- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] net: atlantic: fix aq_vec index out of range error
by Wang Liang 03 Jul '25

03 Jul '25

From: "Chia-Lin Kao (AceLan)" <acelan.kao(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 2ba5e47fb75fbb8fab45f5c1bc8d5c33d8834bd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGA4Q CVE: CVE-2022-50066 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The final update statement of the for loop exceeds the array range, the dereference of self->aq_vec[i] is not checked and then leads to the index out of range error. Also fixed this kind of coding style in other for loop. [ 97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48 [ 97.937607] index 8 is out of range for type 'aq_vec_s *[8]' [ 97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2 [ 97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022 [ 97.937611] Workqueue: events_unbound async_run_entry_fn [ 97.937616] Call Trace: [ 97.937617] <TASK> [ 97.937619] dump_stack_lvl+0x49/0x63 [ 97.937624] dump_stack+0x10/0x16 [ 97.937626] ubsan_epilogue+0x9/0x3f [ 97.937627] __ubsan_handle_out_of_bounds.cold+0x44/0x49 [ 97.937629] ? __scm_send+0x348/0x440 [ 97.937632] ? aq_vec_stop+0x72/0x80 [atlantic] [ 97.937639] aq_nic_stop+0x1b6/0x1c0 [atlantic] [ 97.937644] aq_suspend_common+0x88/0x90 [atlantic] [ 97.937648] aq_pm_suspend_poweroff+0xe/0x20 [atlantic] [ 97.937653] pci_pm_suspend+0x7e/0x1a0 [ 97.937655] ? pci_pm_suspend_noirq+0x2b0/0x2b0 [ 97.937657] dpm_run_callback+0x54/0x190 [ 97.937660] __device_suspend+0x14c/0x4d0 [ 97.937661] async_suspend+0x23/0x70 [ 97.937663] async_run_entry_fn+0x33/0x120 [ 97.937664] process_one_work+0x21f/0x3f0 [ 97.937666] worker_thread+0x4a/0x3c0 [ 97.937668] ? process_one_work+0x3f0/0x3f0 [ 97.937669] kthread+0xf0/0x120 [ 97.937671] ? kthread_complete_and_exit+0x20/0x20 [ 97.937672] ret_from_fork+0x22/0x30 [ 97.937676] </TASK> v2. fixed "warning: variable 'aq_vec' set but not used" v3. simplified a for loop Fixes: 97bde5c4f909 ("net: ethernet: aquantia: Support for NIC-specific code") Signed-off-by: Chia-Lin Kao (AceLan) <acelan.kao(a)canonical.com> Acked-by: Sudarsana Reddy Kalluru <skalluru(a)marvell.com> Link: https://lore.kernel.org/r/20220808081845.42005-1-acelan.kao@canonical.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/aquantia/atlantic/aq_nic.c [conflicts due to not merge 04a1839950d9 ("net: aquantia: implement data PTP datapath"), conflicts due to not merge 4272ba8b11f8 ("net: atlantic: per-TC queue statistics")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- .../net/ethernet/aquantia/atlantic/aq_nic.c | 22 ++++++++----------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c index 8cc34b0bedc3..a29a4f804448 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c @@ -181,12 +181,10 @@ static void aq_nic_service_timer_cb(struct timer_list *t) static void aq_nic_polling_timer_cb(struct timer_list *t) { struct aq_nic_s *self = from_timer(self, t, polling_timer); - struct aq_vec_s *aq_vec = NULL; unsigned int i = 0U; - for (i = 0U, aq_vec = self->aq_vec[0]; - self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) - aq_vec_isr(i, (void *)aq_vec); + for (i = 0U; self->aq_vecs > i; ++i) + aq_vec_isr(i, (void *)self->aq_vec[i]); mod_timer(&self->polling_timer, jiffies + AQ_CFG_POLLING_TIMER_INTERVAL); @@ -643,7 +641,6 @@ void aq_nic_get_stats(struct aq_nic_s *self, u64 *data) { unsigned int i = 0U; unsigned int count = 0U; - struct aq_vec_s *aq_vec = NULL; struct aq_stats_s *stats = self->aq_hw_ops->hw_get_hw_stats(self->aq_hw); if (!stats) @@ -676,10 +673,11 @@ void aq_nic_get_stats(struct aq_nic_s *self, u64 *data) data += i; - for (i = 0U, aq_vec = self->aq_vec[0]; - aq_vec && self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) { + for (i = 0U; self->aq_vecs > i; ++i) { + if (!self->aq_vec[i]) + break; data += count; - aq_vec_get_sw_stats(aq_vec, data, &count); + aq_vec_get_sw_stats(self->aq_vec[i], data, &count); } err_exit:; @@ -855,7 +853,6 @@ u32 aq_nic_get_fw_version(struct aq_nic_s *self) int aq_nic_stop(struct aq_nic_s *self) { - struct aq_vec_s *aq_vec = NULL; unsigned int i = 0U; netif_tx_disable(self->ndev); @@ -870,9 +867,8 @@ int aq_nic_stop(struct aq_nic_s *self) else aq_pci_func_free_irqs(self); - for (i = 0U, aq_vec = self->aq_vec[0]; - self->aq_vecs > i; ++i, aq_vec = self->aq_vec[i]) - aq_vec_stop(aq_vec); + for (i = 0U; self->aq_vecs > i; ++i) + aq_vec_stop(self->aq_vec[i]); return self->aq_hw_ops->hw_stop(self->aq_hw); } @@ -974,4 +970,4 @@ void aq_nic_shutdown(struct aq_nic_s *self) err_exit: rtnl_unlock(); -} \ No newline at end of file +} -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] Backport mainline patches
by Wang Liang 03 Jul '25

03 Jul '25

Florian Westphal (4): xfrm: pass struct net to xfrm_decode_session wrappers xfrm: move mark and oif flowi decode into common code xfrm: policy: replace session decode with flow dissector xfrm: policy: fix layer 4 flowi decoding Guillaume Nault (1): xfrm: Clear low order bits of ->flowi4_tos in decode_session4(). include/net/xfrm.h | 12 +- net/ipv4/icmp.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/netfilter.c | 2 +- net/ipv6/icmp.c | 2 +- net/ipv6/ip6_vti.c | 4 +- net/ipv6/netfilter.c | 2 +- net/netfilter/nf_nat_proto.c | 2 +- net/xfrm/xfrm_interface_core.c | 4 +- net/xfrm/xfrm_policy.c | 299 ++++++++++++++------------------- 10 files changed, 142 insertions(+), 191 deletions(-) -- 2.34.1

2 6

[openeuler:OLK-5.10 2999/2999] arch/x86/kernel/cpu/resctrl/rdtgroup.c:1504:13: warning: variable 'h' set but not used
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 63325b01e46c2933270cf6bdc0c0e859b664d6fe commit: 540e1ae2f7aca5a427a52f12bef657b1e3e81fc1 [2999/2999] x86/resctrl: Add interface to read mbm_total_bytes_config config: x86_64-buildonly-randconfig-2003-20250702 (https://download.01.org/0day-ci/archive/20250703/202507030942.l6gjiDwl-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030942.l6gjiDwl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030942.l6gjiDwl-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/cpu/resctrl/rdtgroup.c: In function 'rdt_last_cmd_printf': arch/x86/kernel/cpu/resctrl/rdtgroup.c:74:9: warning: function 'rdt_last_cmd_printf' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 74 | seq_buf_vprintf(&last_cmd_status, fmt, ap); | ^~~~~~~~~~~~~~~ arch/x86/kernel/cpu/resctrl/rdtgroup.c: In function 'mon_event_config_read': >> arch/x86/kernel/cpu/resctrl/rdtgroup.c:1504:13: warning: variable 'h' set but not used [-Wunused-but-set-variable] 1504 | u32 h; | ^ vim +/h +1504 arch/x86/kernel/cpu/resctrl/rdtgroup.c 1499 1500 static void mon_event_config_read(void *info) 1501 { 1502 struct mon_config_info *mon_info = info; 1503 unsigned int index; > 1504 u32 h; 1505 1506 index = mon_event_config_index_get(mon_info->evtid); 1507 if (index == INVALID_CONFIG_INDEX) { 1508 pr_warn_once("Invalid event id %d\n", mon_info->evtid); 1509 return; 1510 } 1511 rdmsr(MSR_IA32_EVT_CFG_BASE + index, mon_info->mon_config, h); 1512 1513 /* Report only the valid event configuration bits */ 1514 mon_info->mon_config &= MAX_EVT_CONFIG_BITS; 1515 } 1516 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] nfs: handle failure of nfs_get_lock_context in unlock path
by Li Lingfeng 03 Jul '25

03 Jul '25

mainline inclusion from mainline-v6.15-rc7 commit c457dc1ec770a22636b473ce5d35614adfe97636 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAL9 CVE: CVE-2025-38023 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM) as valid and proceed to execute rpc_run_task(), this will trigger a NULL pointer dereference in nfs4_locku_prepare. For example: BUG: kernel NULL pointer dereference, address: 000000000000000c PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 Workqueue: rpciod rpc_async_schedule RIP: 0010:nfs4_locku_prepare+0x35/0xc2 Code: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3 RSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246 RAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: fffffffffffffff4 RDI: ffff9ba53fddbf40 RBP: ffff9ba539934000 R08: 0000000000000000 R09: ffffbbafc006bc38 R10: ffffffffb6b689c8 R11: 0000000000000003 R12: ffff9ba539934030 R13: 0000000000000001 R14: 0000000004248060 R15: ffffffffb56d1c30 FS: 0000000000000000(0000) GS:ffff9ba5881f0000(0000) knlGS:00000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 000000093f244000 CR4: 00000000000006f0 Call Trace: <TASK> __rpc_execute+0xbc/0x480 rpc_async_schedule+0x2f/0x40 process_one_work+0x232/0x5d0 worker_thread+0x1da/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x10d/0x240 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: CR2: 000000000000000c ---[ end trace 0000000000000000 ]--- Free the allocated nfs4_unlockdata when nfs_get_lock_context() fails and return NULL to terminate subsequent rpc_run_task, preventing NULL pointer dereference. Fixes: f30cb757f680 ("NFS: Always wait for I/O completion before unlock") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Link: https://lore.kernel.org/r/20250417072508.3850532-1-lilingfeng3@huawei.com Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/nfs/nfs4proc.c [Commit 32c6e7eee399 ("NFSv4: Handle NFS4ERR_OLD_STATEID in LOCKU") added a local variable state; commit 7b587e1a5a6c ("NFS: use locks_copy_lock() to copy locks.") initialized lock with locks_init_lock and locks_copy_lock instead of memcpy.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 282e5559b176..6d47a1922a1b 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6415,10 +6415,18 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, { struct nfs4_unlockdata *p; struct inode *inode = lsp->ls_state->inode; + struct nfs_lock_context *l_ctx; p = kzalloc(sizeof(*p), GFP_NOFS); if (p == NULL) return NULL; + l_ctx = nfs_get_lock_context(ctx); + if (!IS_ERR(l_ctx)) { + p->l_ctx = l_ctx; + } else { + kfree(p); + return NULL; + } p->arg.fh = NFS_FH(inode); p->arg.fl = &p->fl; p->arg.seqid = seqid; @@ -6427,7 +6435,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, refcount_inc(&lsp->ls_count); /* Ensure we don't close file until we're done freeing locks! */ p->ctx = get_nfs_open_context(ctx); - p->l_ctx = nfs_get_lock_context(ctx); memcpy(&p->fl, fl, sizeof(p->fl)); p->server = NFS_SERVER(inode); return p; -- 2.31.1

2 1

[PATCH OLK-5.10 0/4] Backport mainline patches
by Wang Liang 03 Jul '25

03 Jul '25

Eric Dumazet (2): net: add more sanity check in virtio_net_hdr_to_skb() net: test for not too small csum_start in virtio_net_hdr_to_skb() Wang Liang (2): net: fix crash when config small gso_max_size/gso_ipv4_max_size net: virtio: Fix kabi broken include/linux/virtio_net.h | 13 +++++++++++-- net/core/rtnetlink.c | 2 +- 2 files changed, 12 insertions(+), 3 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 03 Jul '25

03 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-50228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] arch/x86/mm/maccess.o: warning: objtool: missing symbol for section .text
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: 22058d2bdaf6b0526395ceec2736c72c3b5f435a [1605/1605] uaccess: Add strict non-pagefault kernel-space read function config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030925.ESXy0WXt-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030925.ESXy0WXt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030925.ESXy0WXt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/mm/maccess.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net: fix slab-use-after-free read in decode_session6
by Wang Liang 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRT1V CVE: NA ------------------ The skb->cb may be modified in qdisc enqueue() functions, like fq_enqueue and sfb_enqueue. So the cb field should not be visited as IP6CB() after qdisc dequeue(). However, decode_session6() visit IP6CB(skb). If qdisc enqueue() modify the cb field, IP6CB(skb)->nhoff may be also modified, which may trigger a KASAN issue. The stack information is as follows: dump_backtrace+0x12c/0x220 arch/arm64/kernel/stacktrace.c:233 show_stack+0x34/0x50 arch/arm64/kernel/stacktrace.c:240 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x80/0x118 lib/dump_stack.c:106 print_address_description.constprop.0+0x84/0x3c8 mm/kasan/report.c:364 print_report+0xb0/0x280 mm/kasan/report.c:475 kasan_report+0x84/0xd0 mm/kasan/report.c:588 __asan_report_load1_noabort+0x20/0x30 mm/kasan/report_generic.c:378 decode_session6+0xf74/0x1198 net/xfrm/xfrm_policy.c:3491 __xfrm_decode_session+0x78/0xf8 net/xfrm/xfrm_policy.c:3597 xfrm_decode_session_reverse include/net/xfrm.h:1257 [inline] icmpv6_route_lookup+0x30c/0x498 net/ipv6/icmp.c:392 icmp6_send+0x94c/0x1af8 net/ipv6/icmp.c:601 __icmpv6_send include/linux/icmpv6.h:28 [inline] icmpv6_send include/linux/icmpv6.h:49 [inline] ip6_link_failure+0x3c/0x1b0 net/ipv6/route.c:2791 dst_link_failure include/net/dst.h:447 [inline] ip6_tnl_xmit+0x3cc/0x2778 net/ipv6/ip6_tunnel.c:1283 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1399 [inline] ip6_tnl_start_xmit+0x774/0x1138 net/ipv6/ip6_tunnel.c:1447 __netdev_start_xmit include/linux/netdevice.h:4965 [inline] netdev_start_xmit include/linux/netdevice.h:4979 [inline] xmit_one.constprop.0+0x114/0x3c0 net/core/dev.c:3580 dev_hard_start_xmit+0xb0/0x180 net/core/dev.c:3596 sch_direct_xmit+0x17c/0x1088 net/sched/sch_generic.c:342 qdisc_restart net/sched/sch_generic.c:407 [inline] __qdisc_run+0x1a4/0x358 net/sched/sch_generic.c:415 __dev_xmit_skb net/core/dev.c:3886 [inline] __dev_queue_xmit+0x156c/0x3380 net/core/dev.c:4358 dev_queue_xmit include/linux/netdevice.h:3146 [inline] neigh_connected_output+0x2e8/0x3e0 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:553 [inline] ip6_finish_output2+0xb58/0x17b0 net/ipv6/ip6_output.c:141 ip6_fragment+0x1778/0x1d70 net/ipv6/ip6_output.c:962 __ip6_finish_output+0x61c/0x9f0 net/ipv6/ip6_output.c:206 ip6_finish_output+0x48/0x2d8 net/ipv6/ip6_output.c:219 NF_HOOK_COND include/linux/netfilter.h:297 [inline] ip6_output+0x1cc/0x3a0 net/ipv6/ip6_output.c:240 dst_output include/net/dst.h:468 [inline] ip6_local_out+0xa4/0xe0 net/ipv6/output_core.c:155 ip6_send_skb+0x88/0x1f0 net/ipv6/ip6_output.c:2038 udp_v6_send_skb+0xa7c/0x10b8 net/ipv6/udp.c:1295 udpv6_sendmsg+0x1b04/0x2320 net/ipv6/udp.c:1591 inet6_sendmsg+0xb0/0x110 net/ipv6/af_inet6.c:657 sock_sendmsg_nosec net/socket.c:734 [inline] __sock_sendmsg net/socket.c:749 [inline] __sock_sendmsg+0xc8/0x190 net/socket.c:744 sock_sendmsg+0x120/0x210 net/socket.c:772 splice_to_socket+0x8d8/0xc88 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0x100/0x1a0 fs/splice.c:1142 splice_direct_to_actor+0x300/0x898 fs/splice.c:1088 do_splice_direct+0x190/0x268 fs/splice.c:1194 do_sendfile+0xa50/0xf50 fs/read_write.c:1256 __do_sys_sendfile64 fs/read_write.c:1324 [inline] __se_sys_sendfile64+0x2e4/0x3a0 fs/read_write.c:1310 __arm64_sys_sendfile64+0x94/0xe0 fs/read_write.c:1310 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:134 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:176 el0_svc+0x44/0x1d8 arch/arm64/kernel/entry-common.c:806 el0t_64_sync_handler+0x100/0x130 arch/arm64/kernel/entry-common.c:844 el0t_64_sync+0x188/0x190 arch/arm64/kernel/entry.S:757 Therefore, set the cb field in the skb to 0 before xfrm decode process. Fixes: e5d25a90886d ("[IPV6] XFRM: Fix decoding session with preceding extension header(s).") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index d1f819238414..dc8d7ed637ef 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1227,6 +1227,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, t->err_time + IP6TUNNEL_ERR_TIMEO)) { t->err_count--; + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); dst_link_failure(skb); } else { t->err_count = 0; @@ -1302,6 +1303,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, return 0; tx_err_link_failure: stats->tx_carrier_errors++; + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); dst_link_failure(skb); tx_err_dst_release: dst_release(dst); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] drm/amd/display: clear optc underflow before turn off odm clock
by Lin Ruifeng 03 Jul '25

03 Jul '25

From: Fudong Wang <Fudong.Wang(a)amd.com> stable inclusion from stable-v4.19.257 commit 443687798d6f094412b7312b64b3bb4d99aedff7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9B8 CVE: CVE-2022-49969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b2a93490201300a749ad261b5c5d05cb50179c44 ] [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock off. [How] Clear that if have when clock off. Reviewed-by: Alvin Lee <alvin.lee2(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Fudong Wang <Fudong.Wang(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c index 411f89218e01..cb5c44b339e0 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c @@ -452,6 +452,11 @@ void optc1_enable_optc_clock(struct timing_generator *optc, bool enable) OTG_CLOCK_ON, 1, 1, 1000); } else { + + //last chance to clear underflow, otherwise, it will always there due to clock is off. + if (optc->funcs->is_optc_underflow_occurred(optc) == true) + optc->funcs->clear_optc_underflow(optc); + REG_UPDATE_2(OTG_CLOCK_CONTROL, OTG_CLOCK_GATE_DIS, 0, OTG_CLOCK_EN, 0); -- 2.22.0

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] net/ipv4/arp.c:1106:5: warning: comparison of distinct pointer types ('typeof (dev->addr_len) *' (aka 'unsigned char *') and 'typeof (sizeof (r->arp_ha.sa_data)) *' (aka 'unsigned long *'))
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: 7ad207616673722d5cf52c18d9464e0d3184ffc9 [1605/1605] arp: Prevent overflow in arp_req_get(). config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030748.cQODcYRb-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030748.cQODcYRb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030748.cQODcYRb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/ipv4/arp.c:1106:5: warning: comparison of distinct pointer types ('typeof (dev->addr_len) *' (aka 'unsigned char *') and 'typeof (sizeof (r->arp_ha.sa_data)) *' (aka 'unsigned long *')) [-Wcompare-distinct-pointer-types] 1106 | min(dev->addr_len, sizeof(r->arp_ha.sa_data))); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:884:19: note: expanded from macro 'min' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:875:24: note: expanded from macro '__careful_cmp' 875 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~~~~~~~ include/linux/kernel.h:865:4: note: expanded from macro '__safe_cmp' 865 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~~~~~~~ include/linux/kernel.h:851:29: note: expanded from macro '__typecheck' 851 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ 1 warning generated. net/ipv4/arp.o: warning: objtool: missing symbol for section .init.text vim +1106 net/ipv4/arp.c 1090 1091 /* 1092 * Get an ARP cache entry. 1093 */ 1094 1095 static int arp_req_get(struct arpreq *r, struct net_device *dev) 1096 { 1097 __be32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr; 1098 struct neighbour *neigh; 1099 int err = -ENXIO; 1100 1101 neigh = neigh_lookup(&arp_tbl, &ip, dev); 1102 if (neigh) { 1103 if (!(neigh->nud_state & NUD_NOARP)) { 1104 read_lock_bh(&neigh->lock); 1105 memcpy(r->arp_ha.sa_data, neigh->ha, > 1106 min(dev->addr_len, sizeof(r->arp_ha.sa_data))); 1107 r->arp_flags = arp_state_to_flags(neigh); 1108 read_unlock_bh(&neigh->lock); 1109 r->arp_ha.sa_family = dev->type; 1110 strlcpy(r->arp_dev, dev->name, sizeof(r->arp_dev)); 1111 err = 0; 1112 } 1113 neigh_release(neigh); 1114 } 1115 return err; 1116 } 1117 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0