- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] iommu/vt-d: debugfs: Fix legacy mode page table dump logic
by z00845436 22 Nov '25

22 Nov '25

From: "Vineeth Pillai (Google)" <vineeth(a)bitbyteword.org> mainline inclusion from mainline-v6.18-rc1 commit fbe6070c73badca726e4ff7877320e6c62339917 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B92 Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… -------------------------------- In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") Signed-off-by: Vineeth Pillai (Google) <vineeth(a)bitbyteword.org> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> --- drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c index 86b506af7daa..7223adfabd7d 100644 --- a/drivers/iommu/intel/debugfs.c +++ b/drivers/iommu/intel/debugfs.c @@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, } pgd &= VTD_PAGE_MASK; } else { /* legacy mode */ - pgd = context->lo & VTD_PAGE_MASK; - agaw = context->hi & 7; + u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; + + /* + * According to Translation Type(TT), + * get the page table pointer(SSPTPTR). + */ + switch (tt) { + case CONTEXT_TT_MULTI_LEVEL: + case CONTEXT_TT_DEV_IOTLB: + pgd = context->lo & VTD_PAGE_MASK; + agaw = context->hi & 7; + break; + default: + goto iommu_unlock; + } } seq_printf(m, "Device %04x:%02x:%02x.%x ", -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/vt-d: debugfs: Fix legacy mode page table dump logic
by z00845436 22 Nov '25

22 Nov '25

From: "Vineeth Pillai (Google)" <vineeth(a)bitbyteword.org> mainline inclusion from mainline-v6.18-rc1 commit fbe6070c73badca726e4ff7877320e6c62339917 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B92 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") Signed-off-by: Vineeth Pillai (Google) <vineeth(a)bitbyteword.org> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> --- drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c index 86b506af7daa..7223adfabd7d 100644 --- a/drivers/iommu/intel/debugfs.c +++ b/drivers/iommu/intel/debugfs.c @@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, } pgd &= VTD_PAGE_MASK; } else { /* legacy mode */ - pgd = context->lo & VTD_PAGE_MASK; - agaw = context->hi & 7; + u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; + + /* + * According to Translation Type(TT), + * get the page table pointer(SSPTPTR). + */ + switch (tt) { + case CONTEXT_TT_MULTI_LEVEL: + case CONTEXT_TT_DEV_IOTLB: + pgd = context->lo & VTD_PAGE_MASK; + agaw = context->hi & 7; + break; + default: + goto iommu_unlock; + } } seq_printf(m, "Device %04x:%02x:%02x.%x ", -- 2.43.0

2 1

[openeuler:OLK-6.6 3304/3304] drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:450:39: error: incomplete definition of type 'struct ieee_pfc'
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e375b157ddf25336989b074c1f2a88a80ab72f5 commit: 2048b5b7f264f56a4d9e73079e790e13c8596aaf [3304/3304] net: wangxun: txgbe: add support for wangxun 10G/25G/40G config: x86_64-randconfig-015-20251122 (https://download.01.org/0day-ci/archive/20251122/202511221659.lFpcDW1g-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221659.lFpcDW1g-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221659.lFpcDW1g-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:28: In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_xsk.h:7: drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:450:39: error: incomplete definition of type 'struct ieee_pfc' 450 | pfc_en |= !!(adapter->txgbe_ieee_pfc->pfc_en); | ~~~~~~~~~~~~~~~~~~~~~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:814:9: note: forward declaration of 'struct ieee_pfc' 814 | struct ieee_pfc *txgbe_ieee_pfc; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:582:7: warning: variable 'real_tx_hang' set but not used [-Wunused-but-set-variable] 582 | bool real_tx_hang = false; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:2618:21: warning: variable 'tx_ring' set but not used [-Wunused-but-set-variable] 2618 | struct txgbe_ring *tx_ring; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:3270:39: error: incomplete definition of type 'struct ieee_pfc' 3270 | pfc_en |= !!(adapter->txgbe_ieee_pfc->pfc_en); | ~~~~~~~~~~~~~~~~~~~~~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:814:9: note: forward declaration of 'struct ieee_pfc' 814 | struct ieee_pfc *txgbe_ieee_pfc; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4403:20: warning: variable 'vlnctrl' set but not used [-Wunused-but-set-variable] 4403 | u32 fctrl, vmolr, vlnctrl; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4517:15: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4517 | __u16 refill[IEEE_8021QAZ_MAX_TCS], max[IEEE_8021QAZ_MAX_TCS]; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4517:42: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4517 | __u16 refill[IEEE_8021QAZ_MAX_TCS], max[IEEE_8021QAZ_MAX_TCS]; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4518:17: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4518 | __u8 prio_type[IEEE_8021QAZ_MAX_TCS]; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4522:14: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4522 | __u8 bwg_id[IEEE_8021QAZ_MAX_TCS] = {0, 1, 2, 3, 4, 5, 6, 7}; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4525:18: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4525 | for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) { | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4526:14: error: incomplete definition of type 'struct ieee_ets' 4526 | switch (ets->tc_tsa[i]) { | ~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:815:9: note: forward declaration of 'struct ieee_ets' 815 | struct ieee_ets *txgbe_ieee_ets; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4527:8: error: use of undeclared identifier 'IEEE_8021QAZ_TSA_STRICT' 4527 | case IEEE_8021QAZ_TSA_STRICT: | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4530:8: error: use of undeclared identifier 'IEEE_8021QAZ_TSA_ETS' 4530 | case IEEE_8021QAZ_TSA_ETS: | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4543:36: error: incomplete definition of type 'struct ieee_ets' 4543 | txgbe_dcb_calculate_tc_credits(ets->tc_tx_bw, refill, max, max_frame); | ~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:815:9: note: forward declaration of 'struct ieee_ets' 815 | struct ieee_ets *txgbe_ieee_ets; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4543:56: error: use of undeclared identifier 'max' 4543 | txgbe_dcb_calculate_tc_credits(ets->tc_tx_bw, refill, max, max_frame); | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4545:30: error: incomplete definition of type 'struct ieee_ets' 4545 | bwg_id, prio_type, ets->prio_tc); | ~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:815:9: note: forward declaration of 'struct ieee_ets' 815 | struct ieee_ets *txgbe_ieee_ets; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4544:41: error: use of undeclared identifier 'max' 4544 | return txgbe_dcb_hw_config(hw, refill, max, | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4515:5: warning: no previous prototype for function 'txgbe_dcb_hw_ets' [-Wmissing-prototypes] 4515 | s32 txgbe_dcb_hw_ets(struct txgbe_hw *hw, struct ieee_ets *ets, int max_frame) | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4515:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4515 | s32 txgbe_dcb_hw_ets(struct txgbe_hw *hw, struct ieee_ets *ets, int max_frame) | ^ | static >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4591:26: error: use of undeclared identifier 'DCB_CAP_DCBX_VER_IEEE' 4591 | if (adapter->dcbx_cap & DCB_CAP_DCBX_VER_IEEE) { | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4599:36: error: incomplete definition of type 'struct ieee_ets' 4599 | u8 *tc = adapter->txgbe_ieee_ets->prio_tc; | ~~~~~~~~~~~~~~~~~~~~~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:815:9: note: forward declaration of 'struct ieee_ets' 815 | struct ieee_ets *txgbe_ieee_ets; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4601:42: error: incomplete definition of type 'struct ieee_pfc' 4601 | txgbe_dcb_config_pfc(&adapter->hw, pfc->pfc_en, tc); | ~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:814:9: note: forward declaration of 'struct ieee_pfc' 814 | struct ieee_pfc *txgbe_ieee_pfc; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6709:9: warning: variable 'missed_rx' set but not used [-Wunused-but-set-variable] 6709 | u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6915:6: warning: no previous prototype for function 'txgbe_irq_rearm_queues' [-Wmissing-prototypes] 6915 | void txgbe_irq_rearm_queues(struct txgbe_adapter *adapter, | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6915:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6915 | void txgbe_irq_rearm_queues(struct txgbe_adapter *adapter, | ^ | static drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:7007:39: error: incomplete definition of type 'struct ieee_pfc' 7007 | pfc_en |= !!(adapter->txgbe_ieee_pfc->pfc_en); | ~~~~~~~~~~~~~~~~~~~~~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:814:9: note: forward declaration of 'struct ieee_pfc' 814 | struct ieee_pfc *txgbe_ieee_pfc; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:7091:22: error: use of undeclared identifier 'DCB_APP_IDTYPE_ETHTYPE' 7091 | .selector = DCB_APP_IDTYPE_ETHTYPE, | ^ fatal error: too many errors emitted, stopping now [-ferror-limit=] 7 warnings and 20 errors generated. vim +450 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c 439 440 static void txgbe_update_xoff_received(struct txgbe_adapter *adapter) 441 { 442 struct txgbe_hw *hw = &adapter->hw; 443 struct txgbe_hw_stats *hwstats = &adapter->stats; 444 u32 xoff[8] = {0}; 445 int tc; 446 int i; 447 bool pfc_en = adapter->dcb_cfg.pfc_mode_enable; 448 449 if (adapter->txgbe_ieee_pfc) > 450 pfc_en |= !!(adapter->txgbe_ieee_pfc->pfc_en); 451 452 if (!(adapter->flags & TXGBE_FLAG_DCB_ENABLED) || !pfc_en) { 453 txgbe_update_xoff_rx_lfc(adapter); 454 return; 455 } 456 457 /* update stats for each tc, only valid with PFC enabled */ 458 for (i = 0; i < MAX_TX_PACKET_BUFFERS; i++) { 459 u32 pxoffrxc; 460 461 wr32m(hw, TXGBE_MMC_CONTROL, TXGBE_MMC_CONTROL_UP, i << 16); 462 pxoffrxc = rd32(hw, TXGBE_MAC_PXOFFRXC); 463 hwstats->pxoffrxc[i] += pxoffrxc; 464 /* Get the TC for given UP */ 465 tc = netdev_get_prio_tc_map(adapter->netdev, i); 466 xoff[tc] += pxoffrxc; 467 } 468 469 /* disarm tx queues that have received xoff frames */ 470 for (i = 0; i < adapter->num_tx_queues; i++) { 471 struct txgbe_ring *tx_ring = adapter->tx_ring[i]; 472 473 tc = tx_ring->dcb_tc; 474 if (tc <= 7 && xoff[tc]) 475 clear_bit(__TXGBE_HANG_CHECK_ARMED, &tx_ring->state); 476 } 477 for (i = 0; i < adapter->num_xdp_queues; i++) { 478 struct txgbe_ring *xdp_ring = adapter->xdp_ring[i]; 479 480 tc = xdp_ring->dcb_tc; 481 if (tc <= 7 && xoff[tc]) 482 clear_bit(__TXGBE_HANG_CHECK_ARMED, &xdp_ring->state); 483 } 484 } 485 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3304/3304] arch/arm64/kvm/hypercalls.c:380:52: error: passing argument 1 of 'hisi_ipiv_supported_per_vm' from incompatible pointer type
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e375b157ddf25336989b074c1f2a88a80ab72f5 commit: cbd165f529bd32b586342c0a2d11c3ca50b9fdd3 [3304/3304] KVM: arm64: ipiv: Change parameter from vcpu to kvm config: arm64-defconfig (https://download.01.org/0day-ci/archive/20251122/202511221643.H3LgffBo-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221643.H3LgffBo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221643.H3LgffBo-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kvm/hypercalls.c: In function 'kvm_smccc_call_handler': >> arch/arm64/kvm/hypercalls.c:380:52: error: passing argument 1 of 'hisi_ipiv_supported_per_vm' from incompatible pointer type [-Wincompatible-pointer-types] 380 | if (hisi_ipiv_supported_per_vm(vcpu->kvm)) | ~~~~^~~~~ | | | struct kvm * In file included from arch/arm64/kvm/hypercalls.c:13: arch/arm64/kvm/hisilicon/hisi_virt.h:127:64: note: expected 'struct kvm_vcpu *' but argument is of type 'struct kvm *' 127 | static inline bool hisi_ipiv_supported_per_vm(struct kvm_vcpu *vcpu) | ~~~~~~~~~~~~~~~~~^~~~ arch/arm64/kvm/hypercalls.c:386:52: error: passing argument 1 of 'hisi_ipiv_supported_per_vm' from incompatible pointer type [-Wincompatible-pointer-types] 386 | if (hisi_ipiv_supported_per_vm(vcpu->kvm)) { | ~~~~^~~~~ | | | struct kvm * arch/arm64/kvm/hisilicon/hisi_virt.h:127:64: note: expected 'struct kvm_vcpu *' but argument is of type 'struct kvm *' 127 | static inline bool hisi_ipiv_supported_per_vm(struct kvm_vcpu *vcpu) | ~~~~~~~~~~~~~~~~~^~~~ >> arch/arm64/kvm/hypercalls.c:387:53: error: passing argument 1 of 'hisi_ipiv_enable_per_vm' from incompatible pointer type [-Wincompatible-pointer-types] 387 | hisi_ipiv_enable_per_vm(vcpu->kvm); | ~~~~^~~~~ | | | struct kvm * arch/arm64/kvm/hisilicon/hisi_virt.h:131:61: note: expected 'struct kvm_vcpu *' but argument is of type 'struct kvm *' 131 | static inline void hisi_ipiv_enable_per_vm(struct kvm_vcpu *vcpu) {} | ~~~~~~~~~~~~~~~~~^~~~ vim +/hisi_ipiv_supported_per_vm +380 arch/arm64/kvm/hypercalls.c 264 265 int kvm_smccc_call_handler(struct kvm_vcpu *vcpu) 266 { 267 struct kvm_smccc_features *smccc_feat = &vcpu->kvm->arch.smccc_feat; 268 u32 func_id = smccc_get_function(vcpu); 269 u64 val[4] = {SMCCC_RET_NOT_SUPPORTED}; 270 u32 feature; 271 u8 action; 272 gpa_t gpa; 273 274 action = kvm_smccc_get_action(vcpu, func_id); 275 switch (action) { 276 case KVM_SMCCC_FILTER_HANDLE: 277 break; 278 case KVM_SMCCC_FILTER_DENY: 279 goto out; 280 case KVM_SMCCC_FILTER_FWD_TO_USER: 281 kvm_prepare_hypercall_exit(vcpu, func_id); 282 return 0; 283 default: 284 WARN_RATELIMIT(1, "Unhandled SMCCC filter action: %d\n", action); 285 goto out; 286 } 287 288 switch (func_id) { 289 case ARM_SMCCC_VERSION_FUNC_ID: 290 val[0] = ARM_SMCCC_VERSION_1_1; 291 break; 292 case ARM_SMCCC_ARCH_FEATURES_FUNC_ID: 293 feature = smccc_get_arg1(vcpu); 294 switch (feature) { 295 case ARM_SMCCC_ARCH_WORKAROUND_1: 296 switch (arm64_get_spectre_v2_state()) { 297 case SPECTRE_VULNERABLE: 298 break; 299 case SPECTRE_MITIGATED: 300 val[0] = SMCCC_RET_SUCCESS; 301 break; 302 case SPECTRE_UNAFFECTED: 303 val[0] = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED; 304 break; 305 } 306 break; 307 case ARM_SMCCC_ARCH_WORKAROUND_2: 308 switch (arm64_get_spectre_v4_state()) { 309 case SPECTRE_VULNERABLE: 310 break; 311 case SPECTRE_MITIGATED: 312 /* 313 * SSBS everywhere: Indicate no firmware 314 * support, as the SSBS support will be 315 * indicated to the guest and the default is 316 * safe. 317 * 318 * Otherwise, expose a permanent mitigation 319 * to the guest, and hide SSBS so that the 320 * guest stays protected. 321 */ 322 if (cpus_have_final_cap(ARM64_SSBS)) 323 break; 324 fallthrough; 325 case SPECTRE_UNAFFECTED: 326 val[0] = SMCCC_RET_NOT_REQUIRED; 327 break; 328 } 329 break; 330 case ARM_SMCCC_ARCH_WORKAROUND_3: 331 switch (arm64_get_spectre_bhb_state()) { 332 case SPECTRE_VULNERABLE: 333 break; 334 case SPECTRE_MITIGATED: 335 val[0] = SMCCC_RET_SUCCESS; 336 break; 337 case SPECTRE_UNAFFECTED: 338 val[0] = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED; 339 break; 340 } 341 break; 342 case ARM_SMCCC_HV_PV_TIME_FEATURES: 343 if (test_bit(KVM_REG_ARM_STD_HYP_BIT_PV_TIME, 344 &smccc_feat->std_hyp_bmap)) 345 val[0] = SMCCC_RET_SUCCESS; 346 break; 347 #ifdef CONFIG_PARAVIRT_SCHED 348 case ARM_SMCCC_HV_PV_SCHED_FEATURES: 349 val[0] = SMCCC_RET_SUCCESS; 350 break; 351 #endif /* CONFIG_PARAVIRT_SCHED */ 352 } 353 break; 354 case ARM_SMCCC_HV_PV_TIME_FEATURES: 355 val[0] = kvm_hypercall_pv_features(vcpu); 356 break; 357 case ARM_SMCCC_HV_PV_TIME_ST: 358 gpa = kvm_init_stolen_time(vcpu); 359 if (gpa != INVALID_GPA) 360 val[0] = gpa; 361 break; 362 #ifdef CONFIG_PARAVIRT_SCHED 363 case ARM_SMCCC_HV_PV_SCHED_FEATURES: 364 val[0] = kvm_hypercall_pvsched_features(vcpu); 365 break; 366 case ARM_SMCCC_HV_PV_SCHED_IPA_INIT: 367 gpa = smccc_get_arg1(vcpu); 368 if (gpa != INVALID_GPA) { 369 vcpu->arch.pvsched.base = gpa; 370 val[0] = SMCCC_RET_SUCCESS; 371 } 372 break; 373 case ARM_SMCCC_HV_PV_SCHED_IPA_RELEASE: 374 vcpu->arch.pvsched.base = INVALID_GPA; 375 val[0] = SMCCC_RET_SUCCESS; 376 break; 377 #endif /* CONFIG_PARAVIRT_SCHED */ 378 #ifdef CONFIG_ARM64_HISI_IPIV 379 case ARM_SMCCC_VENDOR_PV_SGI_FEATURES: > 380 if (hisi_ipiv_supported_per_vm(vcpu->kvm)) 381 val[0] = SMCCC_RET_SUCCESS; 382 else 383 val[0] = SMCCC_RET_NOT_SUPPORTED; 384 break; 385 case ARM_SMCCC_VENDOR_PV_SGI_ENABLE: > 386 if (hisi_ipiv_supported_per_vm(vcpu->kvm)) { > 387 hisi_ipiv_enable_per_vm(vcpu->kvm); 388 val[0] = SMCCC_RET_SUCCESS; 389 } else { 390 val[0] = SMCCC_RET_NOT_SUPPORTED; 391 } 392 break; 393 #endif 394 case ARM_SMCCC_VENDOR_HYP_CALL_UID_FUNC_ID: 395 val[0] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_0; 396 val[1] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_1; 397 val[2] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_2; 398 val[3] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_3; 399 break; 400 case ARM_SMCCC_VENDOR_HYP_KVM_FEATURES_FUNC_ID: 401 val[0] = smccc_feat->vendor_hyp_bmap; 402 /* Function numbers 2-63 are reserved for pKVM for now */ 403 val[2] = smccc_feat->vendor_hyp_bmap_2; 404 break; 405 case ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID: 406 kvm_ptp_get_time(vcpu, val); 407 break; 408 case ARM_SMCCC_TRNG_VERSION: 409 case ARM_SMCCC_TRNG_FEATURES: 410 case ARM_SMCCC_TRNG_GET_UUID: 411 case ARM_SMCCC_TRNG_RND32: 412 case ARM_SMCCC_TRNG_RND64: 413 return kvm_trng_call(vcpu); 414 default: 415 return kvm_psci_call(vcpu); 416 } 417 418 out: 419 smccc_set_retval(vcpu, val[0], val[1], val[2], val[3]); 420 return 1; 421 } 422 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] crypto: essiv - Check ssize for decryption and in-place encryption
by Yi Yang 22 Nov '25

22 Nov '25

From: Herbert Xu <herbert(a)gondor.apana.org.au> mainline inclusion from mainline-v6.18-rc1 commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3FOP CVE: CVE-2025-40019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption. Reported-by: Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/crypto/essiv.c b/crypto/essiv.c index 85bb624e32b9..7db206fc97f2 100644 --- a/crypto/essiv.c +++ b/crypto/essiv.c @@ -185,9 +185,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); struct aead_request *subreq = &rctx->aead_req; + int ivsize = crypto_aead_ivsize(tfm); + int ssize = req->assoclen - ivsize; struct scatterlist *src = req->src; int err; + if (ssize < 0) + return -EINVAL; + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); /* @@ -197,19 +202,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) */ rctx->assoc = NULL; if (req->src == req->dst || !enc) { - scatterwalk_map_and_copy(req->iv, req->dst, - req->assoclen - crypto_aead_ivsize(tfm), - crypto_aead_ivsize(tfm), 1); + scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); } else { u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; - int ivsize = crypto_aead_ivsize(tfm); - int ssize = req->assoclen - ivsize; struct scatterlist *sg; int nents; - if (ssize < 0) - return -EINVAL; - nents = sg_nents_for_len(req->src, ssize); if (nents < 0) return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-6.6] drm/vmwgfx: Fix a null-ptr access in the cursor snooper
by Yi Yang 22 Nov '25

22 Nov '25

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v6.6.113 commit 299cfb5a7deabdf9ecd30071755672af0aced5eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6796 CVE: CVE-2025-40110 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ] Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it. Fixes unchecked null-ptr reference in the snooping code. Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list(a)broadcom.com> Cc: dri-devel(a)lists.freedesktop.org Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 5fef0b31c117..41be22e781e4 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1514,6 +1514,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, SVGA3dCmdHeader *header) { struct vmw_bo *vmw_bo = NULL; + struct vmw_resource *res; struct vmw_surface *srf = NULL; VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); int ret; @@ -1549,18 +1550,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? VMW_RES_DIRTY_SET : 0; - ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, - dirty, user_surface_converter, - &cmd->body.host.sid, NULL); + ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty, + user_surface_converter, &cmd->body.host.sid, + NULL); if (unlikely(ret != 0)) { if (unlikely(ret != -ERESTARTSYS)) VMW_DEBUG_USER("could not find surface for DMA.\n"); return ret; } - srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); + res = sw_context->res_cache[vmw_res_surface].res; + if (!res) { + VMW_DEBUG_USER("Invalid DMA surface.\n"); + return -EINVAL; + } - vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); + srf = vmw_res_to_srf(res); + vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, + header); return 0; } -- 2.25.1

2 1

[openeuler:OLK-6.6 3304/3304] mm/gmem.c:813:29: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e375b157ddf25336989b074c1f2a88a80ab72f5 commit: 8a89dde40c2bd82755f374bc86b46c77acdfd0b6 [3304/3304] mm: implement hmemcpy API config: arm64-randconfig-r122-20251122 (https://download.01.org/0day-ci/archive/20251122/202511221253.wiWo5CIW-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221253.wiWo5CIW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221253.wiWo5CIW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/gmem.c:384:13: sparse: sparse: symbol 'gm_dev_fault' was not declared. Should it be static? >> mm/gmem.c:813:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int enum gm_ret ret @@ got restricted vm_fault_t @@ mm/gmem.c:813:29: sparse: expected unsigned int enum gm_ret ret mm/gmem.c:813:29: sparse: got restricted vm_fault_t vim +813 mm/gmem.c 765 766 static void do_hmemcpy(struct mm_struct *mm, int hnid, unsigned long dest, 767 unsigned long src, size_t size) 768 { 769 enum gm_ret ret; 770 int page_size = HPAGE_SIZE; 771 struct vm_area_struct *vma_dest, *vma_src; 772 struct gm_mapping *gm_mapping_dest, *gm_mapping_src; 773 struct gm_dev *dev = NULL; 774 struct gm_memcpy_t gmc = {0}; 775 776 if (size == 0) 777 return; 778 779 mmap_read_lock(mm); 780 vma_dest = find_vma(mm, dest); 781 vma_src = find_vma(mm, src); 782 783 if (!vma_src || vma_src->vm_start > src || !vma_dest || vma_dest->vm_start > dest) { 784 gmem_err("hmemcpy: the vma find by src/dest is NULL!"); 785 goto unlock_mm; 786 } 787 788 gm_mapping_dest = vm_object_lookup(vma_dest->vm_obj, dest & ~(page_size - 1)); 789 gm_mapping_src = vm_object_lookup(vma_src->vm_obj, src & ~(page_size - 1)); 790 791 if (!gm_mapping_src) { 792 gmem_err("hmemcpy: gm_mapping_src is NULL"); 793 goto unlock_mm; 794 } 795 796 if (gm_mapping_nomap(gm_mapping_src)) { 797 gmem_err("hmemcpy: src address is not mapping to CPU or device"); 798 goto unlock_mm; 799 } 800 801 if (hnid != -1) { 802 dev = get_gm_dev(hnid); 803 if (!dev) { 804 gmem_err("hmemcpy: hnode's dev is NULL"); 805 goto unlock_mm; 806 } 807 } 808 809 // Trigger dest page fault on host or device 810 if (!gm_mapping_dest || gm_mapping_nomap(gm_mapping_dest) 811 || !hnid_match_dest(hnid, gm_mapping_dest)) { 812 if (hnid == -1) { > 813 ret = handle_mm_fault(vma_dest, dest & ~(page_size - 1), FAULT_FLAG_USER | 814 FAULT_FLAG_INSTRUCTION | FAULT_FLAG_WRITE, NULL); 815 if (ret) { 816 gmem_err("%s: failed to execute host page fault, ret:%d", 817 __func__, ret); 818 goto unlock_mm; 819 } 820 } else { 821 ret = gm_dev_fault_locked(mm, dest & ~(page_size - 1), dev, MADV_WILLNEED); 822 if (ret != GM_RET_SUCCESS) { 823 gmem_err("%s: failed to excecute dev page fault.", __func__); 824 goto unlock_mm; 825 } 826 } 827 } 828 if (!gm_mapping_dest) 829 gm_mapping_dest = vm_object_lookup(vma_dest->vm_obj, round_down(dest, page_size)); 830 831 if (gm_mapping_dest && gm_mapping_dest != gm_mapping_src) 832 mutex_lock(&gm_mapping_dest->lock); 833 834 mutex_lock(&gm_mapping_src->lock); 835 // Use memcpy when there is no device address, otherwise use peer_memcpy 836 if (hnid == -1) { 837 if (gm_mapping_cpu(gm_mapping_src)) { // host to host 838 gmem_err("hmemcpy: host to host is unimplemented\n"); 839 goto unlock_gm_mapping; 840 } else if (gm_mapping_device(gm_mapping_src)) { // device to host 841 dev = gm_mapping_src->dev; 842 gmc.dest = phys_to_dma(dev->dma_dev, 843 page_to_phys(gm_mapping_dest->page) + (dest & (page_size - 1))); 844 gmc.src = gm_mapping_src->gm_page->dev_dma_addr + (src & (page_size - 1)); 845 gmc.kind = GM_MEMCPY_D2H; 846 } else { 847 gmem_err("hmemcpy: src address is not mapping to CPU or device"); 848 goto unlock_gm_mapping; 849 } 850 } else { 851 if (gm_mapping_cpu(gm_mapping_src)) { // host to device 852 gmc.dest = gm_mapping_dest->gm_page->dev_dma_addr + 853 (dest & (page_size - 1)); 854 gmc.src = phys_to_dma(dev->dma_dev, 855 page_to_phys(gm_mapping_src->page) + (src & (page_size - 1))); 856 gmc.kind = GM_MEMCPY_H2D; 857 } else if (gm_mapping_device(gm_mapping_src)) { // device to device 858 gmem_err("hmemcpy: device to device is unimplemented\n"); 859 goto unlock_gm_mapping; 860 } else { 861 gmem_err("hmemcpy: src address is not mapping to CPU or device"); 862 goto unlock_gm_mapping; 863 } 864 } 865 gmc.mm = mm; 866 gmc.dev = dev; 867 gmc.size = size; 868 dev->mmu->peer_hmemcpy(&gmc); 869 870 unlock_gm_mapping: 871 mutex_unlock(&gm_mapping_src->lock); 872 if (gm_mapping_dest && gm_mapping_dest != gm_mapping_src) 873 mutex_unlock(&gm_mapping_dest->lock); 874 unlock_mm: 875 mmap_read_unlock(mm); 876 } 877 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3304/3304] mm/kasan/shadow.c:90:(.text+0x590): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `__memcpy_mc'
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7fe983da1977aac40da78a43010d0612ff5c0bb1 commit: b991780c836ceb9a479c6c6e385e914b487e353a [3304/3304] arm64: introduce copy_mc_to_kernel() implementation config: arm64-randconfig-003-20251122 (https://download.01.org/0day-ci/archive/20251122/202511221034.dymjxfJa-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221034.dymjxfJa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221034.dymjxfJa-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: mm/kasan/shadow.o: in function `memcpy_mc': mm/kasan/shadow.c:90: undefined reference to `__memcpy_mc' >> mm/kasan/shadow.c:90:(.text+0x590): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `__memcpy_mc' vim +90 mm/kasan/shadow.c 81 82 #ifdef __HAVE_ARCH_MEMCPY_MC 83 #undef memcpy_mc 84 int memcpy_mc(void *dest, const void *src, size_t len) 85 { 86 if (!kasan_check_range(src, len, false, _RET_IP_) || 87 !kasan_check_range(dest, len, true, _RET_IP_)) 88 return (int)len; 89 > 90 return __memcpy_mc(dest, src, len); 91 } 92 #endif 93 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2818/2818] ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro
by kernel test robot 21 Nov '25

21 Nov '25

Hi Valdis, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3f1b18215d39769abfd210cb9a02b06b47b0b4b5 commit: 0908fe0570df658beb3866ddcb7bc55b0fb834b0 [2818/2818] gcc-plugins: fix gcc 11 indigestion with plugins... config: arm64-randconfig-002-20250321 (https://download.01.org/0day-ci/archive/20251121/202511212044.w0VqCIiP-lkp@…) compiler: aarch64-linux-gcc (GCC) 5.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251121/202511212044.w0VqCIiP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511212044.w0VqCIiP-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/stackleak_plugin.c:30: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/randomize_layout_plugin.c:19: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/sancov_plugin.c:22: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ ../libexec/gcc/aarch64-linux/5.5.0/cc1: error while loading shared libraries: libmpfr.so.4: cannot open shared object file: No such file or directory ../libexec/gcc/aarch64-linux/5.5.0/cc1: error while loading shared libraries: libmpfr.so.4: cannot open shared object file: No such file or directory make[2]: *** [scripts/Makefile.build:280: scripts/mod/empty.o] Error 1 shuffle=1096673560 make[2]: *** [scripts/Makefile.build:117: scripts/mod/devicetable-offsets.s] Error 1 shuffle=1096673560 make[2]: Target '__build' not remade because of errors. make[1]: *** [Makefile:1214: prepare0] Error 2 shuffle=1096673560 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:185: __sub-make] Error 2 shuffle=1096673560 make: Target 'prepare' not remade because of errors. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
by Xinyu Zheng 21 Nov '25

21 Nov '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> stable inclusion from stable-v6.6.113 commit 69a18ff6c60e8e113420f15355fad862cb45d38e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVZ CVE: CVE-2025-40194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 upstream. The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it. Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless). Address this issue by modifying update_qos_request() to drop the reference to the policy later. Fixes: da5c504c7aae ("cpufreq: intel_pstate: Implement QoS supported freq constraints") Cc: 5.4+ <stable(a)vger.kernel.org> # 5.4+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Zihuan Zhang <zhangzihuan(a)kylinos.cn> Link: https://patch.msgid.link/2255671.irdbgypaU6@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/intel_pstate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c index 0cec5148b69f..8d0d62aca50d 100644 --- a/drivers/cpufreq/intel_pstate.c +++ b/drivers/cpufreq/intel_pstate.c @@ -1243,10 +1243,10 @@ static void update_qos_request(enum freq_qos_req_type type) continue; req = policy->driver_data; - cpufreq_cpu_put(policy); - - if (!req) + if (!req) { + cpufreq_cpu_put(policy); continue; + } if (hwp_active) intel_pstate_get_hwp_cap(cpu); @@ -1262,6 +1262,8 @@ static void update_qos_request(enum freq_qos_req_type type) if (freq_qos_update_request(req, freq) < 0) pr_warn("Failed to update freq constraint: CPU%d\n", i); + + cpufreq_cpu_put(policy); } } -- 2.34.1

2 1