- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2195/2195] net/ipv4/tcp_output.c:1312:5: warning: variable 'tcp_hdr_rsrvd_4b' set but not used
by kernel test robot 26 Jun '25

26 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c02455c4cce8052f74fc11c09e9073c01c7f33a4 commit: abe6bde15def9470fe18af30626e62d51f651dd9 [2195/2195] net: tcp: Modify codes for better compatibility of code format config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250626/202506261849.UT7jUs6l-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250626/202506261849.UT7jUs6l-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506261849.UT7jUs6l-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from net/ipv4/tcp_output.c:40: In file included from include/net/tcp.h:20: In file included from include/linux/tcp.h:17: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/x86/include/asm/cacheflush.h:5: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ net/ipv4/tcp_output.c:186:3: warning: result of comparison of constant -1 with expression of type 'u8' (aka 'unsigned char') is always false [-Wtautological-constant-out-of-range-compare] 186 | NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 187 | tp->compressed_ack); | ~~~~~~~~~~~~~~~~~~~ include/net/ip.h:302:41: note: expanded from macro 'NET_ADD_STATS' 302 | #define NET_ADD_STATS(net, field, adnd) SNMP_ADD_STATS((net)->mib.net_statistics, field, adnd) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/snmp.h:143:4: note: expanded from macro 'SNMP_ADD_STATS' 143 | this_cpu_add(mib->mibs[field], addend) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/percpu-defs.h:491:33: note: expanded from macro 'this_cpu_add' 491 | #define this_cpu_add(pcp, val) __pcpu_size_call(this_cpu_add_, pcp, val) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) <scratch space>:114:1: note: expanded from here 114 | this_cpu_add_8 | ^ arch/x86/include/asm/percpu.h:370:35: note: expanded from macro 'this_cpu_add_8' 370 | #define this_cpu_add_8(pcp, val) percpu_add_op(8, volatile, (pcp), val) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/include/asm/percpu.h:127:31: note: expanded from macro 'percpu_add_op' 127 | ((val) == 1 || (val) == -1)) ? \ | ~~~~~ ^ ~~ >> net/ipv4/tcp_output.c:1312:5: warning: variable 'tcp_hdr_rsrvd_4b' set but not used [-Wunused-but-set-variable] 1312 | u8 tcp_hdr_rsrvd_4b; | ^ 3 warnings generated. vim +/tcp_hdr_rsrvd_4b +1312 net/ipv4/tcp_output.c 1286 1287 /* This routine actually transmits TCP packets queued in by 1288 * tcp_do_sendmsg(). This is used by both the initial 1289 * transmission and possible later retransmissions. 1290 * All SKB's seen here are completely headerless. It is our 1291 * job to build the TCP header, and pass the packet down to 1292 * IP so it can do the same plus pass the packet off to the 1293 * device. 1294 * 1295 * We are working here with either a clone of the original 1296 * SKB, or a fresh unique copy made by the retransmit engine. 1297 */ 1298 static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, 1299 int clone_it, gfp_t gfp_mask, u32 rcv_nxt) 1300 { 1301 const struct inet_connection_sock *icsk = inet_csk(sk); 1302 struct inet_sock *inet; 1303 struct tcp_sock *tp; 1304 struct tcp_skb_cb *tcb; 1305 struct tcp_out_options opts; 1306 unsigned int tcp_options_size, tcp_header_size; 1307 struct sk_buff *oskb = NULL; 1308 struct tcp_md5sig_key *md5; 1309 struct tcphdr *th; 1310 u64 prior_wstamp; 1311 int err; > 1312 u8 tcp_hdr_rsrvd_4b; 1313 1314 BUG_ON(!skb || !tcp_skb_pcount(skb)); 1315 tcp_hdr_rsrvd_4b = try_to_update_skb_for_caqm(sk, skb); 1316 tp = tcp_sk(sk); 1317 prior_wstamp = tp->tcp_wstamp_ns; 1318 tp->tcp_wstamp_ns = max(tp->tcp_wstamp_ns, tp->tcp_clock_cache); 1319 skb_set_delivery_time(skb, tp->tcp_wstamp_ns, true); 1320 if (clone_it) { 1321 oskb = skb; 1322 1323 tcp_skb_tsorted_save(oskb) { 1324 if (unlikely(skb_cloned(oskb))) 1325 skb = pskb_copy(oskb, gfp_mask); 1326 else 1327 skb = skb_clone(oskb, gfp_mask); 1328 } tcp_skb_tsorted_restore(oskb); 1329 1330 if (unlikely(!skb)) 1331 return -ENOBUFS; 1332 /* retransmit skbs might have a non zero value in skb->dev 1333 * because skb->dev is aliased with skb->rbnode.rb_left 1334 */ 1335 skb->dev = NULL; 1336 } 1337 1338 inet = inet_sk(sk); 1339 tcb = TCP_SKB_CB(skb); 1340 memset(&opts, 0, sizeof(opts)); 1341 1342 if (unlikely(tcb->tcp_flags & TCPHDR_SYN)) { 1343 tcp_options_size = tcp_syn_options(sk, skb, &opts, &md5); 1344 } else { 1345 tcp_options_size = tcp_established_options(sk, skb, &opts, 1346 &md5); 1347 /* Force a PSH flag on all (GSO) packets to expedite GRO flush 1348 * at receiver : This slightly improve GRO performance. 1349 * Note that we do not force the PSH flag for non GSO packets, 1350 * because they might be sent under high congestion events, 1351 * and in this case it is better to delay the delivery of 1-MSS 1352 * packets and thus the corresponding ACK packet that would 1353 * release the following packet. 1354 */ 1355 if (tcp_skb_pcount(skb) > 1) 1356 tcb->tcp_flags |= TCPHDR_PSH; 1357 } 1358 tcp_header_size = tcp_options_size + sizeof(struct tcphdr); 1359 1360 /* We set skb->ooo_okay to one if this packet can select 1361 * a different TX queue than prior packets of this flow, 1362 * to avoid self inflicted reorders. 1363 * The 'other' queue decision is based on current cpu number 1364 * if XPS is enabled, or sk->sk_txhash otherwise. 1365 * We can switch to another (and better) queue if: 1366 * 1) No packet with payload is in qdisc/device queues. 1367 * Delays in TX completion can defeat the test 1368 * even if packets were already sent. 1369 * 2) Or rtx queue is empty. 1370 * This mitigates above case if ACK packets for 1371 * all prior packets were already processed. 1372 */ 1373 skb->ooo_okay = sk_wmem_alloc_get(sk) < SKB_TRUESIZE(1) || 1374 tcp_rtx_queue_empty(sk); 1375 1376 /* If we had to use memory reserve to allocate this skb, 1377 * this might cause drops if packet is looped back : 1378 * Other socket might not have SOCK_MEMALLOC. 1379 * Packets not looped back do not care about pfmemalloc. 1380 */ 1381 skb->pfmemalloc = 0; 1382 1383 skb_push(skb, tcp_header_size); 1384 skb_reset_transport_header(skb); 1385 1386 skb_orphan(skb); 1387 skb->sk = sk; 1388 skb->destructor = skb_is_tcp_pure_ack(skb) ? __sock_wfree : tcp_wfree; 1389 refcount_add(skb->truesize, &sk->sk_wmem_alloc); 1390 1391 skb_set_dst_pending_confirm(skb, READ_ONCE(sk->sk_dst_pending_confirm)); 1392 1393 /* Build TCP header and checksum it. */ 1394 th = (struct tcphdr *)skb->data; 1395 th->source = inet->inet_sport; 1396 th->dest = inet->inet_dport; 1397 th->seq = htonl(tcb->seq); 1398 th->ack_seq = htonl(rcv_nxt); 1399 *(((__be16 *)th) + 6) = htons(((tcp_header_size >> 2) << 12) | 1400 tcb->tcp_flags); 1401 #ifdef CONFIG_ETH_CAQM 1402 if (static_branch_unlikely(&sysctl_caqm_enable)) 1403 *(((__be16 *)th) + 6) |= htons((tcp_hdr_rsrvd_4b & 0x0F) << 8); 1404 #endif 1405 1406 th->check = 0; 1407 th->urg_ptr = 0; 1408 1409 /* The urg_mode check is necessary during a below snd_una win probe */ 1410 if (unlikely(tcp_urg_mode(tp) && before(tcb->seq, tp->snd_up))) { 1411 if (before(tp->snd_up, tcb->seq + 0x10000)) { 1412 th->urg_ptr = htons(tp->snd_up - tcb->seq); 1413 th->urg = 1; 1414 } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) { 1415 th->urg_ptr = htons(0xFFFF); 1416 th->urg = 1; 1417 } 1418 } 1419 1420 skb_shinfo(skb)->gso_type = sk->sk_gso_type; 1421 if (likely(!(tcb->tcp_flags & TCPHDR_SYN))) { 1422 th->window = htons(tcp_select_window(sk)); 1423 tcp_ecn_send(sk, skb, th, tcp_header_size); 1424 } else { 1425 /* RFC1323: The window in SYN & SYN/ACK segments 1426 * is never scaled. 1427 */ 1428 th->window = htons(min(tp->rcv_wnd, 65535U)); 1429 } 1430 1431 tcp_options_write(th, tp, &opts); 1432 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2195/2195] mm/memory.c:5277:17: warning: variable 'nr_pages' set but not used
by kernel test robot 26 Jun '25

26 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c02455c4cce8052f74fc11c09e9073c01c7f33a4 commit: 3bfa35ccde9e52ca74fed047eb4d89be32dd9e5e [2195/2195] mm/numa: no task_numa_fault() call if PTE is changed config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250626/202506261637.qYfRPb91-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250626/202506261637.qYfRPb91-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506261637.qYfRPb91-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memory.c:43: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/memory.c:44: include/linux/mm_inline.h:47:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 47 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:49:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 49 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ >> mm/memory.c:5277:17: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 5277 | int flags = 0, nr_pages; | ^ 4 warnings generated. vim +/nr_pages +5277 mm/memory.c f569661eacc258 Baolin Wang 2024-05-11 5266 2b7403035459c7 Souptick Joarder 2018-08-23 5267 static vm_fault_t do_numa_page(struct vm_fault *vmf) d10e63f29488b0 Mel Gorman 2012-10-25 5268 { 82b0f8c39a3869 Jan Kara 2016-12-14 5269 struct vm_area_struct *vma = vmf->vma; d5e6c8d5790088 Kefeng Wang 2023-11-27 5270 struct folio *folio = NULL; d5e6c8d5790088 Kefeng Wang 2023-11-27 5271 int nid = NUMA_NO_NODE; 2cb37064a2b82c Baolin Wang 2024-06-22 5272 bool writable = false, ignore_writable = false; 2cb37064a2b82c Baolin Wang 2024-06-22 5273 bool pte_write_upgrade = vma_wants_manual_pte_write_upgrade(vma); 90572890d20252 Peter Zijlstra 2013-10-07 5274 int last_cpupid; cbee9f88ec1b8d Peter Zijlstra 2012-10-25 5275 int target_nid; 04a8645304500b Aneesh Kumar K.V 2019-03-05 5276 pte_t pte, old_pte; 2cb37064a2b82c Baolin Wang 2024-06-22 @5277 int flags = 0, nr_pages; d10e63f29488b0 Mel Gorman 2012-10-25 5278 d10e63f29488b0 Mel Gorman 2012-10-25 5279 /* e2491c31fb10ae John Hubbard 2024-05-25 5280 * The pte cannot be used safely until we verify, while holding the page e2491c31fb10ae John Hubbard 2024-05-25 5281 * table lock, that its contents have not changed during fault handling. d10e63f29488b0 Mel Gorman 2012-10-25 5282 */ 82b0f8c39a3869 Jan Kara 2016-12-14 5283 spin_lock(vmf->ptl); e2491c31fb10ae John Hubbard 2024-05-25 5284 /* Read the live PTE from the page tables: */ e2491c31fb10ae John Hubbard 2024-05-25 5285 old_pte = ptep_get(vmf->pte); e2491c31fb10ae John Hubbard 2024-05-25 5286 e2491c31fb10ae John Hubbard 2024-05-25 5287 if (unlikely(!pte_same(old_pte, vmf->orig_pte))) { 82b0f8c39a3869 Jan Kara 2016-12-14 5288 pte_unmap_unlock(vmf->pte, vmf->ptl); 3bfa35ccde9e52 Zi Yan 2024-08-09 5289 return 0; 4daae3b4b9e49b Mel Gorman 2012-11-02 5290 } 4daae3b4b9e49b Mel Gorman 2012-11-02 5291 04a8645304500b Aneesh Kumar K.V 2019-03-05 5292 pte = pte_modify(old_pte, vma->vm_page_prot); d10e63f29488b0 Mel Gorman 2012-10-25 5293 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5294 /* 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5295 * Detect now whether the PTE could be writable; this information 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5296 * is only valid while holding the PT lock. 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5297 */ 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5298 writable = pte_write(pte); 2cb37064a2b82c Baolin Wang 2024-06-22 5299 if (!writable && pte_write_upgrade && 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5300 can_change_pte_writable(vma, vmf->address, pte)) 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5301 writable = true; 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5302 d5e6c8d5790088 Kefeng Wang 2023-11-27 5303 folio = vm_normal_folio(vma, vmf->address, pte); d5e6c8d5790088 Kefeng Wang 2023-11-27 5304 if (!folio || folio_is_zone_device(folio)) b99a342d4f11a5 Huang Ying 2021-04-29 5305 goto out_map; d10e63f29488b0 Mel Gorman 2012-10-25 5306 6688cc05473b36 Peter Zijlstra 2013-10-07 5307 /* bea66fbd11af1c Mel Gorman 2015-03-25 5308 * Avoid grouping on RO pages in general. RO pages shouldn't hurt as bea66fbd11af1c Mel Gorman 2015-03-25 5309 * much anyway since they can be in shared cache state. This misses bea66fbd11af1c Mel Gorman 2015-03-25 5310 * the case where a mapping is writable but the process never writes bea66fbd11af1c Mel Gorman 2015-03-25 5311 * to it but pte_write gets cleared during protection updates and bea66fbd11af1c Mel Gorman 2015-03-25 5312 * pte_dirty has unpredictable behaviour between PTE scan updates, bea66fbd11af1c Mel Gorman 2015-03-25 5313 * background writeback, dirty balancing and application behaviour. bea66fbd11af1c Mel Gorman 2015-03-25 5314 */ 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5315 if (!writable) 6688cc05473b36 Peter Zijlstra 2013-10-07 5316 flags |= TNF_NO_GROUP; 6688cc05473b36 Peter Zijlstra 2013-10-07 5317 dabe1d992414a6 Rik van Riel 2013-10-07 5318 /* d5e6c8d5790088 Kefeng Wang 2023-11-27 5319 * Flag if the folio is shared between multiple address spaces. This dabe1d992414a6 Rik van Riel 2013-10-07 5320 * is later used when determining whether to group tasks together dabe1d992414a6 Rik van Riel 2013-10-07 5321 */ b8eba2d7e4a309 David Hildenbrand 2024-05-11 5322 if (folio_likely_mapped_shared(folio) && (vma->vm_flags & VM_SHARED)) dabe1d992414a6 Rik van Riel 2013-10-07 5323 flags |= TNF_SHARED; dabe1d992414a6 Rik van Riel 2013-10-07 5324 d5e6c8d5790088 Kefeng Wang 2023-11-27 5325 nid = folio_nid(folio); 2cb37064a2b82c Baolin Wang 2024-06-22 5326 nr_pages = folio_nr_pages(folio); 33024536bafd91 Huang Ying 2022-07-13 5327 /* 33024536bafd91 Huang Ying 2022-07-13 5328 * For memory tiering mode, cpupid of slow memory page is used 33024536bafd91 Huang Ying 2022-07-13 5329 * to record page access time. So use default value. 33024536bafd91 Huang Ying 2022-07-13 5330 */ 33024536bafd91 Huang Ying 2022-07-13 5331 if ((sysctl_numa_balancing_mode & NUMA_BALANCING_MEMORY_TIERING) && d5e6c8d5790088 Kefeng Wang 2023-11-27 5332 !node_is_toptier(nid)) 33024536bafd91 Huang Ying 2022-07-13 5333 last_cpupid = (-1 & LAST_CPUPID_MASK); 33024536bafd91 Huang Ying 2022-07-13 5334 else 28e1ec746768bb Kefeng Wang 2023-11-27 5335 last_cpupid = folio_last_cpupid(folio); bf7c2ab764599b Kefeng Wang 2023-11-27 5336 target_nid = numa_migrate_prep(folio, vma, vmf->address, nid, &flags); 98fa15f34cb379 Anshuman Khandual 2019-03-05 5337 if (target_nid == NUMA_NO_NODE) { d5e6c8d5790088 Kefeng Wang 2023-11-27 5338 folio_put(folio); b99a342d4f11a5 Huang Ying 2021-04-29 5339 goto out_map; 4daae3b4b9e49b Mel Gorman 2012-11-02 5340 } b99a342d4f11a5 Huang Ying 2021-04-29 5341 pte_unmap_unlock(vmf->pte, vmf->ptl); 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5342 writable = false; 2cb37064a2b82c Baolin Wang 2024-06-22 5343 ignore_writable = true; 4daae3b4b9e49b Mel Gorman 2012-11-02 5344 4daae3b4b9e49b Mel Gorman 2012-11-02 5345 /* Migrate to the requested node */ d5e6c8d5790088 Kefeng Wang 2023-11-27 5346 if (migrate_misplaced_folio(folio, vma, target_nid)) { d5e6c8d5790088 Kefeng Wang 2023-11-27 5347 nid = target_nid; 6688cc05473b36 Peter Zijlstra 2013-10-07 5348 flags |= TNF_MIGRATED; 3bfa35ccde9e52 Zi Yan 2024-08-09 5349 task_numa_fault(last_cpupid, nid, 1, flags); 3bfa35ccde9e52 Zi Yan 2024-08-09 5350 return 0; 3bfa35ccde9e52 Zi Yan 2024-08-09 5351 } 3bfa35ccde9e52 Zi Yan 2024-08-09 5352 074c238177a75f Mel Gorman 2015-03-25 5353 flags |= TNF_MIGRATE_FAIL; c7ad08804fae5b Hugh Dickins 2023-06-08 5354 vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, c7ad08804fae5b Hugh Dickins 2023-06-08 5355 vmf->address, &vmf->ptl); c7ad08804fae5b Hugh Dickins 2023-06-08 5356 if (unlikely(!vmf->pte)) 3bfa35ccde9e52 Zi Yan 2024-08-09 5357 return 0; c33c794828f212 Ryan Roberts 2023-06-12 5358 if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) { b99a342d4f11a5 Huang Ying 2021-04-29 5359 pte_unmap_unlock(vmf->pte, vmf->ptl); d10e63f29488b0 Mel Gorman 2012-10-25 5360 return 0; 3bfa35ccde9e52 Zi Yan 2024-08-09 5361 } b99a342d4f11a5 Huang Ying 2021-04-29 5362 out_map: b99a342d4f11a5 Huang Ying 2021-04-29 5363 /* b99a342d4f11a5 Huang Ying 2021-04-29 5364 * Make it present again, depending on how arch implements b99a342d4f11a5 Huang Ying 2021-04-29 5365 * non-accessible ptes, some can allow access by kernel mode. b99a342d4f11a5 Huang Ying 2021-04-29 5366 */ 2cb37064a2b82c Baolin Wang 2024-06-22 5367 if (folio && folio_test_large(folio)) 2cb37064a2b82c Baolin Wang 2024-06-22 5368 numa_rebuild_large_mapping(vmf, vma, folio, pte, ignore_writable, 2cb37064a2b82c Baolin Wang 2024-06-22 5369 pte_write_upgrade); 2cb37064a2b82c Baolin Wang 2024-06-22 5370 else 2cb37064a2b82c Baolin Wang 2024-06-22 5371 numa_rebuild_single_mapping(vmf, vma, vmf->address, vmf->pte, 2cb37064a2b82c Baolin Wang 2024-06-22 5372 writable); b99a342d4f11a5 Huang Ying 2021-04-29 5373 pte_unmap_unlock(vmf->pte, vmf->ptl); 3bfa35ccde9e52 Zi Yan 2024-08-09 5374 3bfa35ccde9e52 Zi Yan 2024-08-09 5375 if (nid != NUMA_NO_NODE) 3bfa35ccde9e52 Zi Yan 2024-08-09 5376 task_numa_fault(last_cpupid, nid, 1, flags); 3bfa35ccde9e52 Zi Yan 2024-08-09 5377 return 0; d10e63f29488b0 Mel Gorman 2012-10-25 5378 } d10e63f29488b0 Mel Gorman 2012-10-25 5379 :::::: The code at line 5277 was first introduced by commit :::::: 2cb37064a2b82cd8ebeeaaed21259b5912dff51d mm: support multi-size THP numa balancing :::::: TO: Baolin Wang <baolin.wang(a)linux.alibaba.com> :::::: CC: Liu Shixin <liushixin2(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-50080
by Yuntao Liu 26 Jun '25

26 Jun '25

CVE-2022-50080 Jens Wiklander (2): tee: add overflow check in register_shm_helper() tee: fix compiler warning in tee_shm_register() drivers/tee/tee_core.c | 4 ++++ drivers/tee/tee_shm.c | 1 + 2 files changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10] vhost-scsi: protect vq->log_used with vq->mutex
by ZHENG Xinyu 26 Jun '25

26 Jun '25

From: Dongli Zhang <dongli.zhang(a)oracle.com> stable inclusion from stable-v6.6.93 commit ca85c2d0db5f8309832be45858b960d933c2131c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEC CVE: CVE-2025-38074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ] The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue. Signed-off-by: Dongli Zhang <dongli.zhang(a)oracle.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Message-Id: <20250403063028.16045-2-dongli.zhang(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/scsi.c [Since this fix just want to protect vhost_add_used function from conccurent situation. And vhost_scsi_virtqueue data structure is different so we cannot get the virt queue from vhost_work. In this version, get the virt queue from cmd and solve the conccurent situation.] Signed-off-by: Zheng Xinyu <zhengxinyu6(a)huawei.com> --- drivers/vhost/scsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index a5c6f0baedda..da38525d2e60 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -579,8 +579,10 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); if (likely(ret == sizeof(v_rsp))) { struct vhost_scsi_virtqueue *q; - vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); q = container_of(cmd->tvc_vq, struct vhost_scsi_virtqueue, vq); + mutex_lock(&q->vq.mutex); + vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); + mutex_unlock(&q->vq.mutex); vq = q - vs->vqs; __set_bit(vq, signal); } else @@ -1193,8 +1195,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work) else resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED; + mutex_lock(&tmf->svq->vq.mutex); vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs, tmf->vq_desc, &tmf->resp_iov, resp_code); + mutex_unlock(&tmf->svq->vq.mutex); + vhost_scsi_release_tmf_res(tmf); } -- 2.34.1

2 1

[openeuler:OLK-6.6 2195/2195] drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:299:21: warning: variable 'netdev' set but not used
by kernel test robot 26 Jun '25

26 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c02455c4cce8052f74fc11c09e9073c01c7f33a4 commit: 2d861e6888256771288076b36aa9beba46c7af67 [2195/2195] Net: nebula_matrix: fix ci compile nbl_ethtool.c warning config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250626/202506261533.YYy68pzU-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250626/202506261533.YYy68pzU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506261533.YYy68pzU-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:7: In file included from drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.h:10: In file included from drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_service.h:10: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:299:21: warning: variable 'netdev' set but not used [-Wunused-but-set-variable] 299 | struct net_device *netdev; | ^ >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:1666:36: warning: variable 'net_resource_mgt' set but not used [-Wunused-but-set-variable] 1666 | struct nbl_serv_net_resource_mgt *net_resource_mgt; | ^ 3 warnings generated. vim +/netdev +299 drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c bad535d287c9c1 Bennie Yan 2024-09-24 293 2d861e68882567 Bennie Yan 2024-11-19 294 static void nbl_serv_adjust_interrpt_param(struct nbl_service_mgt *serv_mgt, bool ethtool) bad535d287c9c1 Bennie Yan 2024-09-24 295 { bad535d287c9c1 Bennie Yan 2024-09-24 296 struct nbl_serv_net_resource_mgt *net_resource_mgt; bad535d287c9c1 Bennie Yan 2024-09-24 297 struct nbl_serv_ring_mgt *ring_mgt; bad535d287c9c1 Bennie Yan 2024-09-24 298 struct nbl_dispatch_ops *disp_ops; bad535d287c9c1 Bennie Yan 2024-09-24 @299 struct net_device *netdev; bad535d287c9c1 Bennie Yan 2024-09-24 300 struct nbl_serv_ring_vsi_info *vsi_info; bad535d287c9c1 Bennie Yan 2024-09-24 301 u64 last_tx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 302 u64 last_rx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 303 u64 last_get_stats_jiffies, time_diff; bad535d287c9c1 Bennie Yan 2024-09-24 304 u64 tx_packets, rx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 305 u64 tx_rates, rx_rates, pkt_rates; bad535d287c9c1 Bennie Yan 2024-09-24 306 u16 local_vector_id, vector_num; bad535d287c9c1 Bennie Yan 2024-09-24 307 u16 intr_suppress_level; bad535d287c9c1 Bennie Yan 2024-09-24 308 bad535d287c9c1 Bennie Yan 2024-09-24 309 net_resource_mgt = NBL_SERV_MGT_TO_NET_RES_MGT(serv_mgt); bad535d287c9c1 Bennie Yan 2024-09-24 310 netdev = net_resource_mgt->netdev; bad535d287c9c1 Bennie Yan 2024-09-24 311 ring_mgt = NBL_SERV_MGT_TO_RING_MGT(serv_mgt); bad535d287c9c1 Bennie Yan 2024-09-24 312 disp_ops = NBL_SERV_MGT_TO_DISP_OPS(serv_mgt); bad535d287c9c1 Bennie Yan 2024-09-24 313 vsi_info = &ring_mgt->vsi_info[NBL_VSI_DATA]; bad535d287c9c1 Bennie Yan 2024-09-24 314 bad535d287c9c1 Bennie Yan 2024-09-24 315 last_tx_packets = net_resource_mgt->stats.tx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 316 last_rx_packets = net_resource_mgt->stats.rx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 317 last_get_stats_jiffies = net_resource_mgt->get_stats_jiffies; bad535d287c9c1 Bennie Yan 2024-09-24 318 disp_ops->get_net_stats(NBL_SERV_MGT_TO_DISP_PRIV(serv_mgt), &net_resource_mgt->stats); bad535d287c9c1 Bennie Yan 2024-09-24 319 /* ethtool -S don't adaptive interrupt suppression param */ bad535d287c9c1 Bennie Yan 2024-09-24 320 if (!vsi_info->itr_dynamic || ethtool) bad535d287c9c1 Bennie Yan 2024-09-24 321 return; bad535d287c9c1 Bennie Yan 2024-09-24 322 bad535d287c9c1 Bennie Yan 2024-09-24 323 tx_packets = net_resource_mgt->stats.tx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 324 rx_packets = net_resource_mgt->stats.rx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 325 time_diff = jiffies - last_get_stats_jiffies; bad535d287c9c1 Bennie Yan 2024-09-24 326 bad535d287c9c1 Bennie Yan 2024-09-24 327 net_resource_mgt->get_stats_jiffies = jiffies; bad535d287c9c1 Bennie Yan 2024-09-24 328 tx_rates = (tx_packets - last_tx_packets) / time_diff * HZ; bad535d287c9c1 Bennie Yan 2024-09-24 329 rx_rates = (rx_packets - last_rx_packets) / time_diff * HZ; bad535d287c9c1 Bennie Yan 2024-09-24 330 pkt_rates = max_t(u64, tx_rates, rx_rates); bad535d287c9c1 Bennie Yan 2024-09-24 331 bad535d287c9c1 Bennie Yan 2024-09-24 332 intr_suppress_level = bad535d287c9c1 Bennie Yan 2024-09-24 333 disp_ops->get_intr_suppress_level(NBL_SERV_MGT_TO_DISP_PRIV(serv_mgt), pkt_rates, bad535d287c9c1 Bennie Yan 2024-09-24 334 ring_mgt->vectors->intr_suppress_level); bad535d287c9c1 Bennie Yan 2024-09-24 335 if (intr_suppress_level != ring_mgt->vectors->intr_suppress_level) { bad535d287c9c1 Bennie Yan 2024-09-24 336 local_vector_id = ring_mgt->vectors[vsi_info->ring_offset].local_vector_id; bad535d287c9c1 Bennie Yan 2024-09-24 337 vector_num = vsi_info->ring_num; bad535d287c9c1 Bennie Yan 2024-09-24 338 disp_ops->set_intr_suppress_level(NBL_SERV_MGT_TO_DISP_PRIV(serv_mgt), bad535d287c9c1 Bennie Yan 2024-09-24 339 local_vector_id, vector_num, bad535d287c9c1 Bennie Yan 2024-09-24 340 intr_suppress_level); bad535d287c9c1 Bennie Yan 2024-09-24 341 ring_mgt->vectors->intr_suppress_level = intr_suppress_level; bad535d287c9c1 Bennie Yan 2024-09-24 342 } bad535d287c9c1 Bennie Yan 2024-09-24 343 } bad535d287c9c1 Bennie Yan 2024-09-24 344 :::::: The code at line 299 was first introduced by commit :::::: bad535d287c9c1056d99de3666be7da84de4a8fc Net:nbl_core: Add nbl_core-driver for nebula-matrix S1055AS series smart NIC. :::::: TO: Bennie Yan <bennie.yan(a)nebula-matrix.com> :::::: CC: Bennie Yan <bennie.yan(a)nebula-matrix.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] [Backport] vhost-scsi: protect vq->log_used with vq->mutex
by ZHENG Xinyu 26 Jun '25

26 Jun '25

From: Dongli Zhang <dongli.zhang(a)oracle.com> stable inclusion from stable-v6.6.93 commit ca85c2d0db5f8309832be45858b960d933c2131c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEC CVE: CVE-2025-38074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ] The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue. Signed-off-by: Dongli Zhang <dongli.zhang(a)oracle.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Message-Id: <20250403063028.16045-2-dongli.zhang(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/scsi.c [Since this fix just want to protect vhost_add_used function from conccurent situation.] [And vhost_scsi_virtqueue data structure is different so we cannot get the virt queue from vhost_work.] [In this version, get the virt queue from cmd and solve the conccurent situation.] Signed-off-by: Zheng Xinyu <zhengxinyu6(a)huawei.com> --- drivers/vhost/scsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index f896c8a83f1a..c16af38a3bbc 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -579,8 +579,10 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); if (likely(ret == sizeof(v_rsp))) { struct vhost_scsi_virtqueue *q; - vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); q = container_of(cmd->tvc_vq, struct vhost_scsi_virtqueue, vq); + mutex_lock(&q->vq.mutex); + vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); + mutex_unlock(&q->vq.mutex); vq = q - vs->vqs; __set_bit(vq, signal); } else @@ -1193,8 +1195,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work) else resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED; + mutex_lock(&tmf->svq->vq.mutex); vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs, tmf->vq_desc, &tmf->resp_iov, resp_code); + mutex_unlock(&tmf->svq->vq.mutex); + vhost_scsi_release_tmf_res(tmf); } -- 2.34.1

1 0

[PATCH 1/8] Revert "arm64: Kconfig: Enable HOTPLUG_SMT"
by Qi Xi 26 Jun '25

26 Jun '25

driver inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/IBZQQR ---------------------------------------------------------------------- This reverts commit 4ee778a80dd45dbf3fa7c0b527271ec8babeae35. This reverts commit d31fbcb824a33a9035401a17bd995106a948b8c9. This reverts commit a09d9ba1682c68ae8a6986d4cd7c18caffb8cc53. This reverts commit b19938a0f75e2844e4c5093237f380e5ae23b361. This reverts commit 1243a42766a6352b4fdccde2caa5ef3ec41c49e1. Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/arm64/Kconfig | 1 - arch/arm64/configs/defconfig | 1 - arch/arm64/kernel/topology.c | 23 ------------------ drivers/base/arch_topology.c | 45 ----------------------------------- include/linux/arch_topology.h | 13 ---------- 5 files changed, 83 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 6e3047a1e993..580cbe2f8ec6 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -235,7 +235,6 @@ config ARM64 select HAVE_KRETPROBES select HAVE_GENERIC_VDSO select HOTPLUG_CORE_SYNC_DEAD if HOTPLUG_CPU - select HOTPLUG_SMT if (SMP && HOTPLUG_CPU) select IRQ_DOMAIN select IRQ_FORCED_THREADING select KASAN_VMALLOC if KASAN diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig index 2df5c1e3d42f..c6f35d0ce475 100644 --- a/arch/arm64/configs/defconfig +++ b/arch/arm64/configs/defconfig @@ -1593,7 +1593,6 @@ CONFIG_HISILICON_ERRATUM_162102203=y CONFIG_CPU_INSPECT=m CONFIG_CPU_INSPECTOR_ATF=m # end of CPU Inspect -CONFIG_HOTPLUG_SMT=y CONFIG_NUMA_AWARE_SPINLOCKS=y CONFIG_HISI_SOC_CACHE=m CONFIG_HISI_SOC_HHA=m diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c index 6d0d54de7349..45143dfd1402 100644 --- a/arch/arm64/kernel/topology.c +++ b/arch/arm64/kernel/topology.c @@ -16,7 +16,6 @@ #include <linux/cacheinfo.h> #include <linux/init.h> #include <linux/percpu.h> -#include <linux/xarray.h> #include <asm/cpu.h> #include <asm/cputype.h> @@ -43,16 +42,11 @@ static bool __init acpi_cpu_is_threaded(int cpu) */ int __init parse_acpi_topology(void) { - int thread_num, max_smt_thread_num = 1; - struct xarray core_threads; int cpu, topology_id; - void *entry; if (acpi_disabled) return 0; - xa_init(&core_threads); - for_each_possible_cpu(cpu) { topology_id = find_acpi_cpu_topology(cpu, 0); if (topology_id < 0) @@ -62,20 +56,6 @@ int __init parse_acpi_topology(void) cpu_topology[cpu].thread_id = topology_id; topology_id = find_acpi_cpu_topology(cpu, 1); cpu_topology[cpu].core_id = topology_id; - - entry = xa_load(&core_threads, topology_id); - if (!entry) { - xa_store(&core_threads, topology_id, - xa_mk_value(1), GFP_KERNEL); - } else { - thread_num = xa_to_value(entry); - thread_num++; - xa_store(&core_threads, topology_id, - xa_mk_value(thread_num), GFP_KERNEL); - - if (thread_num > max_smt_thread_num) - max_smt_thread_num = thread_num; - } } else { cpu_topology[cpu].thread_id = -1; cpu_topology[cpu].core_id = topology_id; @@ -86,9 +66,6 @@ int __init parse_acpi_topology(void) cpu_topology[cpu].package_id = topology_id; } - topology_smt_set_num_threads(max_smt_thread_num); - - xa_destroy(&core_threads); return 0; } #endif diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c index 630c59d97aef..2aa0c6425290 100644 --- a/drivers/base/arch_topology.c +++ b/drivers/base/arch_topology.c @@ -547,13 +547,6 @@ static int __init parse_core(struct device_node *core, int package_id, i++; } while (t); - /* - * We've already gotten threads number in this core, update the SMT - * threads number when necessary. - */ - if (i > topology_smt_get_num_threads()) - topology_smt_set_num_threads(i); - cpu = get_cpu_for_node(core); if (cpu >= 0) { if (!leaf) { @@ -757,36 +750,6 @@ const struct cpumask *cpu_clustergroup_mask(int cpu) return &cpu_topology[cpu].cluster_sibling; } -#ifdef CONFIG_HOTPLUG_SMT - -/* Maximum threads number per-Core */ -static unsigned int topology_smt_num_threads = 1; - -void __init topology_smt_set_num_threads(unsigned int num_threads) -{ - topology_smt_num_threads = num_threads; -} - -unsigned int __init topology_smt_get_num_threads(void) -{ - return topology_smt_num_threads; -} - -/* - * On SMT Hotplug the primary thread of the SMT won't be disabled. For x86 they - * seem to have a primary thread for special purpose. For other arthitectures - * like arm64 there's no such restriction for a primary thread, so make the - * first thread in the SMT as the primary thread. - */ -bool topology_is_primary_thread(unsigned int cpu) -{ - if (cpu == cpumask_first(topology_sibling_cpumask(cpu))) - return true; - - return false; -} -#endif - void update_siblings_masks(unsigned int cpuid) { struct cpu_topology *cpu_topo, *cpuid_topo = &cpu_topology[cpuid]; @@ -899,14 +862,6 @@ void __init init_cpu_topology(void) reset_cpu_topology(); } - /* - * By this stage we get to know whether we support SMT or not, update - * the information for the core. We don't support - * CONFIG_SMT_NUM_THREADS_DYNAMIC so make the max_threads == num_threads. - */ - cpu_smt_set_num_threads(topology_smt_get_num_threads(), - topology_smt_get_num_threads()); - for_each_possible_cpu(cpu) { ret = fetch_cache_info(cpu); if (!ret) diff --git a/include/linux/arch_topology.h b/include/linux/arch_topology.h index 14cdf5df760c..949ecdb6e956 100644 --- a/include/linux/arch_topology.h +++ b/include/linux/arch_topology.h @@ -100,19 +100,6 @@ void remove_cpu_topology(unsigned int cpuid); void reset_cpu_topology(void); int parse_acpi_topology(void); -#ifdef CONFIG_HOTPLUG_SMT -bool topology_is_primary_thread(unsigned int cpu); -void topology_smt_set_num_threads(unsigned int num_threads); -unsigned int topology_smt_get_num_threads(void); -#else -static inline bool topology_is_primary_thread(unsigned int cpu) { return false; } -static inline void topology_smt_set_num_threads(unsigned int num_threads) { } -static inline unsigned int topology_smt_get_num_threads(void) -{ - return 1; -} -#endif - void freq_inv_set_max_ratio(int cpu, u64 max_rate); #endif -- 2.33.0

1 7

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-50080
by Yuntao Liu 26 Jun '25

26 Jun '25

CVE-2022-50080 Jens Wiklander (2): tee: add overflow check in register_shm_helper() tee: fix compiler warning in tee_shm_register() drivers/tee/tee_core.c | 4 ++++ drivers/tee/tee_shm.c | 1 + 2 files changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] vhost-scsi: protect vq->log_used with vq->mutex
by ZHENG Xinyu 26 Jun '25

26 Jun '25

From: Dongli Zhang <dongli.zhang(a)oracle.com> stable inclusion from stable-v6.6.93 commit ca85c2d0db5f8309832be45858b960d933c2131c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEC CVE: CVE-2025-38074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ] The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue. Signed-off-by: Dongli Zhang <dongli.zhang(a)oracle.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Message-Id: <20250403063028.16045-2-dongli.zhang(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/vhost/scsi.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 99813232c25e..d4e60a6ed214 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -560,6 +560,9 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) int ret; llnode = llist_del_all(&svq->completion_list); + + mutex_lock(&svq->vq.mutex); + llist_for_each_entry_safe(cmd, t, llnode, tvc_completion_list) { se_cmd = &cmd->tvc_se_cmd; @@ -593,6 +596,8 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) vhost_scsi_release_cmd_res(se_cmd); } + mutex_unlock(&svq->vq.mutex); + if (signal) vhost_signal(&svq->vs->dev, &svq->vq); } @@ -1301,8 +1306,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work) resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED; } + mutex_lock(&tmf->svq->vq.mutex); vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs, tmf->vq_desc, &tmf->resp_iov, resp_code); + mutex_unlock(&tmf->svq->vq.mutex); + vhost_scsi_release_tmf_res(tmf); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tee: add overflow check in register_shm_helper()
by Yuntao Liu 26 Jun '25

26 Jun '25

From: Jens Wiklander <jens.wiklander(a)linaro.org> stable inclusion from stable-v4.19.256 commit b37e0f17653c00b586cdbcdf0dbca475358ecffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG798 CVE: CVE-2022-50080 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 573ae4f13f630d6660008f1974c0a8a29c30e18a upstream. With special lengths supplied by user space, register_shm_helper() has an integer overflow when calculating the number of pages covered by a supplied user space memory region. This causes internal_get_user_pages_fast() a helper function of pin_user_pages_fast() to do a NULL pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Modules linked in: CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11 Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pc : internal_get_user_pages_fast+0x474/0xa80 Call trace: internal_get_user_pages_fast+0x474/0xa80 pin_user_pages_fast+0x24/0x4c register_shm_helper+0x194/0x330 tee_shm_register_user_buf+0x78/0x120 tee_ioctl+0xd0/0x11a0 __arm64_sys_ioctl+0xa8/0xec invoke_syscall+0x48/0x114 Fix this by adding an an explicit call to access_ok() in tee_shm_register_user_buf() to catch an invalid user space address early. Fixes: 033ddf12bcf5 ("tee: add register user memory") Cc: stable(a)vger.kernel.org Reported-by: Nimish Mishra <neelam.nimish(a)gmail.com> Reported-by: Anirban Chakraborty <ch.anirban00727(a)gmail.com> Reported-by: Debdeep Mukhopadhyay <debdeep.mukhopadhyay(a)gmail.com> Suggested-by: Jerome Forissier <jerome.forissier(a)linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> [JW: backport to stable-4.19 + update commit message] Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/tee/tee_core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 0d252f151584..69be7f764bf9 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -172,6 +172,10 @@ tee_ioctl_shm_register(struct tee_context *ctx, if (data.flags) return -EINVAL; + if (!access_ok(VERIFY_WRITE, (void __user *)(unsigned long)data.addr, + data.length)) + return -EFAULT; + shm = tee_shm_register(ctx, data.addr, data.length, TEE_SHM_DMA_BUF | TEE_SHM_USER_MAPPED); if (IS_ERR(shm)) -- 2.34.1

2 1