask(shadow_zero_check, reserved_hpa_bits(), - context->root_role.level, false, + context->root_role.level, true, boot_cpu_has(X86_FEATURE_GBPAGES), false, true); else -- 2.39.2

2 1

[PATCH OLK-5.10] ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()
by Yongjian Sun 04 Jul '25

04 Jul '25

From: Baokun Li <libaokun1(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 13df4d44a3aaabe61cd01d277b6ee23ead2a5206 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJLYW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We can trigger a slab-out-of-bounds with the following commands: mkfs.ext4 -F /dev/$disk 10G mount /dev/$disk /tmp/test echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc echo test > /tmp/test/file && sync ================================================================== BUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] Read of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11 CPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521 Call Trace: dump_stack_lvl+0x2c/0x50 kasan_report+0xb6/0xf0 ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4] ext4_mb_regular_allocator+0x19e9/0x2370 [ext4] ext4_mb_new_blocks+0x88a/0x1370 [ext4] ext4_ext_map_blocks+0x14f7/0x2390 [ext4] ext4_map_blocks+0x569/0xea0 [ext4] ext4_do_writepages+0x10f6/0x1bc0 [ext4] [...] ================================================================== The flow of issue triggering is as follows: // Set s_mb_group_prealloc to 2147483647 via sysfs ext4_mb_new_blocks ext4_mb_normalize_request ext4_mb_normalize_group_request ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc ext4_mb_regular_allocator ext4_mb_choose_next_group ext4_mb_choose_next_group_best_avail mb_avg_fragment_size_order order = fls(len) - 2 = 29 ext4_mb_find_good_group_avg_frag_lists frag_list = &sbi->s_mb_avg_fragment_size[order] if (list_empty(frag_list)) // Trigger SOOB! At 4k block size, the length of the s_mb_avg_fragment_size list is 14, but an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds to be triggered by an attempt to access an element at index 29. Add a new attr_id attr_clusters_in_group with values in the range [0, sbi->s_clusters_per_group] and declare mb_group_prealloc as that type to fix the issue. In addition avoid returning an order from mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb) and reduce some useless loops. Fixes: 7e170922f06b ("ext4: Add allocation criteria 1.5 (CR1_5)") CC: stable(a)vger.kernel.org Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240319113325.3110393-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/sysfs.c fs/ext4/mballoc.c [This patch not only fixes the issue introduced by the commit "7e170922f06b", but also addresses the BUG_ON problem caused by the sign flip in the assignment of s_mb_group_prealloc. Since we did not merge the commit "7e170922f06b", this patch has been adapted accordingly.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/sysfs.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c index b0bb4a92c9c9..4d690ce19dd4 100644 --- a/fs/ext4/sysfs.c +++ b/fs/ext4/sysfs.c @@ -29,6 +29,7 @@ typedef enum { attr_trigger_test_error, attr_first_error_time, attr_last_error_time, + attr_clusters_in_group, attr_feature, attr_pointer_ui, attr_pointer_ul, @@ -213,13 +214,14 @@ EXT4_ATTR_FUNC(sra_exceeded_retry_limit, 0444); EXT4_ATTR_OFFSET(inode_readahead_blks, 0644, inode_readahead, ext4_sb_info, s_inode_readahead_blks); +EXT4_ATTR_OFFSET(mb_group_prealloc, 0644, clusters_in_group, + ext4_sb_info, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(inode_goal, s_inode_goal); EXT4_RW_ATTR_SBI_UI(mb_stats, s_mb_stats); EXT4_RW_ATTR_SBI_UI(mb_max_to_scan, s_mb_max_to_scan); EXT4_RW_ATTR_SBI_UI(mb_min_to_scan, s_mb_min_to_scan); EXT4_RW_ATTR_SBI_UI(mb_order2_req, s_mb_order2_reqs); EXT4_RW_ATTR_SBI_UI(mb_stream_req, s_mb_stream_request); -EXT4_RW_ATTR_SBI_UI(mb_group_prealloc, s_mb_group_prealloc); EXT4_RW_ATTR_SBI_UI(mb_max_inode_prealloc, s_mb_max_inode_prealloc); EXT4_RW_ATTR_SBI_UI(extent_max_zeroout_kb, s_extent_max_zeroout_kb); EXT4_ATTR(trigger_fs_error, 0200, trigger_test_error); @@ -388,6 +390,7 @@ static ssize_t ext4_attr_show(struct kobject *kobj, (unsigned long long) percpu_counter_sum(&sbi->s_sra_exceeded_retry_limit)); case attr_inode_readahead: + case attr_clusters_in_group: case attr_pointer_ui: if (!ptr) return 0; @@ -448,6 +451,7 @@ static ssize_t ext4_attr_store(struct kobject *kobj, struct ext4_attr *a = container_of(attr, struct ext4_attr, attr); void *ptr = calc_ptr(a, sbi); unsigned long t; + unsigned int ut; int ret; switch (a->attr_id) { @@ -464,6 +468,14 @@ static ssize_t ext4_attr_store(struct kobject *kobj, else *((unsigned int *) ptr) = t; return len; + case attr_clusters_in_group: + ret = kstrtouint(skip_spaces(buf), 0, &ut); + if (ret) + return ret; + if (ut > sbi->s_clusters_per_group) + return -EINVAL; + *((unsigned int *) ptr) = ut; + return len; case attr_pointer_ul: if (!ptr) return 0; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS v2] dm: fix unconditional IO throttle caused by REQ_PREFLUSH
by Zheng Qixing 04 Jul '25

04 Jul '25

From: Jinliang Zheng <alexjlzheng(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit 88f7f56d16f568f19e1a695af34a7f4a6ce537a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEX CVE: CVE-2025-38063 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC, which causes the flush_bio to be throttled by wbt_wait(). An example from v5.4, similar problem also exists in upstream: crash> bt 2091206 PID: 2091206 TASK: ffff2050df92a300 CPU: 109 COMMAND: "kworker/u260:0" #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8 #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4 #2 [ffff800084a2f880] schedule at ffff800040bfa4b4 #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4 #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0 #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254 #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38 #8 [ffff800084a2fa60] generic_make_request at ffff800040570138 #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4 #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs] #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs] #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs] #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs] #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs] #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs] #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08 #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc #18 [ffff800084a2fe70] kthread at ffff800040118de4 After commit 2def2845cc33 ("xfs: don't allow log IO to be throttled"), the metadata submitted by xlog_write_iclog() should not be throttled. But due to the existence of the dm layer, throttling flush_bio indirectly causes the metadata bio to be throttled. Fix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes wbt_should_throttle() return false to avoid wbt_wait(). Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Reviewed-by: Tianxiang Peng <txpeng(a)tencent.com> Reviewed-by: Hao Peng <flyingpeng(a)tencent.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Conflicts: drivers/md/dm.c [Due to not merging commit dbe3ece1287d ("dm: don't reuse bio for flushes").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/dm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 469aefecfe0b..5c73d4f44082 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1472,6 +1472,10 @@ static int __send_empty_flush(struct clone_info *ci) unsigned target_nr = 0; struct dm_target *ti; + if ((ci->io->orig_bio->bi_opf & (REQ_IDLE | REQ_SYNC)) == + (REQ_IDLE | REQ_SYNC)) + ci->bio->bi_opf |= REQ_IDLE; + BUG_ON(bio_has_data(ci->bio)); while ((ti = dm_table_get_target(ci->map, target_nr++))) __send_duplicate_bios(ci, ti, ti->num_flush_bios, NULL); -- 2.39.2

2 1

[PATCH OLK-5.10 v2] dm: fix unconditional IO throttle caused by REQ_PREFLUSH
by Zheng Qixing 04 Jul '25

04 Jul '25

From: Jinliang Zheng <alexjlzheng(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit 88f7f56d16f568f19e1a695af34a7f4a6ce537a6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEX CVE: CVE-2025-38063 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ When a bio with REQ_PREFLUSH is submitted to dm, __send_empty_flush() generates a flush_bio with REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC, which causes the flush_bio to be throttled by wbt_wait(). An example from v5.4, similar problem also exists in upstream: crash> bt 2091206 PID: 2091206 TASK: ffff2050df92a300 CPU: 109 COMMAND: "kworker/u260:0" #0 [ffff800084a2f7f0] __switch_to at ffff80004008aeb8 #1 [ffff800084a2f820] __schedule at ffff800040bfa0c4 #2 [ffff800084a2f880] schedule at ffff800040bfa4b4 #3 [ffff800084a2f8a0] io_schedule at ffff800040bfa9c4 #4 [ffff800084a2f8c0] rq_qos_wait at ffff8000405925bc #5 [ffff800084a2f940] wbt_wait at ffff8000405bb3a0 #6 [ffff800084a2f9a0] __rq_qos_throttle at ffff800040592254 #7 [ffff800084a2f9c0] blk_mq_make_request at ffff80004057cf38 #8 [ffff800084a2fa60] generic_make_request at ffff800040570138 #9 [ffff800084a2fae0] submit_bio at ffff8000405703b4 #10 [ffff800084a2fb50] xlog_write_iclog at ffff800001280834 [xfs] #11 [ffff800084a2fbb0] xlog_sync at ffff800001280c3c [xfs] #12 [ffff800084a2fbf0] xlog_state_release_iclog at ffff800001280df4 [xfs] #13 [ffff800084a2fc10] xlog_write at ffff80000128203c [xfs] #14 [ffff800084a2fcd0] xlog_cil_push at ffff8000012846dc [xfs] #15 [ffff800084a2fda0] xlog_cil_push_work at ffff800001284a2c [xfs] #16 [ffff800084a2fdb0] process_one_work at ffff800040111d08 #17 [ffff800084a2fe00] worker_thread at ffff8000401121cc #18 [ffff800084a2fe70] kthread at ffff800040118de4 After commit 2def2845cc33 ("xfs: don't allow log IO to be throttled"), the metadata submitted by xlog_write_iclog() should not be throttled. But due to the existence of the dm layer, throttling flush_bio indirectly causes the metadata bio to be throttled. Fix this by conditionally adding REQ_IDLE to flush_bio.bi_opf, which makes wbt_should_throttle() return false to avoid wbt_wait(). Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Reviewed-by: Tianxiang Peng <txpeng(a)tencent.com> Reviewed-by: Hao Peng <flyingpeng(a)tencent.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Conflicts: drivers/md/dm.c [Due to not merging commit 49add4966d79 ("block: pass a block_device and opf to bio_init").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/dm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 9048cfc0d000..43cbfe359527 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1459,6 +1459,11 @@ static int __send_empty_flush(struct clone_info *ci) unsigned target_nr = 0; struct dm_target *ti; struct bio flush_bio; + unsigned int opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC; + + if ((ci->io->orig_bio->bi_opf & (REQ_IDLE | REQ_SYNC)) == + (REQ_IDLE | REQ_SYNC)) + opf |= REQ_IDLE; /* * Use an on-stack bio for this, it's safe since we don't @@ -1466,7 +1471,7 @@ static int __send_empty_flush(struct clone_info *ci) * the basis for the clone(s). */ bio_init(&flush_bio, NULL, 0); - flush_bio.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC; + flush_bio.bi_opf = opf; ci->bio = &flush_bio; ci->sector_count = 0; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 04 Jul '25

04 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-50228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[PATCH OLK-6.6 v2] mucse: rnpm: fix UAF in rnpm_remove()
by Ding Hui 04 Jul '25

04 Jul '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJVFM CVE: NA ------------------------------------ KASAN report a use-after-free case in rnpm_remove(). The pf_adapter is already be freed in rnpm_rm_pf_adapter(), but using pf_adapter->hw.mbx after that. Fix it by moving the dma_free_coherent() into rnpm_rm_pf_adapter() just before releasing pf_adapter, that also fix reply_dma leaking on rnpm_probe() error path. Fixes: 5deaf74c4b3e ("drivers: initial support for rnpm drivers from Mucse Technology") Signed-off-by: Ding Hui <dinghui(a)sangfor.com.cn> --- drivers/net/ethernet/mucse/rnpm/rnpm_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- v2: add Fixes: tag diff --git a/drivers/net/ethernet/mucse/rnpm/rnpm_main.c b/drivers/net/ethernet/mucse/rnpm/rnpm_main.c index 8c920f2fd9bc..3b1a3d872e22 100644 --- a/drivers/net/ethernet/mucse/rnpm/rnpm_main.c +++ b/drivers/net/ethernet/mucse/rnpm/rnpm_main.c @@ -8296,6 +8296,11 @@ static int rnpm_rm_pf_adapter(struct pci_dev *pdev, if (pf_adapter->hw_addr4) pcim_iounmap(pdev, pf_adapter->hw_addr4); + if (pf_adapter->hw.mbx.reply_dma) + dma_free_coherent(&pdev->dev, pf_adapter->hw.mbx.reply_dma_size, + pf_adapter->hw.mbx.reply_dma, + pf_adapter->hw.mbx.reply_dma_phy); + if (pf_adapter) devm_kfree(&pdev->dev, pf_adapter); @@ -8977,9 +8982,6 @@ static void rnpm_remove(struct pci_dev *pdev) rnpm_rm_pf_adapter(pdev, &pf_adapter); // pci_release_selected_regions(pdev, pci_select_bars(pdev, // IORESOURCE_MEM)); - dma_free_coherent(&pdev->dev, pf_adapter->hw.mbx.reply_dma_size, - pf_adapter->hw.mbx.reply_dma, - pf_adapter->hw.mbx.reply_dma_phy); pci_release_mem_regions(pdev); pci_disable_device(pdev); } -- 2.17.1

2 1

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5536700e483b14a193ce40d6be90b95fb2d7532e
by kernel test robot 04 Jul '25

04 Jul '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5536700e483b14a193ce40d6be90b95fb2d7532e !16920 net: atlantic: fix aq_vec index out of range error Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202506061449.nBm6oAvj-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506061633.Zsp5yfyi-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506061637.CVNqsEqf-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506061755.yar1Fr9d-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202506182031.ldH7VynO-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202507030343.E83xAhC0-lkp@intel.com kernel/sched/core.c:5989:22: error: 'root_task_group' undeclared (first use in this function); did you mean 'task_group'? kernel/sched/core.c:5989:29: error: 'root_task_group' undeclared (first use in this function); did you mean 'task_group'? mm/memcontrol.c:5000:6: warning: no previous prototype for function 'dhugetlb_pool_is_free' [-Wmissing-prototypes] mm/memory.c:4803:3: warning: cast from 'int (*)(unsigned long, unsigned long, struct cgp_args *)' to 'ktask_thread_func' (aka 'int (*)(void *, void *, void *)') converts to incompatible function type [-Wcast-function-type-mismatch] mm/memory_hotplug.c:970:13: warning: 'rollback_node_hotadd' defined but not used [-Wunused-function] mm/mmu_gather.o: warning: objtool: missing symbol for section .text mm/page_alloc.c:3123: warning: Function parameter or member 'mt' not described in '__putback_isolated_page' mm/vmalloc.c:231:16: warning: variable 'start' set but not used [-Wunused-but-set-variable] mm/vmalloc.c:231:23: warning: variable 'start' set but not used [-Wunused-but-set-variable] Unverified Error/Warning (likely false positive, kindly check if interested): include/asm-generic/bug.h:70:12: warning: 'mcu_ctrl' may be used uninitialized in this function [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ces32' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ciov' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'colormap' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ctl' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'data' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'data_arg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'drive_command' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'epds' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'idx' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'inbuf' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'info64' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'iocb' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'irq_req' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'load' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'm' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'master' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'pkg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'r' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'reg' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'req_task' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'rs' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'slave' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'st_loc' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'tmplut' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'ubuf' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'version' may be used uninitialized [-Wmaybe-uninitialized] include/linux/uaccess.h:112:17: warning: 'vw' may be used uninitialized [-Wmaybe-uninitialized] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- include-asm-generic-bitops-non-atomic.h:error:array-subscript-long-unsigned-int-is-partly-outside-array-bounds-of-u32-aka-unsigned-int | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddr_change-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddrinfo-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_paddrparams-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_prim-is-less-than | |-- include-uapi-linux-sctp.h:error:alignment-of-struct-sctp_setpeerprim-is-less-than | |-- include-uapi-linux-sctp.h:error:spinfo_address-offset-in-struct-sctp_paddrinfo-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:spp_address-offset-in-struct-sctp_paddrparams-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:ssp_addr-offset-in-struct-sctp_prim-isn-t-aligned-to | |-- include-uapi-linux-sctp.h:error:sspp_addr-offset-in-struct-sctp_setpeerprim-isn-t-aligned-to | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-allnoconfig | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-002-20250703 | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-003-20250627 | |-- include-linux-uaccess.h:warning:ces32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ciov-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:colormap-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ctl-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:drive_command-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:epds-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:idx-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:inbuf-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:info64-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:iocb-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:irq_req-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:load-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:m-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:master-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:pkg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:r-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:reg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:req_task-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:slave-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:st_loc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:tmplut-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ubuf-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:version-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:vw-may-be-used-uninitialized |-- arm64-randconfig-003-20250703 | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- arm64-randconfig-004-20250626 | |-- include-linux-uaccess.h:warning:acc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:b32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:buts-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:c32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:cgc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:cmap-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:compat_event-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:compat_kdfcopy-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:con2fb-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:d32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:desc32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:event-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:fa-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:fdq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:flags-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:getb-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:handle-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:head-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:hreq32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:idq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:input-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:io-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:kdfcopy-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:log_addrs-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:m32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mask-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:me-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mfetch-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:n_blocks_count-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:new_serial-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:parms-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:pcopy-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:phys_addr-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ptr-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:range-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:recv32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:req32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:res32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ret-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:retval-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rs485-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rsp-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:set_buffer-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:sp32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:tnew-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uq32-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:var-may-be-used-uninitialized |-- arm64-randconfig-004-20250703 | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-allnoconfig | |-- mm-mmu_gather.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-allyesconfig | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250703 | |-- mm-memory_hotplug.c:warning:rollback_node_hotadd-defined-but-not-used | |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-003-20250703 | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used |-- x86_64-buildonly-randconfig-004-20250703 | |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-dhugetlb_pool_is_free | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-vmalloc.c:warning:variable-start-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-defconfig | |-- include-asm-generic-bug.h:warning:mcu_ctrl-may-be-used-uninitialized-in-this-function | |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-vmalloc.c:warning:variable-start-set-but-not-used `-- x86_64-rhel-9.4-rust |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- mm-memcontrol.c:warning:no-previous-prototype-for-function-dhugetlb_pool_is_free |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type |-- mm-memory_hotplug.c:warning:unused-variable-start_pfn |-- mm-page_alloc.c:warning:Function-parameter-or-member-mt-not-described-in-__putback_isolated_page `-- mm-vmalloc.c:warning:variable-start-set-but-not-used elapsed time: 722m configs tested: 16 configs skipped: 115 tested configs: arm64 allmodconfig gcc-15.1.0 arm64 allnoconfig gcc-15.1.0 arm64 randconfig-001-20250703 gcc-5.5.0 arm64 randconfig-002-20250703 gcc-14.3.0 arm64 randconfig-003-20250703 gcc-12.3.0 arm64 randconfig-004-20250703 gcc-8.5.0 x86_64 allnoconfig clang-20 x86_64 allyesconfig clang-20 x86_64 buildonly-randconfig-001-20250703 gcc-11 x86_64 buildonly-randconfig-002-20250703 gcc-12 x86_64 buildonly-randconfig-003-20250703 clang-20 x86_64 buildonly-randconfig-004-20250703 clang-20 x86_64 buildonly-randconfig-005-20250703 gcc-12 x86_64 buildonly-randconfig-006-20250703 gcc-12 x86_64 defconfig gcc-11 x86_64 rhel-9.4-rust clang-21 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] mucse: rnpm: fix UAF in rnpm_remove()
by Ding Hui 04 Jul '25

04 Jul '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJVFM CVE: NA ------------------------------------ KASAN report a use-after-free case in rnpm_remove(). The pf_adapter is already be freed in rnpm_rm_pf_adapter(), but using pf_adapter->hw.mbx after that. Fix it by moving the dma_free_coherent() into rnpm_rm_pf_adapter() just before releasing pf_adapter, that also fix reply_dma leaking on rnpm_probe() error path. Signed-off-by: Ding Hui <dinghui(a)sangfor.com.cn> --- drivers/net/ethernet/mucse/rnpm/rnpm_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mucse/rnpm/rnpm_main.c b/drivers/net/ethernet/mucse/rnpm/rnpm_main.c index 8c920f2fd9bc..3b1a3d872e22 100644 --- a/drivers/net/ethernet/mucse/rnpm/rnpm_main.c +++ b/drivers/net/ethernet/mucse/rnpm/rnpm_main.c @@ -8296,6 +8296,11 @@ static int rnpm_rm_pf_adapter(struct pci_dev *pdev, if (pf_adapter->hw_addr4) pcim_iounmap(pdev, pf_adapter->hw_addr4); + if (pf_adapter->hw.mbx.reply_dma) + dma_free_coherent(&pdev->dev, pf_adapter->hw.mbx.reply_dma_size, + pf_adapter->hw.mbx.reply_dma, + pf_adapter->hw.mbx.reply_dma_phy); + if (pf_adapter) devm_kfree(&pdev->dev, pf_adapter); @@ -8977,9 +8982,6 @@ static void rnpm_remove(struct pci_dev *pdev) rnpm_rm_pf_adapter(pdev, &pf_adapter); // pci_release_selected_regions(pdev, pci_select_bars(pdev, // IORESOURCE_MEM)); - dma_free_coherent(&pdev->dev, pf_adapter->hw.mbx.reply_dma_size, - pf_adapter->hw.mbx.reply_dma, - pf_adapter->hw.mbx.reply_dma_phy); pci_release_mem_regions(pdev); pci_disable_device(pdev); } -- 2.17.1

2 1