- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:75:18: warning: no previous prototype for 'bpf_si_memswinfo'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: faa195bad3afed3c326917fb4cd36e0bd311220c commit: b3aa368c1f9f8f3acee4703cfebb30e7a909df9f [3098/3098] bpf-rvi: Add bpf_si_memswinfo() kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511050050.0VfB10bw-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511050050.0VfB10bw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511050050.0VfB10bw-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:18:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 18 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:27:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 27 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:32:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 32 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:46:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 46 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:75:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 75 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ vim +/bpf_si_memswinfo +75 kernel/bpf-rvi/common_kfuncs.c 22 23 /* 24 * Loadavg related kfuncs 25 */ 26 > 27 __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) 28 { 29 return task_active_pid_ns(task); 30 } 31 32 __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) 33 { 34 struct pid_iter iter = {}; 35 u32 nr_running = 0, nr_threads = 0; 36 37 for_each_task_in_pidns(iter, ns) { 38 nr_threads++; 39 if (task_is_running(iter.task)) 40 nr_running++; 41 } 42 43 return (u64)nr_running << 32 | nr_threads; 44 } 45 46 __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) 47 { 48 return idr_get_cursor(&ns->idr) - 1; 49 } 50 51 /* 52 * Swaps related kfuncs 53 */ 54 55 /* 56 * no padding member "_f" compared to struct sysinfo, because sizeof(_f) 57 * maybe zero and not supported by bpf_verifier. 58 */ 59 struct bpf_sysinfo { 60 __kernel_long_t uptime; /* Seconds since boot */ 61 __kernel_ulong_t loads[3]; /* 1, 5, and 15 minute load averages */ 62 __kernel_ulong_t totalram; /* Total usable main memory size */ 63 __kernel_ulong_t freeram; /* Available memory size */ 64 __kernel_ulong_t sharedram; /* Amount of shared memory */ 65 __kernel_ulong_t bufferram; /* Memory used by buffers */ 66 __kernel_ulong_t totalswap; /* Total swap space size */ 67 __kernel_ulong_t freeswap; /* swap space still available */ 68 __u16 procs; /* Number of current processes */ 69 __u16 pad; /* Explicit padding for m68k */ 70 __kernel_ulong_t totalhigh; /* Total high memory size */ 71 __kernel_ulong_t freehigh; /* Available high memory size */ 72 __u32 mem_unit; /* Memory unit size in bytes */ 73 }; 74 > 75 __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) 76 { 77 struct sysinfo *si = (struct sysinfo *)bsi; 78 79 if (si) { 80 si_meminfo(si); 81 si_swapinfo(si); 82 } 83 } 84 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3075/3075] drivers/ub/ubus/enum.c:1332:5: warning: no previous prototype for function 'ub_enum_entities_active'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: e7af929fc0444491fa5f13a00c3f576ea5a4b923 [3075/3075] ub:ubus: Supports device enumeration. config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251104/202511042359.TcIxX2CV-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511042359.TcIxX2CV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511042359.TcIxX2CV-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/ubus/enum.c:996:5: warning: no previous prototype for function 'ub_cfg_read_guid' [-Wmissing-prototypes] 996 | int ub_cfg_read_guid(struct ub_entity *uent) | ^ drivers/ub/ubus/enum.c:996:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 996 | int ub_cfg_read_guid(struct ub_entity *uent) | ^ | static drivers/ub/ubus/enum.c:1097:6: warning: no previous prototype for function 'ub_enum_clear_ent_list' [-Wmissing-prototypes] 1097 | void ub_enum_clear_ent_list(struct list_head *dev_list) | ^ drivers/ub/ubus/enum.c:1097:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1097 | void ub_enum_clear_ent_list(struct list_head *dev_list) | ^ | static >> drivers/ub/ubus/enum.c:1332:5: warning: no previous prototype for function 'ub_enum_entities_active' [-Wmissing-prototypes] 1332 | int ub_enum_entities_active(struct list_head *dev_list) | ^ drivers/ub/ubus/enum.c:1332:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1332 | int ub_enum_entities_active(struct list_head *dev_list) | ^ | static 3 warnings generated. vim +/ub_enum_entities_active +1332 drivers/ub/ubus/enum.c 1331 > 1332 int ub_enum_entities_active(struct list_head *dev_list) 1333 { 1334 struct ub_entity *uent, *tmp; 1335 int ret; 1336 1337 list_for_each_entry_safe(uent, tmp, dev_list, node) { 1338 if (uent->entity_idx != 0) 1339 continue; 1340 1341 ub_route_sync_dev(uent); 1342 ret = ub_setup_ent(uent); 1343 if (ret) { 1344 pr_err("setup dev err, ret=%d\n", ret); 1345 return ret; 1346 } 1347 1348 list_del(&uent->node); 1349 ub_entity_add(uent, uent->ubc); 1350 ub_start_ent(uent); 1351 } 1352 1353 return 0; 1354 } 1355 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] kernel/sched/cpuacct.c:417:17: warning: no previous prototype for 'bpf_task_ca_cpuusage'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: 00c32c5569d488b6c90f1695175577e35c17c21c [3098/3098] bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511042208.SaUQnITn-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511042208.SaUQnITn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511042208.SaUQnITn-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:61: >> kernel/sched/cpuacct.c:417:17: warning: no previous prototype for 'bpf_task_ca_cpuusage' [-Wmissing-prototypes] 417 | __bpf_kfunc u64 bpf_task_ca_cpuusage(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/cpuacct.c:424:18: warning: no previous prototype for 'bpf_cpuacct_kcpustat_cpu_fetch' [-Wmissing-prototypes] 424 | __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:73: kernel/sched/debug.c:102:12: warning: no previous prototype for 'is_prefer_numa' [-Wmissing-prototypes] 102 | int __weak is_prefer_numa(void) | ^~~~~~~~~~~~~~ vim +/bpf_task_ca_cpuusage +417 kernel/sched/cpuacct.c 416 > 417 __bpf_kfunc u64 bpf_task_ca_cpuusage(struct task_struct *p) 418 { 419 if (!p) 420 return 0; 421 return cpuusage_read(task_css(p, cpuacct_cgrp_id), NULL); 422 } 423 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] fs/smb: Fix inconsistent refcnt update
by Yifan Qiao 04 Nov '25

04 Nov '25

From: Shuhao Fu <sfual(a)cse.ust.hk> mainline inclusion from mainline-v6.17-rc4 commit ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICYBJ5 CVE: CVE-2025-39819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label "out" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label "finished" and "out" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of "-ENOMEM" is not recoverable. Therefore, the replay logic also gets ignored. Signed-off-by: Shuhao Fu <sfual(a)cse.ust.hk> Acked-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Cc: stable(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2inode.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c index e1078a1decdf..0cc80f472432 100644 --- a/fs/smb/client/smb2inode.c +++ b/fs/smb/client/smb2inode.c @@ -206,8 +206,10 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, server = cifs_pick_channel(ses); vars = kzalloc(sizeof(*vars), GFP_ATOMIC); - if (vars == NULL) - return -ENOMEM; + if (vars == NULL) { + rc = -ENOMEM; + goto out; + } rqst = &vars->rqst[0]; rsp_iov = &vars->rsp_iov[0]; @@ -828,6 +830,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, smb2_should_replay(tcon, &retries, &cur_sleep)) goto replay_again; +out: if (cfile) cifsFileInfo_put(cfile); -- 2.39.2

2 1

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:24:35: warning: no previous prototype for 'bpf_task_active_pid_ns'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: ef015dbb4151c10d0415045f9d0fcf3dc85063d7 [3098/3098] bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511042031.XJbcBnUd-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511042031.XJbcBnUd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511042031.XJbcBnUd-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:15:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 15 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:24:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 24 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:29:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 29 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:43:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 43 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ vim +/bpf_task_active_pid_ns +24 kernel/bpf-rvi/common_kfuncs.c 19 20 /* 21 * Loadavg related kfuncs 22 */ 23 > 24 __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) 25 { 26 return task_active_pid_ns(task); 27 } 28 > 29 __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) 30 { 31 struct pid_iter iter = {}; 32 u32 nr_running = 0, nr_threads = 0; 33 34 for_each_task_in_pidns(iter, ns) { 35 nr_threads++; 36 if (task_is_running(iter.task)) 37 nr_running++; 38 } 39 40 return (u64)nr_running << 32 | nr_threads; 41 } 42 > 43 __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) 44 { 45 return idr_get_cursor(&ns->idr) - 1; 46 } 47 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] block/bpf-rvi.c:36:28: error: implicit declaration of function 'css_to_blkcg'; did you mean 'pd_to_blkg'?
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: 89fa7dcff5e533bd14396601f40c388cfb6c1e59 [3098/3098] bpf-rvi: block: Add diskstats iterator target config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511041808.gFZ75q5u-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511041808.gFZ75q5u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511041808.gFZ75q5u-lkp@intel.com/ All errors (new ones prefixed by >>): block/bpf-rvi.c: In function 'bpf_disk_seqf_start': >> block/bpf-rvi.c:36:28: error: implicit declaration of function 'css_to_blkcg'; did you mean 'pd_to_blkg'? [-Wimplicit-function-declaration] 36 | priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); | ^~~~~~~~~~~~ | pd_to_blkg >> block/bpf-rvi.c:36:69: error: 'io_cgrp_id' undeclared (first use in this function); did you mean 'cpu_cgrp_id'? 36 | priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); | ^~~~~~~~~~ | cpu_cgrp_id block/bpf-rvi.c:36:69: note: each undeclared identifier is reported only once for each function it appears in vim +36 block/bpf-rvi.c 20 21 /* 22 * Basically the same with disk_seqf_start() but without allocating iter and 23 * then overwriting seqf->private, which points to priv_data->target_private 24 * in bpf_iter case (see prepare_seq_file()), and is needed to retrieve 25 * struct bpf_iter_priv_data. Here we allocate iter via setting 26 * .seq_priv_size and turning priv_data->target_private into iter. 27 */ 28 static void *bpf_disk_seqf_start(struct seq_file *seqf, loff_t *pos) 29 { 30 loff_t skip = *pos; 31 struct diskstats_seq_priv *priv = seqf->private; 32 struct class_dev_iter *iter; 33 struct device *dev; 34 struct task_struct *reaper = get_current_level1_reaper(); 35 > 36 priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); 37 if (reaper) 38 put_task_struct(reaper); 39 40 iter = &priv->iter; 41 class_dev_iter_init(iter, &block_class, NULL, &disk_type); 42 do { 43 dev = class_dev_iter_next(iter); 44 if (!dev) 45 return NULL; 46 } while (skip--); 47 48 return dev_to_disk(dev); 49 } 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] arm64/mpam: Add quirk to retrigger L3 CSU monitor
by Zeng Heng 04 Nov '25

04 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4UC2 -------------------------------- Due to the inaccurate L2 CSU sampling on the specified platform, the L3 cache capacity statistics accumulate error. To avoid this, perform a full re-scan instead of incremental counting. Each time when read the L3 CSU monitor, we forcibly reconfigure it so that the hardware rescans the L3 cache capacity. Note that the first read of the L3 CSU usually returns EBUSY, so a second read is required. On the second attempt, skip forcibly reconfigure the monitor, preventing another EBUSY and ensuring the correct result. Fixes: bb66b4d115e5 ("arm_mpam: Add mpam_msmon_read() to read monitor value") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 30e4ce54a3c4..ebc8887d8267 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -909,6 +909,27 @@ static void read_msmon_ctl_flt_vals(struct mon_read *m, u32 *ctl_val, } } +static bool mpam_csu_hisi_need_retrigger(struct mpam_msc_ris *ris, + bool read_again) +{ + static const struct midr_range cpus[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_HIP12), + { /* sentinel */ } + }; + + if (ris->comp->class->type != MPAM_CLASS_CACHE || + ris->comp->class->level != 3) + return false; + + if (!is_midr_in_range_list(cpus)) + return false; + + if (read_again) + return false; + + return true; +} + static void write_msmon_ctl_flt_vals(struct mon_read *m, u32 ctl_val, u32 flt_val) { @@ -1047,7 +1068,8 @@ static void __ris_msmon_read(void *arg) config_mismatch = cur_flt != flt_val || cur_ctl != (ctl_val | MSMON_CFG_x_CTL_EN); - if (config_mismatch || reset_on_next_read) { + if (config_mismatch || reset_on_next_read || + mpam_csu_hisi_need_retrigger(ris, m->err == -EBUSY)) { write_msmon_ctl_flt_vals(m, ctl_val, flt_val); if (mbwu_state) { mbwu_state->prev_val = 0; @@ -1190,6 +1212,7 @@ int mpam_msmon_read(struct mpam_component *comp, struct mon_cfg *ctx, arg.ctx = ctx; arg.type = type; arg.val = val; + arg.err = 0; *val = 0; return _msmon_read(comp, &arg); @@ -1448,7 +1471,7 @@ static int mpam_reprogram_ris(void *_arg) static int mpam_restore_mbwu_state(void *_ris) { int i; - struct mon_read mwbu_arg; + struct mon_read mwbu_arg = {}; struct mpam_msc_ris *ris = _ris; for (i = 0; i < ris->props.num_mbwu_mon; i++) { -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
by Chen Jinghuang 04 Nov '25

04 Nov '25

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.111 commit 3d3abf3f7e8b1abb082070a343de82d7efc80523 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3VRJ CVE: CVE-2025-40026 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e750f85391286a4c8100275516973324b621a269 upstream. When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Reported-by: syzbot+cc2032ba16cc2018ca25(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68790db4.a00a0220.3af5df.0020.GAE@google.com Fixes: 8a76d7f25f8f ("KVM: x86: Add x86 callback for intercept check") Cc: stable(a)vger.kernel.org Cc: Jim Mattson <jmattson(a)google.com> Link: https://lore.kernel.org/r/20250715190638.1899116-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- arch/x86/kvm/emulate.c | 9 ++++----- arch/x86/kvm/kvm_emulate.h | 3 +-- arch/x86/kvm/x86.c | 15 ++++++++------- 3 files changed, 13 insertions(+), 14 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 296e289472a2..5a49156c9540 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -5140,12 +5140,11 @@ void init_decode_cache(struct x86_emulate_ctxt *ctxt) ctxt->mem_read.end = 0; } -int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) +int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts) { const struct x86_emulate_ops *ops = ctxt->ops; int rc = X86EMUL_CONTINUE; int saved_dst_type = ctxt->dst.type; - bool is_guest_mode = ctxt->ops->is_guest_mode(ctxt); ctxt->mem_read.pos = 0; @@ -5193,7 +5192,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) fetch_possible_mmx_operand(&ctxt->dst); } - if (unlikely(is_guest_mode) && ctxt->intercept) { + if (unlikely(check_intercepts) && ctxt->intercept) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_PRE_EXCEPT); if (rc != X86EMUL_CONTINUE) @@ -5222,7 +5221,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) goto done; } - if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { + if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_POST_EXCEPT); if (rc != X86EMUL_CONTINUE) @@ -5276,7 +5275,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) special_insn: - if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { + if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_POST_MEMACCESS); if (rc != X86EMUL_CONTINUE) diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h index c224cf4126f2..c74d20a14246 100644 --- a/arch/x86/kvm/kvm_emulate.h +++ b/arch/x86/kvm/kvm_emulate.h @@ -228,7 +228,6 @@ struct x86_emulate_ops { void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); bool (*is_smm)(struct x86_emulate_ctxt *ctxt); - bool (*is_guest_mode)(struct x86_emulate_ctxt *ctxt); int (*leave_smm)(struct x86_emulate_ctxt *ctxt); void (*triple_fault)(struct x86_emulate_ctxt *ctxt); int (*set_xcr)(struct x86_emulate_ctxt *ctxt, u32 index, u64 xcr); @@ -512,7 +511,7 @@ bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt); #define EMULATION_RESTART 1 #define EMULATION_INTERCEPTED 2 void init_decode_cache(struct x86_emulate_ctxt *ctxt); -int x86_emulate_insn(struct x86_emulate_ctxt *ctxt); +int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts); int emulator_task_switch(struct x86_emulate_ctxt *ctxt, u16 tss_selector, int idt_index, int reason, bool has_error_code, u32 error_code); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index c30e3e9d60f7..7a98760a4c03 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -8454,11 +8454,6 @@ static bool emulator_is_smm(struct x86_emulate_ctxt *ctxt) return is_smm(emul_to_vcpu(ctxt)); } -static bool emulator_is_guest_mode(struct x86_emulate_ctxt *ctxt) -{ - return is_guest_mode(emul_to_vcpu(ctxt)); -} - #ifndef CONFIG_KVM_SMM static int emulator_leave_smm(struct x86_emulate_ctxt *ctxt) { @@ -8540,7 +8535,6 @@ static const struct x86_emulate_ops emulate_ops = { .guest_has_rdpid = emulator_guest_has_rdpid, .set_nmi_mask = emulator_set_nmi_mask, .is_smm = emulator_is_smm, - .is_guest_mode = emulator_is_guest_mode, .leave_smm = emulator_leave_smm, .triple_fault = emulator_triple_fault, .set_xcr = emulator_set_xcr, @@ -9160,7 +9154,14 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, ctxt->exception.address = 0; } - r = x86_emulate_insn(ctxt); + /* + * Check L1's instruction intercepts when emulating instructions for + * L2, unless KVM is re-emulating a previously decoded instruction, + * e.g. to complete userspace I/O, in which case KVM has already + * checked the intercepts. + */ + r = x86_emulate_insn(ctxt, is_guest_mode(vcpu) && + !(emulation_type & EMULTYPE_NO_DECODE)); if (r == EMULATION_INTERCEPTED) return 1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] *** fix CVE-2023-53454 ***
by Lin Ruifeng 04 Nov '25

04 Nov '25

*** fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH OLK-5.10 0/3] CVE-2025-22121
by Yongjian Sun 04 Nov '25

04 Nov '25

Ye Bin (2): ext4: introduce ITAIL helper ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() Yongjian Sun (1): ext4: Restore the deleted check paths of the xattr. fs/ext4/inode.c | 5 +++++ fs/ext4/xattr.c | 15 ++++++--------- fs/ext4/xattr.h | 10 ++++++++++ 3 files changed, 21 insertions(+), 9 deletions(-) -- 2.39.2

2 4