- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2784/2784] net/oenetcls/oenetcls_flow.c:18:6: warning: no previous prototype for function 'is_oecls_config_netdev'
by kernel test robot 28 Aug '25

28 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ed9bff77568b702badeef2b7c7776bb93d993768 commit: 4bed6ba0e88f50484fd5fb06bd993727b981b718 [2784/2784] net/oenetcls: introduce oenetcls for network optimization config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250828/202508282115.FeEkHc1L-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250828/202508282115.FeEkHc1L-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508282115.FeEkHc1L-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/oenetcls/oenetcls_flow.c:18:6: warning: no previous prototype for function 'is_oecls_config_netdev' [-Wmissing-prototypes] 18 | bool is_oecls_config_netdev(const char *name) | ^ net/oenetcls/oenetcls_flow.c:18:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 18 | bool is_oecls_config_netdev(const char *name) | ^ | static 1 warning generated. vim +/is_oecls_config_netdev +18 net/oenetcls/oenetcls_flow.c 17 > 18 bool is_oecls_config_netdev(const char *name) 19 { 20 struct oecls_netdev_info *netdev_info; 21 int netdev_loop; 22 23 for_each_oecls_netdev(netdev_loop, netdev_info) 24 if (strcmp(netdev_info->dev_name, name) == 0) 25 return true; 26 27 return false; 28 } 29 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] irqchip/gicv3-its: Add workaround for HIP09/HIP10/HIP10C erratum 162100803/162200807/162400807
by Jinqian Yang 28 Aug '25

28 Aug '25

Zhou Wang (1): irqchip/gicv3-its: Add workaround for HIP09/HIP10/HIP10C erratum 162100803/162200807/162400807 arch/arm64/Kconfig | 13 ++++ drivers/irqchip/irq-gic-v3-its.c | 114 +++++++++++++++++++++++++++---- 2 files changed, 113 insertions(+), 14 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] KVM: arm64: fix the issue of vNMI not supporting live migration
by Jinqian Yang 28 Aug '25

28 Aug '25

Jinqian Yang (1): KVM: arm64: fix the issue of vNMI not supporting live migration arch/arm64/kvm/vgic/vgic-mmio-v3.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) -- 2.33.0

2 2

[PATCH OLK-5.10 0/3] page_pool: Fix use-after-free in page_pool_recycle_in_ring
by Dong Chenchen 28 Aug '25

28 Aug '25

Fix use-after-free in page_pool_recycle_in_ring Dong Chenchen (1): page_pool: Fix use-after-free in page_pool_recycle_in_ring Qingfang DENG (1): net: page_pool: use in_softirq() instead Yunsheng Lin (1): page_pool: fix inconsistency for page_pool_ring_[un]lock() include/net/page_pool.h | 18 ------------- net/core/page_pool.c | 58 +++++++++++++++++++++++++++++------------ 2 files changed, 41 insertions(+), 35 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/1] gic: increase the arch_timer
by Qinxin Xia 28 Aug '25

28 Aug '25

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICUJ1T ---------------------------------------------------------------------- Qinxin Xia (1): gic: increase the arch_timer priority to avoid hardlockup arch/arm64/Kconfig | 11 +++++++ arch/arm64/configs/openeuler_defconfig | 1 + drivers/clocksource/arm_arch_timer.c | 44 ++++++++++++++++++++++++++ drivers/irqchip/irq-gic-v3.c | 2 +- include/linux/irqchip/arm-gic-v3.h | 4 +++ 5 files changed, 61 insertions(+), 1 deletion(-) -- 2.33.0

2 2

[PATCH OLK-5.10] iwlwifi: Add missing check for alloc_ordered_workqueue
by Ziming Du 28 Aug '25

28 Aug '25

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v6.1.148 commit 6663c52608d8d8727bf1911e6d9218069ba1c85e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6EY CVE: CVE-2025-38602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 90a0d9f339960448a3acc1437a46730f975efd6a ] Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Link: https://patch.msgid.link/20230110014848.28226-1-jiasheng@iscas.ac.cn Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c index 461af58311561..d371889e03853 100644 --- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c +++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c @@ -1054,9 +1054,11 @@ static void iwl_bg_restart(struct work_struct *data) * *****************************************************************************/ -static void iwl_setup_deferred_work(struct iwl_priv *priv) +static int iwl_setup_deferred_work(struct iwl_priv *priv) { priv->workqueue = alloc_ordered_workqueue(DRV_NAME, 0); + if (!priv->workqueue) + return -ENOMEM; INIT_WORK(&priv->restart, iwl_bg_restart); INIT_WORK(&priv->beacon_update, iwl_bg_beacon_update); @@ -1073,6 +1075,8 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv) timer_setup(&priv->statistics_periodic, iwl_bg_statistics_periodic, 0); timer_setup(&priv->ucode_trace, iwl_bg_ucode_trace, 0); + + return 0; } void iwl_cancel_deferred_work(struct iwl_priv *priv) @@ -1462,7 +1466,9 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, /******************** * 6. Setup services ********************/ - iwl_setup_deferred_work(priv); + if (iwl_setup_deferred_work(priv)) + goto out_uninit_drv; + iwl_setup_rx_handlers(priv); iwl_power_initialize(priv); @@ -1500,6 +1506,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, iwl_cancel_deferred_work(priv); destroy_workqueue(priv->workqueue); priv->workqueue = NULL; +out_uninit_drv: iwl_uninit_drv(priv); out_free_eeprom_blob: kfree(priv->eeprom_blob); -- 2.43.0

2 1

[PATCH OLK-6.6] benet: fix BUG when creating VFs
by Ziming Du 28 Aug '25

28 Aug '25

From: Michal Schmidt <mschmidt(a)redhat.com> stable inclusion from stable-v6.6.102 commit c377ba2be9430d165a98e4b782902ed630bc7546 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6G1 CVE: CVE-2025-38569 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5a40f8af2ba1b9bdf46e2db10e8c9710538fbc63 ] benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x5f/0x70 [...] Call Trace: <TASK> __iommu_dma_free+0xe8/0x1c0 be_cmd_set_mac_list+0x3fe/0x640 [be2net] be_cmd_set_mac+0xaf/0x110 [be2net] be_vf_eth_addr_config+0x19f/0x330 [be2net] be_vf_setup+0x4f7/0x990 [be2net] be_pci_sriov_configure+0x3a1/0x470 [be2net] sriov_numvfs_store+0x20b/0x380 kernfs_fop_write_iter+0x354/0x530 vfs_write+0x9b9/0xf60 ksys_write+0xf3/0x1d0 do_syscall_64+0x8c/0x3d0 be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh. Fix it by freeing only after the lock has been released. Fixes: 1a82d19ca2d6 ("be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink") Signed-off-by: Michal Schmidt <mschmidt(a)redhat.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://patch.msgid.link/20250801101338.72502-1-mschmidt@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/ethernet/emulex/benet/be_cmds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c index 51b8377edd1d0..078b3b36db485 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.c +++ b/drivers/net/ethernet/emulex/benet/be_cmds.c @@ -3852,8 +3852,8 @@ int be_cmd_set_mac_list(struct be_adapter *adapter, u8 *mac_array, status = be_mcc_notify_wait(adapter); err: - dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma); spin_unlock_bh(&adapter->mcc_lock); + dma_free_coherent(&adapter->pdev->dev, cmd.size, cmd.va, cmd.dma); return status; } -- 2.43.0

2 1

[PATCH OLK-6.6 v3 00/11] HiSock Redirect Framework
by Pu Lehui 28 Aug '25

28 Aug '25

Matteo Croce (1): bpf: Enable generic kfuncs for BPF_CGROUP_* programs Pu Lehui (10): bpf: Add CONFIG_HISOCK bpf: Add XDP_HISOCK_REDIRECT action bpf: Add BPF_PROG_TYPE_HISOCK prog type bpf: Add HISOCK_EGRESS hook on network egress path bpf: Add bpf_skops_get_ingress_dst kfunc bpf: Add hisock_xdp_buff wrapper for xdp_buff bpf: Add bpf_xdp_set_ingress_dst kfunc bpf: Add bpf_*_change_dev kfunc openeuler_defconfig: Enable CONFIG_HISOCK samples/bpf: Add HiSock Redirect sample arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf-cgroup-defs.h | 3 + include/linux/bpf-cgroup.h | 25 ++ include/linux/bpf_types.h | 4 + include/net/xdp.h | 5 + include/uapi/linux/bpf.h | 14 + kernel/bpf/btf.c | 18 +- kernel/bpf/cgroup.c | 43 +++ kernel/bpf/helpers.c | 1 + kernel/bpf/syscall.c | 19 ++ kernel/bpf/verifier.c | 3 + net/Kconfig | 10 + net/core/dev.c | 76 ++++- net/core/filter.c | 167 ++++++++++ net/ipv4/ip_output.c | 68 +++++ samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 3 + samples/bpf/hisock/bpf.c | 251 +++++++++++++++ samples/bpf/hisock/hisock_cmd.c | 405 +++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 14 + tools/lib/bpf/libbpf.c | 3 + 22 files changed, 1130 insertions(+), 5 deletions(-) create mode 100644 samples/bpf/hisock/bpf.c create mode 100644 samples/bpf/hisock/hisock_cmd.c -- 2.34.1

2 12

[PATCH OLK-5.10] perf/core: Prevent VMA split of buffer mappings
by Xiaomeng Zhang 28 Aug '25

28 Aug '25

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v6.17-rc1 commit b024d7b56c77191cde544f838debb7f8451cd0d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU7CC CVE: CVE-2025-38563 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping. Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-27504 Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Acked-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: stable(a)vger.kernel.org Conflicts: kernel/events/core.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/events/core.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/kernel/events/core.c b/kernel/events/core.c index b56b572f1bd0..95a1ba716e0b 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6042,11 +6042,21 @@ static void perf_mmap_close(struct vm_area_struct *vma) ring_buffer_put(rb); /* could be last */ } +static int perf_mmap_may_split(struct vm_area_struct *vma, unsigned long addr) +{ + /* + * Forbid splitting perf mappings to prevent refcount leaks due to + * the resulting non-matching offsets and sizes. See open()/close(). + */ + return -EINVAL; +} + static const struct vm_operations_struct perf_mmap_vmops = { .open = perf_mmap_open, .close = perf_mmap_close, /* non mergeable */ .fault = perf_mmap_fault, .page_mkwrite = perf_mmap_fault, + .split = perf_mmap_may_split, }; static int perf_mmap(struct file *file, struct vm_area_struct *vma) -- 2.34.1

2 1

[PATCH OLK-6.6] perf/core: Prevent VMA split of buffer mappings
by Xiaomeng Zhang 28 Aug '25

28 Aug '25

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-v6.6.102 commit 6757a31a8e295ae4f01717a954afda173f25a121 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU7CC CVE: CVE-2025-38563 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b024d7b56c77191cde544f838debb7f8451cd0d6 upstream. The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping. Fixes: 45bfb2e50471 ("perf/core: Add AUX area to ring buffer for raw data streams") Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-27504 Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Acked-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/events/core.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/kernel/events/core.c b/kernel/events/core.c index 69cdf8aabf52..caa6dcbeb55a 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6467,11 +6467,21 @@ static void perf_mmap_close(struct vm_area_struct *vma) ring_buffer_put(rb); /* could be last */ } +static int perf_mmap_may_split(struct vm_area_struct *vma, unsigned long addr) +{ + /* + * Forbid splitting perf mappings to prevent refcount leaks due to + * the resulting non-matching offsets and sizes. See open()/close(). + */ + return -EINVAL; +} + static const struct vm_operations_struct perf_mmap_vmops = { .open = perf_mmap_open, .close = perf_mmap_close, /* non mergeable */ .fault = perf_mmap_fault, .page_mkwrite = perf_mmap_fault, + .may_split = perf_mmap_may_split, }; static int perf_mmap(struct file *file, struct vm_area_struct *vma) -- 2.34.1

2 1