- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 00/10] EEVDF null pointer
by Zicheng Qu 19 Dec '25

19 Dec '25

Fernand Sieber (1): sched/fair: Forfeit vruntime on yield Ingo Molnar (1): sched/balancing: Change comment formatting to not overlap Git conflict marker lines Peter Zijlstra (4): sched/fair: Avoid re-setting virtual deadline on 'migrations' sched/eevdf: Remove min_vruntime_copy sched/core: Add comment explaining force-idle vruntime snapshots sched/eevdf: Fix min_vruntime vs avg_vruntime Zicheng Qu (4): sched: Fix kabi breakage of struct sched_entity for on_rq and rel_deadline sched: Fix kabi breakage of struct cfs_rq for min_vruntime_copy Revert "sched/fair: Only increment deadline once on yield" sched: Fix kabi breakage of struct cfs_rq for zero_vruntime include/linux/sched.h | 4 +- kernel/sched/debug.c | 8 +- kernel/sched/fair.c | 277 ++++++++++++++++++++++++++++++---------- kernel/sched/features.h | 4 + kernel/sched/sched.h | 6 +- 5 files changed, 223 insertions(+), 76 deletions(-) -- 2.34.1

2 11

[PATCH v2 OLK-6.6] ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
by Yihang Li 19 Dec '25

19 Dec '25

mainline inclusion from v6.18-rc1 commit b32cc17d607e8ae7af037303fe101368cb4dc44c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDC4FS CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------------------------------------------------------- Call scsi_device_put() in ata_scsi_dev_rescan() if the device or its queue are not running. Fixes: 0c76106cb975 ("scsi: sd: Fix TCG OPAL unlock on system resume") Cc: stable(a)vger.kernel.org Signed-off-by: Yihang Li <liyihang9(a)h-partners.com> Reviewed-by: Damien Le Moal <dlemoal(a)kernel.org> Signed-off-by: Niklas Cassel <cassel(a)kernel.org> --- drivers/ata/libata-scsi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c index b43a3196e2be..3fb84f690644 100644 --- a/drivers/ata/libata-scsi.c +++ b/drivers/ata/libata-scsi.c @@ -4894,8 +4894,10 @@ void ata_scsi_dev_rescan(struct work_struct *work) spin_unlock_irqrestore(ap->lock, flags); if (do_resume) { ret = scsi_resume_device(sdev); - if (ret == -EWOULDBLOCK) + if (ret == -EWOULDBLOCK) { + scsi_device_put(sdev); goto unlock_scan; + } dev->flags &= ~ATA_DFLAG_RESUMING; } ret = scsi_rescan_device(sdev); -- 2.33.0

2 1

[PATCH OLK-6.6 00/10] EEVDF null pointer
by Zicheng Qu 19 Dec '25

19 Dec '25

Fernand Sieber (1): sched/fair: Forfeit vruntime on yield Ingo Molnar (1): sched/balancing: Change comment formatting to not overlap Git conflict marker lines Peter Zijlstra (4): sched/fair: Avoid re-setting virtual deadline on 'migrations' sched/eevdf: Remove min_vruntime_copy sched/core: Add comment explaining force-idle vruntime snapshots sched/eevdf: Fix min_vruntime vs avg_vruntime Zicheng Qu (4): sched: Fix kabi breakage of struct sched_entity for on_rq and rel_deadline sched: Fix kabi breakage of struct cfs_rq for min_vruntime_copy Revert "sched/fair: Only increment deadline once on yield" sched: Fix kabi breakage of struct cfs_rq for zero_vruntime include/linux/sched.h | 4 +- kernel/sched/debug.c | 8 +- kernel/sched/fair.c | 277 ++++++++++++++++++++++++++++++---------- kernel/sched/features.h | 4 + kernel/sched/sched.h | 6 +- 5 files changed, 223 insertions(+), 76 deletions(-) -- 2.34.1

2 11

[PATCH OLK-6.6] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
by Long Li 19 Dec '25

19 Dec '25

From: Albin Babu Varghese <albinbabuvarghese20(a)gmail.com> stable inclusion from stable-v6.6.116 commit 86df8ade88d290725554cefd03101ecd0fbd3752 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBACC CVE: CVE-2025-40304 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ] Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes. Reported-by: syzbot+48b0652a95834717f190(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 Suggested-by: Helge Deller <deller(a)gmx.de> Tested-by: syzbot+48b0652a95834717f190(a)syzkaller.appspotmail.com Signed-off-by: Albin Babu Varghese <albinbabuvarghese20(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c index 43639f045269..70d27f950e10 100644 --- a/drivers/video/fbdev/core/bitblit.c +++ b/drivers/video/fbdev/core/bitblit.c @@ -169,6 +169,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, image.height = vc->vc_font.height; image.depth = 1; + if (image.dy >= info->var.yres) + return; + + image.height = min(image.height, info->var.yres - image.dy); + if (attribute) { buf = kmalloc(cellsize, GFP_ATOMIC); if (!buf) @@ -182,6 +187,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, cnt = count; image.width = vc->vc_font.width * cnt; + + if (image.dx >= info->var.xres) + break; + + if (image.dx + image.width > info->var.xres) { + image.width = info->var.xres - image.dx; + cnt = image.width / vc->vc_font.width; + if (cnt == 0) + break; + image.width = cnt * vc->vc_font.width; + } + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; pitch &= ~scan_align; size = pitch * image.height + buf_align; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
by Long Li 19 Dec '25

19 Dec '25

From: Albin Babu Varghese <albinbabuvarghese20(a)gmail.com> mainline inclusion from mainline-v6.17-rc7 commit 3637d34b35b287ab830e66048841ace404382b67 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBACC CVE: CVE-2025-40304 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add bounds checking to prevent writes past framebuffer boundaries when rendering text near screen edges. Return early if the Y position is off-screen and clip image height to screen boundary. Break from the rendering loop if the X position is off-screen. When clipping image width to fit the screen, update the character count to match the clipped width to prevent buffer size mismatches. Without the character count update, bit_putcs_aligned and bit_putcs_unaligned receive mismatched parameters where the buffer is allocated for the clipped width but cnt reflects the original larger count, causing out-of-bounds writes. Reported-by: syzbot+48b0652a95834717f190(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190 Suggested-by: Helge Deller <deller(a)gmx.de> Tested-by: syzbot+48b0652a95834717f190(a)syzkaller.appspotmail.com Signed-off-by: Albin Babu Varghese <albinbabuvarghese20(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c index 8f59206321e0..2ce1e7729569 100644 --- a/drivers/video/fbdev/core/bitblit.c +++ b/drivers/video/fbdev/core/bitblit.c @@ -169,6 +169,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, image.height = vc->vc_font.height; image.depth = 1; + if (image.dy >= info->var.yres) + return; + + image.height = min(image.height, info->var.yres - image.dy); + if (attribute) { buf = kmalloc(cellsize, GFP_ATOMIC); if (!buf) @@ -182,6 +187,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, cnt = count; image.width = vc->vc_font.width * cnt; + + if (image.dx >= info->var.xres) + break; + + if (image.dx + image.width > info->var.xres) { + image.width = info->var.xres - image.dx; + cnt = image.width / vc->vc_font.width; + if (cnt == 0) + break; + image.width = cnt * vc->vc_font.width; + } + pitch = DIV_ROUND_UP(image.width, 8) + scan_align; pitch &= ~scan_align; size = pitch * image.height + buf_align; -- 2.39.2

2 1

[PATCH OLK-5.10] net: atlantic: fix fragment overflow handling in RX path
by Fanhua Li 19 Dec '25

19 Dec '25

From: Jiefeng Zhang <jiefeng.z.zhang(a)gmail.com> stable inclusion from stable-v5.10.247 commit 34147477eeab24077fcfe9649e282849347d760c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDDF5H CVE: CVE-2025-68301 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ffcb7b890f61541201461580bb6622ace405aec ] The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This causes an out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic. The issue occurs because the driver doesn't check the total number of fragments before calling skb_add_rx_frag(). When a packet requires more than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds. Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. And reusing the existing check to prevent the overflow earlier in the code path. This crash occurred in production with an Aquantia AQC113 10G NIC. Stack trace from production environment: ``` RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89 ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90 c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48 89 fa 83 RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287 RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX: fffffffe0a0c8000 RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI: 0000000000037a40 RBP: 0000000000000024 R08: 0000000000000000 R09: 0000000000000021 R10: 0000000000000848 R11: 0000000000000000 R12: ffffa9bec02a8e24 R13: ffff925ad8615570 R14: 0000000000000000 R15: ffff925b22e80a00 FS: 0000000000000000(0000) GS:ffff925e47880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4: 0000000000f72ef0 PKRU: 55555554 Call Trace: <IRQ> aq_ring_rx_clean+0x175/0xe60 [atlantic] ? aq_ring_rx_clean+0x14d/0xe60 [atlantic] ? aq_ring_tx_clean+0xdf/0x190 [atlantic] ? kmem_cache_free+0x348/0x450 ? aq_vec_poll+0x81/0x1d0 [atlantic] ? __napi_poll+0x28/0x1c0 ? net_rx_action+0x337/0x420 ``` Fixes: 6aecbba12b5c ("net: atlantic: add check for MAX_SKB_FRAGS") Changes in v4: - Add Fixes: tag to satisfy patch validation requirements. Changes in v3: - Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE, then all fragments are accounted for. Signed-off-by: Jiefeng Zhang <jiefeng.z.zhang(a)gmail.com> Link: https://patch.msgid.link/20251126032249.69358-1-jiefeng.z.zhang@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c index a50f40eea778..10209a1ed2ea 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c @@ -334,6 +334,11 @@ int aq_ring_rx_clean(struct aq_ring_s *self, if (!buff->is_eop) { unsigned int frag_cnt = 0U; + + /* There will be an extra fragment */ + if (buff->len > AQ_CFG_RX_HDR_SIZE) + frag_cnt++; + buff_ = buff; do { bool is_rsc_completed = true; -- 2.43.0

2 1

[openeuler:openEuler-1.0-LTS 1944/1944] drivers/net/bonding/bond_sysctl.o: warning: objtool: missing symbol for section .text
by kernel test robot 19 Dec '25

19 Dec '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4e9c55920995d70b3e88b60c69753df54b03fdf4 commit: 0397c33121652647d544d4bcdceb9f2d868146af [1944/1944] anolis: bond: broadcast ARP or ND messages to all slaves config: x86_64-buildonly-randconfig-006-20251216 (https://download.01.org/0day-ci/archive/20251219/202512190947.4c8UaXQD-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 1335a05ab8bc8339ce24be3a9da89d8c3f4e0571) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251219/202512190947.4c8UaXQD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512190947.4c8UaXQD-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/bonding/bond_sysctl.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1944/1944] arch/x86/kernel/unwind_orc.o: warning: objtool: missing symbol for section .text
by kernel test robot 19 Dec '25

19 Dec '25

Hi Shile, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4e9c55920995d70b3e88b60c69753df54b03fdf4 commit: badd79c400ed404df871e1d035bed971d20ead4c [1944/1944] x86/unwind/orc: Remove boot-time ORC unwind tables sorting config: x86_64-buildonly-randconfig-006-20251216 (https://download.01.org/0day-ci/archive/20251219/202512190624.AbYfKuZU-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 1335a05ab8bc8339ce24be3a9da89d8c3f4e0571) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251219/202512190624.AbYfKuZU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512190624.AbYfKuZU-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/unwind_orc.c:179:13: warning: unused function 'orc_sort_swap' [-Wunused-function] 179 | static void orc_sort_swap(void *_a, void *_b, int size) | ^~~~~~~~~~~~~ arch/x86/kernel/unwind_orc.c:199:12: warning: unused function 'orc_sort_cmp' [-Wunused-function] 199 | static int orc_sort_cmp(const void *_a, const void *_b) | ^~~~~~~~~~~~ 2 warnings generated. >> arch/x86/kernel/unwind_orc.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1946/1946] drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:53:32: error: 'struct pci_dev' has no member named 'physfn'; did you mean 'is_physfn'?
by kernel test robot 19 Dec '25

19 Dec '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4e9c55920995d70b3e88b60c69753df54b03fdf4 commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [1946/1946] Net: ethernet: Support 3snic 3s9xx network card config: arm64-randconfig-r062-20251218 (https://download.01.org/0day-ci/archive/20251219/202512190528.ut6FEno8-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251219/202512190528.ut6FEno8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512190528.ut6FEno8-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c: In function 'sss_get_vf_load_state': >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:53:32: error: 'struct pci_dev' has no member named 'physfn'; did you mean 'is_physfn'? 53 | dev = pdev->is_virtfn ? pdev->physfn : pdev; | ^~~~~~ | is_physfn drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c: At top level: drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:276:5: error: no previous prototype for 'sss_attach_uld_driver' [-Werror=missing-prototypes] 276 | int sss_attach_uld_driver(struct sss_pci_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c: In function 'sss_get_vf_service_load': drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:319:39: error: 'struct pci_dev' has no member named 'physfn'; did you mean 'is_physfn'? 319 | dev = (pdev->is_virtfn != 0) ? pdev->physfn : pdev; | ^~~~~~ | is_physfn drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c: At top level: drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c:548:5: error: no previous prototype for 'sss_pci_probe' [-Werror=missing-prototypes] 548 | int sss_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) | ^~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:40:13: error: 'sss_deinit_vf_hw' defined but not used [-Werror=unused-function] 40 | static void sss_deinit_vf_hw(void *hwdev, u16 vf_num) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/hw/sss_pci_sriov.c:18:12: error: 'sss_init_vf_hw' defined but not used [-Werror=unused-function] 18 | static int sss_init_vf_hw(void *hwdev, u16 vf_num) | ^~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- drivers/net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.c: In function 'sss_get_pci_bus_id': >> drivers/net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.c:234:30: error: 'struct pci_dev' has no member named 'physfn'; did you mean 'is_physfn'? 234 | pf_pdev = adapter->pcidev->physfn; | ^~~~~~ | is_physfn -- drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c: In function 'sss_nic_get_vlan_depth': >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:14: error: implicit declaration of function 'vlan_dev_priv'; did you mean 'netdev_priv'? [-Werror=implicit-function-declaration] 165 | vlan_dev = vlan_dev_priv(vlan_dev)->real_dev; | ^~~~~~~~~~~~~ | netdev_priv >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:165:37: error: invalid type argument of '->' (have 'int') 165 | vlan_dev = vlan_dev_priv(vlan_dev)->real_dev; | ^~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c: At top level: drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:878:6: error: no previous prototype for 'sss_nic_port_module_cable_plug' [-Werror=missing-prototypes] 878 | void sss_nic_port_module_cable_plug(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:884:6: error: no previous prototype for 'sss_nic_port_module_cable_unplug' [-Werror=missing-prototypes] 884 | void sss_nic_port_module_cable_unplug(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:890:6: error: no previous prototype for 'sss_nic_port_module_link_err' [-Werror=missing-prototypes] 890 | void sss_nic_port_module_link_err(struct sss_nic_dev *nic_dev, void *event_data) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_main.c:1029:22: error: no previous prototype for 'get_nic_uld_info' [-Werror=missing-prototypes] 1029 | struct sss_uld_info *get_nic_uld_info(void) | ^~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors cocci warnings: (new ones prefixed by >>) >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwif_ctrlq_export.c:99:5-24: WARNING: atomic_dec_and_test variation before object free at line 103. -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_adapter_mgmt.c:210:7-16: ERROR: iterator variable bound on line 209 cannot be NULL -- >> drivers/net/ethernet/3snic/sssnic/hw/tool/sss_tool_chip.c:700:8-15: WARNING opportunity for memdup_user -- >> drivers/net/ethernet/3snic/sssnic/hw/sss_hwdev_link.c:620:30-68: WARNING avoid newline at end of message in NL_SET_ERR_MSG_MOD -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops_api.c:1006:7-43: WARNING avoid newline at end of message in NL_SET_ERR_MSG_MOD -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool.c:284:5-25: opportunity for str_on_off(pauseparam -> rx_pause) >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool.c:284:42-62: opportunity for str_on_off(pauseparam -> tx_pause) -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:456:5-17: opportunity for str_enable_disable(set_spoofchk) drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops.c:462:5-17: opportunity for str_enable_disable(set_spoofchk) -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_netdev_ops_api.c:419:6-16: opportunity for str_up_down(link_state) -- >> drivers/net/ethernet/3snic/sssnic/nic/tool/sss_tool_nic_phy_attr.c:132:5-16: opportunity for str_up_down(link_status) -- >> drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:589:6-9: ERROR: invalid reference to the index variable of the iterator on line 583 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:589:13-16: ERROR: invalid reference to the index variable of the iterator on line 583 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:459:6-9: ERROR: invalid reference to the index variable of the iterator on line 453 drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ntuple.c:459:13-16: ERROR: invalid reference to the index variable of the iterator on line 453 vim +53 drivers/net/ethernet/3snic/sssnic/hw/sss_pci_probe.c 33 34 #define SSS_CHECK_EVENT_INFO(event) \ 35 ((event)->service == SSS_EVENT_SRV_COMM && \ 36 (event)->type == SSS_EVENT_FAULT) 37 38 #define SSS_CHECK_FAULT_EVENT_INFO(hwdev, fault_event) \ 39 ((fault_event)->fault_level == SSS_FAULT_LEVEL_SERIOUS_FLR && \ 40 (fault_event)->info.chip.func_id < sss_get_max_pf_num(hwdev)) 41 42 #define SSS_GET_CFG_REG_BAR(pdev) (SSS_IS_VF_DEV(pdev) ? \ 43 SSS_VF_PCI_CFG_REG_BAR : SSS_PF_PCI_CFG_REG_BAR) 44 45 static bool sss_get_vf_load_state(struct pci_dev *pdev) 46 { 47 struct sss_pci_adapter *adapter = NULL; 48 struct pci_dev *dev = NULL; 49 50 if (pci_is_root_bus(pdev->bus)) 51 return false; 52 > 53 dev = pdev->is_virtfn ? pdev->physfn : pdev; 54 adapter = pci_get_drvdata(dev); 55 56 if (!adapter) { 57 sdk_err(&pdev->dev, "Invalid adapter, is null.\n"); 58 return false; 59 } 60 61 return true; 62 } 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked()
by Xinyu Zheng 18 Dec '25

18 Dec '25

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.12.58 commit 35f3fb86bb0158a298d6834e7e110dcaf07f490c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDDEV5 CVE: CVE-2025-68190 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit cc9a8e238e42c1f43b98c097995137d644b69245 ] kcalloc() may fail. When WS is non-zero and allocation fails, ectx.ws remains NULL while ectx.ws_size is set, leading to a potential NULL pointer dereference in atom_get_src_int() when accessing WS entries. Return -ENOMEM on allocation failure to avoid the NULL dereference. Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/amdgpu/atom.c [context conflict] Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/atom.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c index 4cfc786699c7..b3acfc943184 100644 --- a/drivers/gpu/drm/amd/amdgpu/atom.c +++ b/drivers/gpu/drm/amd/amdgpu/atom.c @@ -1225,10 +1225,15 @@ static int amdgpu_atom_execute_table_locked(struct atom_context *ctx, int index, ectx.ps = params; ectx.abort = false; ectx.last_jump = 0; - if (ws) + if (ws) { ectx.ws = kcalloc(4, ws, GFP_KERNEL); - else + if (!ectx.ws) { + ret = -ENOMEM; + goto free; + } + } else { ectx.ws = NULL; + } debug_depth++; while (1) { -- 2.34.1

2 1