- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1568/1568] kernel/uid16.o: warning: objtool: __x64_sys_getuid16.cold()+0x0: unreachable instruction
by kernel test robot 08 Apr '25

08 Apr '25

Hi Josh, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 56bc1719652e7a937bc9856f76f0c0fbf8ce1b23 [1568/1568] objtool: Support GCC 9 cold subfunction naming scheme config: x86_64-randconfig-103-20250408 (https://download.01.org/0day-ci/archive/20250408/202504081156.eLZp36Hb-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081156.eLZp36Hb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081156.eLZp36Hb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/uid16.o: warning: objtool: __x64_sys_getuid16.cold()+0x0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 08 Apr '25

08 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250408/202504081127.rMMmKSGb-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081127.rMMmKSGb-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1334/1334] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 08 Apr '25

08 Apr '25

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 190aae97bcddbed131a203f829257b168f5058ce [1334/1334] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-randconfig-103-20241218 (https://download.01.org/0day-ci/archive/20250408/202504081025.oeT4D3sO-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081025.oeT4D3sO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081025.oeT4D3sO-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1418/1418] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool'
by kernel test robot 08 Apr '25

08 Apr '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1418/1418] dhugetlb: backport dynamic hugetlb feature config: x86_64-buildonly-randconfig-003-20250207 (https://download.01.org/0day-ci/archive/20250408/202504081022.SWpK2BGS-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504081022.SWpK2BGS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504081022.SWpK2BGS-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ mm/hugetlb.c:1370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ | static In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 2 warnings generated. vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 08 Apr '25

08 Apr '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3191c9e4e7c581bfe0a40ee198ffcbd5c3dea53e commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250408/202504080927.7eGn2cDH-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250408/202504080927.7eGn2cDH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504080927.7eGn2cDH-lkp@intel.com/ All errors (new ones prefixed by >>): mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 1 warning and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 07 Apr '25

07 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v5.10.235 commit 4f3509cfcc02e9d757f2714bb7dbbeec35de6fa7 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] vhost/vdpa: Provide new ioctls to user
by frenkjason 07 Apr '25

07 Apr '25

From: frankyj915 <yangjieyj.yang(a)huawei.com> Enable users to bind, unbind, attach, detach vDPA devices with iommufd. So multiple vDPA devices can share the same iommu/smmu table. frankyj915 (2): vhost/vdpa: Add support to bind, unbind, attach and detach iommufd vhost/vdpa: Add error handling when binding or attaching fails drivers/vhost/vdpa.c | 130 +++++++++++++++++++++++++++++++ include/uapi/linux/vhost.h | 28 +++++++ include/uapi/linux/vhost_types.h | 5 ++ tools/include/uapi/linux/vhost.h | 28 +++++++ 4 files changed, 191 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10] hrtimers: Handle CPU state correctly on hotplug
by Zeng Heng 07 Apr '25

07 Apr '25

From: Koichiro Den <koichiro.den(a)canonical.com> stable inclusion from stable-v5.10.234 commit 14984139f1f2768883332965db566ef26db609e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLWTN CVE: CVE-2024-57951 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2f8dea1692eef2b7ba6a256246ed82c365fdc686 upstream. Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. [ tglx: Make the new callback unconditionally available, remove the online modification in the prepare() callback and clear the remaining state in the starting callback instead of the prepare callback ] Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Signed-off-by: Koichiro Den <koichiro.den(a)canonical.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/20241220134421.3809834-1-koichiro.den@canonical… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: kernel/cpu.c [commit 1426c91277cc ("cpu/hotplug: Fix kabi breakage in enum cpuhp_state") removed CPUHP_AP_HRTIMERS_DYING to fix kabi changes] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/hrtimer.h | 1 + kernel/cpu.c | 9 ++++++++- kernel/time/hrtimer.c | 11 ++++++++++- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h index 9c4f4f15a056..04bdeba7b072 100644 --- a/include/linux/hrtimer.h +++ b/include/linux/hrtimer.h @@ -545,6 +545,7 @@ extern void __init hrtimers_init(void); extern void sysrq_timer_list_show(void); int hrtimers_prepare_cpu(unsigned int cpu); +int hrtimers_cpu_starting(unsigned int cpu); #ifdef CONFIG_HOTPLUG_CPU int hrtimers_cpu_dying(unsigned int cpu); #else diff --git a/kernel/cpu.c b/kernel/cpu.c index 137baebdeced..83e1bc2fafb1 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -1713,9 +1713,16 @@ static struct cpuhp_step cpuhp_hp_states[] = { * Please ensure that there are no other steps with teardown handler * between smpcfd:dying and cpu:teardown. */ + /* + * In the past, the implementation of CPUHP_AP_HRTIMERS_DYING is deleted because + * the Kabi is fixed. The teardown operation and teardown of CPUHP_AP_SMPCFD_DYING + * are combined into smpcfd_and_hrtimer_dying_cpu. The startup operation of + * CPUHP_AP_SMPCFD_DYING is empty. Therefore, the startup operation of + * hrtimers_cpu_starting is set to the startup operation of CPUHP_AP_SMPCFD_DYING. + */ [CPUHP_AP_SMPCFD_DYING] = { .name = "smpcfd:dying", - .startup.single = NULL, + .startup.single = hrtimers_cpu_starting, .teardown.single = smpcfd_and_hrtimer_dying_cpu, }, diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c index 31d481da509e..0831821d04c4 100644 --- a/kernel/time/hrtimer.c +++ b/kernel/time/hrtimer.c @@ -2136,6 +2136,15 @@ int hrtimers_prepare_cpu(unsigned int cpu) } cpu_base->cpu = cpu; + hrtimer_cpu_base_init_expiry_lock(cpu_base); + return 0; +} + +int hrtimers_cpu_starting(unsigned int cpu) +{ + struct hrtimer_cpu_base *cpu_base = this_cpu_ptr(&hrtimer_bases); + + /* Clear out any left over state from a CPU down operation */ cpu_base->active_bases = 0; cpu_base->hres_active = 0; cpu_base->hang_detected = 0; @@ -2144,7 +2153,6 @@ int hrtimers_prepare_cpu(unsigned int cpu) cpu_base->expires_next = KTIME_MAX; cpu_base->softirq_expires_next = KTIME_MAX; cpu_base->online = 1; - hrtimer_cpu_base_init_expiry_lock(cpu_base); return 0; } @@ -2222,6 +2230,7 @@ int hrtimers_cpu_dying(unsigned int dying_cpu) void __init hrtimers_init(void) { hrtimers_prepare_cpu(smp_processor_id()); + hrtimers_cpu_starting(smp_processor_id()); open_softirq(HRTIMER_SOFTIRQ, hrtimer_run_softirq); } -- 2.25.1

2 1

[PATCH OLK-6.6] rapidio: add check for rio_add_net() in rio_scan_alloc_net()
by Zeng Heng 07 Apr '25

07 Apr '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.83 commit e6411c3b9512dba09af7d014d474516828c89706 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBRSCC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e842f9a1edf306bf36fe2a4d847a0b0d458770de upstream. The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the reference initialized in rio_add_net(). Link: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Cc: Alexandre Bounine <alex.bou9(a)gmail.com> Cc: Matt Porter <mporter(a)kernel.crashing.org> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/rapidio/rio-scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c index fdcf742b2adb..c12941f71e2c 100644 --- a/drivers/rapidio/rio-scan.c +++ b/drivers/rapidio/rio-scan.c @@ -871,7 +871,10 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport, dev_set_name(&net->dev, "rnet_%d", net->id); net->dev.parent = &mport->dev; net->dev.release = rio_scan_release_dev; - rio_add_net(net); + if (rio_add_net(net)) { + put_device(&net->dev); + net = NULL; + } } return net; -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] ksmbd: fix incorrect validation for num_aces field of smb_acl
by Yongjian Sun 07 Apr '25

07 Apr '25

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.12-rc3 commit 1b8b67f3c5e5169535e26efedd3e422172e2db64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYED0 CVE: CVE-2025-21994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an incorrect validation that we can create an array of size ULONG_MAX. smb_acl has ->size field to calculate actual number of aces in request buffer size. Use this to check invalid num_aces. Reported-by: Igor Leite Ladessa <igor-ladessa(a)hotmail.com> Tested-by: Igor Leite Ladessa <igor-ladessa(a)hotmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/smb/server/smbacl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c index da8ed72f335d..109036e2227c 100644 --- a/fs/smb/server/smbacl.c +++ b/fs/smb/server/smbacl.c @@ -398,7 +398,9 @@ static void parse_dacl(struct mnt_idmap *idmap, if (num_aces <= 0) return; - if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) + if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) / + (offsetof(struct smb_ace, sid) + + offsetof(struct smb_sid, sub_auth) + sizeof(__le16))) return; ret = init_acl_state(&acl_state, num_aces); @@ -432,6 +434,7 @@ static void parse_dacl(struct mnt_idmap *idmap, offsetof(struct smb_sid, sub_auth); if (end_of_acl - acl_base < acl_size || + ppace[i]->sid.num_subauth == 0 || ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || (end_of_acl - acl_base < acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) || -- 2.39.2

2 5