- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 3164/3164] drivers/crypto/ccp/hygon/hct.c:46: warning: Function parameter or member 'fmt' not described in 'pr_fmt'
by kernel test robot 27 Aug '25

27 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2631a43115d05f216c64dbf901afa2b4bfdf13f5 commit: b7a218b5c46200f323ac0fe07589e0bf0d648069 [3164/3164] crypto: hct: provides hygon crypto technology ccp device driver. config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20250827/202508271204.tfohm9Mj-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d26ea02060b1c9db751d188b2edb0059a9eb273d) rustc: rustc 1.58.0 (02072b482 2022-01-11) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250827/202508271204.tfohm9Mj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508271204.tfohm9Mj-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/hct.c:46: warning: Function parameter or member 'fmt' not described in 'pr_fmt' vim +46 drivers/crypto/ccp/hygon/hct.c 34 35 /** 36 * VERSION_STRING modification instructions: 37 * 0.1 -- support hct/mdev mode. 38 * 0.2 -- supoort qemu virtualization. 39 * 0.3 -- support host-noiommu mode memory encryption function, 40 * and performance optimization in virtual machines (enable caching). 41 * 0.4 -- support compiling hct.ko when mdev module is disabled. 42 * 0.5 -- change the maximum number of supported ccps from 16 to 48. 43 */ 44 45 #undef pr_fmt > 46 #define pr_fmt(fmt) "hct: " fmt 47 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3164/3164] kernel/sched/fair.c:9944:43: error: incomplete definition of type 'struct task_group'
by kernel test robot 27 Aug '25

27 Aug '25

Hi Cheng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2631a43115d05f216c64dbf901afa2b4bfdf13f5 commit: 433c0b72564239cf3086f563d5ca32a10e4ffd3f [3164/3164] sched/fair: Count the number of tasks marked as steal_task on cfs_rq config: x86_64-randconfig-104-20250827 (https://download.01.org/0day-ci/archive/20250827/202508271837.ae2GMAYR-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250827/202508271837.ae2GMAYR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508271837.ae2GMAYR-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/fair.c:4483:31: error: implicit declaration of function 'is_tg_steal' [-Werror,-Wimplicit-function-declaration] 4483 | return group_steal_used() && is_tg_steal(steal_task); | ^ kernel/sched/fair.c:6013:6: warning: no previous prototype for function 'init_cfs_bandwidth' [-Wmissing-prototypes] 6013 | void init_cfs_bandwidth(struct cfs_bandwidth *cfs_b) {} | ^ kernel/sched/fair.c:6013:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6013 | void init_cfs_bandwidth(struct cfs_bandwidth *cfs_b) {} | ^ | static kernel/sched/fair.c:9944:29: error: implicit declaration of function 'is_tg_steal' [-Werror,-Wimplicit-function-declaration] 9944 | if (group_steal_used() && !is_tg_steal(tg->steal_task)) | ^ >> kernel/sched/fair.c:9944:43: error: incomplete definition of type 'struct task_group' 9944 | if (group_steal_used() && !is_tg_steal(tg->steal_task)) | ~~^ include/linux/sched.h:69:8: note: forward declaration of 'struct task_group' 69 | struct task_group; | ^ kernel/sched/fair.c:13961:6: warning: no previous prototype for function 'free_fair_sched_group' [-Wmissing-prototypes] 13961 | void free_fair_sched_group(struct task_group *tg) { } | ^ kernel/sched/fair.c:13961:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 13961 | void free_fair_sched_group(struct task_group *tg) { } | ^ | static kernel/sched/fair.c:13963:5: warning: no previous prototype for function 'alloc_fair_sched_group' [-Wmissing-prototypes] 13963 | int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent) | ^ kernel/sched/fair.c:13963:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 13963 | int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent) | ^ | static kernel/sched/fair.c:13968:6: warning: no previous prototype for function 'online_fair_sched_group' [-Wmissing-prototypes] 13968 | void online_fair_sched_group(struct task_group *tg) { } | ^ kernel/sched/fair.c:13968:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 13968 | void online_fair_sched_group(struct task_group *tg) { } | ^ | static kernel/sched/fair.c:13970:6: warning: no previous prototype for function 'unregister_fair_sched_group' [-Wmissing-prototypes] 13970 | void unregister_fair_sched_group(struct task_group *tg) { } | ^ kernel/sched/fair.c:13970:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 13970 | void unregister_fair_sched_group(struct task_group *tg) { } | ^ | static 5 warnings and 3 errors generated. vim +9944 kernel/sched/fair.c 9929 9930 #ifdef CONFIG_SCHED_STEAL 9931 /* 9932 * Return true if task @p can migrate from @rq to @dst_rq in the same LLC. 9933 * No need to test for co-locality, and no need to test task_hot(), as sharing 9934 * LLC provides cache warmth at that level. 9935 */ 9936 static bool 9937 can_migrate_task_llc(struct task_struct *p, struct rq *rq, struct rq *dst_rq) 9938 { 9939 int dst_cpu = dst_rq->cpu; 9940 struct task_group *tg = task_group(p); 9941 9942 lockdep_assert_rq_held(rq); 9943 > 9944 if (group_steal_used() && !is_tg_steal(tg->steal_task)) 9945 return false; 9946 9947 if (throttled_lb_pair(tg, cpu_of(rq), dst_cpu)) 9948 return false; 9949 9950 if (!cpumask_test_cpu(dst_cpu, p->cpus_ptr)) { 9951 schedstat_inc(p->se.statistics.nr_failed_migrations_affine); 9952 return false; 9953 } 9954 9955 if (task_running(rq, p)) { 9956 schedstat_inc(p->se.statistics.nr_failed_migrations_running); 9957 return false; 9958 } 9959 9960 return true; 9961 } 9962 #endif 9963 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ipv6: mcast: extend RCU protection in igmp6_send()
by Dong Chenchen 27 Aug '25

27 Aug '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 087c1faa594fa07a66933d750c0b2610aa1a2946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5R CVE: CVE-2025-21759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/mcast.c [commit b4a11b2033b7 separates OUTREQUESTS stastic from MIB_OUT, which not merged lead to context conflicts. commit 2e7ef287f07c convert from timer to delayed work. Because this patch was not merged, we use GFP_ATOMIC flag] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/mcast.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 9fb5077f8e9a..e0d5125de202 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1974,21 +1974,21 @@ static void mld_send_cr(struct inet6_dev *idev) static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) { - struct net *net = dev_net(dev); - struct sock *sk = net->ipv6.igmp_sk; + const struct in6_addr *snd_addr, *saddr; + int err, len, payload_len, full_len; + struct in6_addr addr_buf; struct inet6_dev *idev; struct sk_buff *skb; struct mld_msg *hdr; - const struct in6_addr *snd_addr, *saddr; - struct in6_addr addr_buf; int hlen = LL_RESERVED_SPACE(dev); int tlen = dev->needed_tailroom; - int err, len, payload_len, full_len; u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 2, 0, 0, IPV6_TLV_PADN, 0 }; - struct flowi6 fl6; struct dst_entry *dst; + struct flowi6 fl6; + struct net *net; + struct sock *sk; if (type == ICMPV6_MGM_REDUCTION) snd_addr = &in6addr_linklocal_allrouters; @@ -1999,20 +1999,20 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) payload_len = len + sizeof(ra); full_len = sizeof(struct ipv6hdr) + payload_len; - rcu_read_lock(); - IP6_UPD_PO_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUT, full_len); - rcu_read_unlock(); - - skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); + skb = alloc_skb(hlen + tlen + full_len, GFP_ATOMIC); + rcu_read_lock(); + net = dev_net_rcu(dev); + idev = __in6_dev_get(dev); + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len); if (!skb) { - rcu_read_lock(); - IP6_INC_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUTDISCARDS); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); rcu_read_unlock(); return; } + sk = net->ipv6.igmp_sk; + skb_set_owner_w(skb, sk); + skb->priority = TC_PRIO_CONTROL; skb_reserve(skb, hlen); @@ -2037,9 +2037,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) IPPROTO_ICMPV6, csum_partial(hdr, len, 0)); - rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - icmpv6_flow_init(sk, &fl6, type, &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->dev->ifindex); -- 2.25.1

2 1

[openeuler:OLK-6.6 2752/2752] include/linux/bitfield.h:165:3: error: call to '__bad_mask' declared with attribute error: bad bitfield mask
by kernel test robot 27 Aug '25

27 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 242365f71d0edaeff9d861d32b639f02170e075d commit: 9e76624e89d2d5210d25a33749d8989212945735 [2752/2752] [v8-28-43]arm64: RME: Allow checking SVE on VM instance config: arm64-randconfig-004-20250827 (https://download.01.org/0day-ci/archive/20250827/202508271638.WDlsxoDG-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250827/202508271638.WDlsxoDG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508271638.WDlsxoDG-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/arm64/include/asm/sysreg.h:1065, from arch/arm64/include/asm/percpu.h:13, from arch/arm64/include/asm/smp.h:28, from include/linux/smp.h:113, from include/linux/percpu.h:7, from include/linux/context_tracking_state.h:5, from include/linux/hardirq.h:5, from include/linux/kvm_host.h:7, from arch/arm64/kvm/rme.c:6: In function 'field_multiplier', inlined from 'u64_get_bits' at include/linux/bitfield.h:201:1, inlined from 'rme_has_feature' at arch/arm64/kvm/rme.c:38:11: >> include/linux/bitfield.h:165:3: error: call to '__bad_mask' declared with attribute error: bad bitfield mask 165 | __bad_mask(); | ^~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] vim +/__bad_mask +165 include/linux/bitfield.h e2192de59e457a Johannes Berg 2023-01-18 119 e2192de59e457a Johannes Berg 2023-01-18 120 /** e2192de59e457a Johannes Berg 2023-01-18 121 * FIELD_PREP_CONST() - prepare a constant bitfield element e2192de59e457a Johannes Berg 2023-01-18 122 * @_mask: shifted mask defining the field's length and position e2192de59e457a Johannes Berg 2023-01-18 123 * @_val: value to put in the field e2192de59e457a Johannes Berg 2023-01-18 124 * e2192de59e457a Johannes Berg 2023-01-18 125 * FIELD_PREP_CONST() masks and shifts up the value. The result should e2192de59e457a Johannes Berg 2023-01-18 126 * be combined with other fields of the bitfield using logical OR. e2192de59e457a Johannes Berg 2023-01-18 127 * e2192de59e457a Johannes Berg 2023-01-18 128 * Unlike FIELD_PREP() this is a constant expression and can therefore e2192de59e457a Johannes Berg 2023-01-18 129 * be used in initializers. Error checking is less comfortable for this e2192de59e457a Johannes Berg 2023-01-18 130 * version, and non-constant masks cannot be used. e2192de59e457a Johannes Berg 2023-01-18 131 */ e2192de59e457a Johannes Berg 2023-01-18 132 #define FIELD_PREP_CONST(_mask, _val) \ e2192de59e457a Johannes Berg 2023-01-18 133 ( \ e2192de59e457a Johannes Berg 2023-01-18 134 /* mask must be non-zero */ \ e2192de59e457a Johannes Berg 2023-01-18 135 BUILD_BUG_ON_ZERO((_mask) == 0) + \ e2192de59e457a Johannes Berg 2023-01-18 136 /* check if value fits */ \ e2192de59e457a Johannes Berg 2023-01-18 137 BUILD_BUG_ON_ZERO(~((_mask) >> __bf_shf(_mask)) & (_val)) + \ e2192de59e457a Johannes Berg 2023-01-18 138 /* check if mask is contiguous */ \ e2192de59e457a Johannes Berg 2023-01-18 139 __BF_CHECK_POW2((_mask) + (1ULL << __bf_shf(_mask))) + \ e2192de59e457a Johannes Berg 2023-01-18 140 /* and create the value */ \ e2192de59e457a Johannes Berg 2023-01-18 141 (((typeof(_mask))(_val) << __bf_shf(_mask)) & (_mask)) \ e2192de59e457a Johannes Berg 2023-01-18 142 ) e2192de59e457a Johannes Berg 2023-01-18 143 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 144 /** 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 145 * FIELD_GET() - extract a bitfield element 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 146 * @_mask: shifted mask defining the field's length and position 7240767450d6d8 Masahiro Yamada 2017-10-03 147 * @_reg: value of entire bitfield 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 148 * 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 149 * FIELD_GET() extracts the field specified by @_mask from the 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 150 * bitfield passed in as @_reg by masking and shifting it down. 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 151 */ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 152 #define FIELD_GET(_mask, _reg) \ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 153 ({ \ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 154 __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 155 (typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask)); \ 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 156 }) 3e9b3112ec74f1 Jakub Kicinski 2016-08-31 157 e7d4a95da86e0b Johannes Berg 2018-06-20 158 extern void __compiletime_error("value doesn't fit into mask") 00b0c9b82663ac Al Viro 2017-12-14 159 __field_overflow(void); 00b0c9b82663ac Al Viro 2017-12-14 160 extern void __compiletime_error("bad bitfield mask") 00b0c9b82663ac Al Viro 2017-12-14 161 __bad_mask(void); 00b0c9b82663ac Al Viro 2017-12-14 162 static __always_inline u64 field_multiplier(u64 field) 00b0c9b82663ac Al Viro 2017-12-14 163 { 00b0c9b82663ac Al Viro 2017-12-14 164 if ((field | (field - 1)) & ((field | (field - 1)) + 1)) 00b0c9b82663ac Al Viro 2017-12-14 @165 __bad_mask(); 00b0c9b82663ac Al Viro 2017-12-14 166 return field & -field; 00b0c9b82663ac Al Viro 2017-12-14 167 } 00b0c9b82663ac Al Viro 2017-12-14 168 static __always_inline u64 field_mask(u64 field) 00b0c9b82663ac Al Viro 2017-12-14 169 { 00b0c9b82663ac Al Viro 2017-12-14 170 return field / field_multiplier(field); 00b0c9b82663ac Al Viro 2017-12-14 171 } e31a50162feb35 Alex Elder 2020-03-12 172 #define field_max(field) ((typeof(field))field_mask(field)) 00b0c9b82663ac Al Viro 2017-12-14 173 #define ____MAKE_OP(type,base,to,from) \ 00b0c9b82663ac Al Viro 2017-12-14 174 static __always_inline __##type type##_encode_bits(base v, base field) \ 00b0c9b82663ac Al Viro 2017-12-14 175 { \ e7d4a95da86e0b Johannes Berg 2018-06-20 176 if (__builtin_constant_p(v) && (v & ~field_mask(field))) \ 00b0c9b82663ac Al Viro 2017-12-14 177 __field_overflow(); \ 00b0c9b82663ac Al Viro 2017-12-14 178 return to((v & field_mask(field)) * field_multiplier(field)); \ 00b0c9b82663ac Al Viro 2017-12-14 179 } \ 00b0c9b82663ac Al Viro 2017-12-14 180 static __always_inline __##type type##_replace_bits(__##type old, \ 00b0c9b82663ac Al Viro 2017-12-14 181 base val, base field) \ 00b0c9b82663ac Al Viro 2017-12-14 182 { \ 00b0c9b82663ac Al Viro 2017-12-14 183 return (old & ~to(field)) | type##_encode_bits(val, field); \ 00b0c9b82663ac Al Viro 2017-12-14 184 } \ 00b0c9b82663ac Al Viro 2017-12-14 185 static __always_inline void type##p_replace_bits(__##type *p, \ 00b0c9b82663ac Al Viro 2017-12-14 186 base val, base field) \ 00b0c9b82663ac Al Viro 2017-12-14 187 { \ 00b0c9b82663ac Al Viro 2017-12-14 188 *p = (*p & ~to(field)) | type##_encode_bits(val, field); \ 00b0c9b82663ac Al Viro 2017-12-14 189 } \ 00b0c9b82663ac Al Viro 2017-12-14 190 static __always_inline base type##_get_bits(__##type v, base field) \ 00b0c9b82663ac Al Viro 2017-12-14 191 { \ 00b0c9b82663ac Al Viro 2017-12-14 192 return (from(v) & field)/field_multiplier(field); \ 00b0c9b82663ac Al Viro 2017-12-14 193 } 00b0c9b82663ac Al Viro 2017-12-14 194 #define __MAKE_OP(size) \ 00b0c9b82663ac Al Viro 2017-12-14 195 ____MAKE_OP(le##size,u##size,cpu_to_le##size,le##size##_to_cpu) \ 00b0c9b82663ac Al Viro 2017-12-14 196 ____MAKE_OP(be##size,u##size,cpu_to_be##size,be##size##_to_cpu) \ 00b0c9b82663ac Al Viro 2017-12-14 197 ____MAKE_OP(u##size,u##size,,) 37a3862e123826 Johannes Berg 2018-06-20 198 ____MAKE_OP(u8,u8,,) 00b0c9b82663ac Al Viro 2017-12-14 199 __MAKE_OP(16) 00b0c9b82663ac Al Viro 2017-12-14 200 __MAKE_OP(32) 00b0c9b82663ac Al Viro 2017-12-14 201 __MAKE_OP(64) 00b0c9b82663ac Al Viro 2017-12-14 202 #undef __MAKE_OP 00b0c9b82663ac Al Viro 2017-12-14 203 #undef ____MAKE_OP 00b0c9b82663ac Al Viro 2017-12-14 204 :::::: The code at line 165 was first introduced by commit :::::: 00b0c9b82663ac42e5a09f58ce960f81f29d64ee Add primitives for manipulating bitfields both in host- and fixed-endian. :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2753/2753] drivers/i2c/busses/i2c-zhaoxin.c:176:5: warning: no previous prototype for function 'zxi2c_fifo_irq_xfer'
by kernel test robot 27 Aug '25

27 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 71bbca0322aee9dfe26f2a23ab54f5cfca1dd85c commit: 07a6747f952bd8a1ee87d6f5d74448c64fbb152e [2753/2753] i2c: zhaoxin: Add support for Zhaoxin I2C controller config: x86_64-buildonly-randconfig-001-20250827 (https://download.01.org/0day-ci/archive/20250827/202508271625.s6br6gQM-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250827/202508271625.s6br6gQM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508271625.s6br6gQM-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/i2c/busses/i2c-zhaoxin.c:12: In file included from include/linux/i2c.h:19: In file included from include/linux/regulator/consumer.h:35: In file included from include/linux/suspend.h:5: In file included from include/linux/swap.h:9: In file included from include/linux/memcontrol.h:20: In file included from include/linux/mm.h:2235: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> drivers/i2c/busses/i2c-zhaoxin.c:176:5: warning: no previous prototype for function 'zxi2c_fifo_irq_xfer' [-Wmissing-prototypes] 176 | int zxi2c_fifo_irq_xfer(struct zxi2c *i2c, bool irq) | ^ drivers/i2c/busses/i2c-zhaoxin.c:176:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 176 | int zxi2c_fifo_irq_xfer(struct zxi2c *i2c, bool irq) | ^ | static >> drivers/i2c/busses/i2c-zhaoxin.c:314:5: warning: no previous prototype for function 'zxi2c_xfer' [-Wmissing-prototypes] 314 | int zxi2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) | ^ drivers/i2c/busses/i2c-zhaoxin.c:314:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 314 | int zxi2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) | ^ | static 3 warnings generated. vim +/zxi2c_fifo_irq_xfer +176 drivers/i2c/busses/i2c-zhaoxin.c 174 175 /* 'irq == true' means in interrupt context */ > 176 int zxi2c_fifo_irq_xfer(struct zxi2c *i2c, bool irq) 177 { 178 u16 i; 179 u8 tmp; 180 struct i2c_msg *msg = i2c->msg; 181 void __iomem *base = i2c->base; 182 bool read = !!(msg->flags & I2C_M_RD); 183 184 if (irq) { 185 /* get the received data */ 186 if (read) 187 for (i = 0; i < i2c->xfer_len; i++) 188 msg->buf[i2c->xfered_len + i] = ioread8(base + ZXI2C_REG_HRDR); 189 190 i2c->xfered_len += i2c->xfer_len; 191 if (i2c->xfered_len == msg->len) 192 return 1; 193 } 194 195 /* reset fifo buffer */ 196 tmp = ioread8(base + ZXI2C_REG_HCR); 197 iowrite8(tmp | ZXI2C_HCR_RST_FIFO, base + ZXI2C_REG_HCR); 198 199 /* set xfer len */ 200 i2c->xfer_len = min_t(u16, msg->len - i2c->xfered_len, ZXI2C_FIFO_SIZE); 201 if (read) { 202 iowrite8(i2c->xfer_len - 1, base + ZXI2C_REG_HRLR); 203 } else { 204 iowrite8(i2c->xfer_len - 1, base + ZXI2C_REG_HTLR); 205 /* set write data */ 206 for (i = 0; i < i2c->xfer_len; i++) 207 iowrite8(msg->buf[i2c->xfered_len + i], base + ZXI2C_REG_HTDR); 208 } 209 210 /* prepare to stop transmission */ 211 if (i2c->hrv && msg->len == (i2c->xfered_len + i2c->xfer_len)) { 212 tmp = ioread8(base + ZXI2C_REG_CR); 213 tmp |= read ? ZXI2C_CR_RX_END : ZXI2C_CR_TX_END; 214 iowrite8(tmp, base + ZXI2C_REG_CR); 215 } 216 217 if (irq) { 218 /* continue transmission */ 219 tmp = ioread8(base + ZXI2C_REG_CR); 220 iowrite8(tmp |= ZXI2C_CR_CPU_RDY, base + ZXI2C_REG_CR); 221 } else { 222 u16 tcr_val = i2c->tcr; 223 224 /* start transmission */ 225 tcr_val |= read ? ZXI2C_TCR_READ : 0; 226 writew(tcr_val | msg->addr, base + ZXI2C_REG_TCR); 227 } 228 229 return 0; 230 } 231 232 static irqreturn_t zxi2c_isr(int irq, void *data) 233 { 234 struct zxi2c *i2c = data; 235 void __iomem *base = i2c->base; 236 u8 status; 237 238 /* save the status and write-clear it */ 239 status = readw(base + ZXI2C_REG_ISR); 240 if (!status) 241 return IRQ_NONE; 242 243 writew(status, base + ZXI2C_REG_ISR); 244 245 i2c->ret = 0; 246 if (status & ZXI2C_ISR_NACK_ADDR) 247 i2c->ret = -EIO; 248 249 if (!i2c->ret) { 250 if (i2c->mode == ZXI2C_BYTE_MODE) 251 i2c->ret = zxi2c_irq_xfer(i2c); 252 else 253 i2c->ret = zxi2c_fifo_irq_xfer(i2c, true); 254 } 255 256 if (i2c->ret) 257 complete(&i2c->complete); 258 259 return IRQ_HANDLED; 260 } 261 262 static int zxi2c_write(struct zxi2c *i2c, struct i2c_msg *msg, int last) 263 { 264 u16 tcr_val = i2c->tcr; 265 void __iomem *base = i2c->base; 266 267 i2c->last = last; 268 269 writew(msg->buf[0] & 0xFF, base + ZXI2C_REG_CDR); 270 271 reinit_completion(&i2c->complete); 272 273 tcr_val |= msg->addr & 0x7f; 274 275 writew(tcr_val, base + ZXI2C_REG_TCR); 276 277 if (!wait_for_completion_timeout(&i2c->complete, ZXI2C_TIMEOUT)) 278 return -ETIMEDOUT; 279 280 return i2c->ret; 281 } 282 283 static int zxi2c_read(struct zxi2c *i2c, struct i2c_msg *msg, bool first) 284 { 285 u16 val, tcr_val = i2c->tcr; 286 void __iomem *base = i2c->base; 287 288 val = readw(base + ZXI2C_REG_CR); 289 val &= ~(ZXI2C_CR_TX_END | ZXI2C_CR_RX_END); 290 291 if (msg->len == 1) 292 val |= ZXI2C_CR_RX_END; 293 294 writew(val, base + ZXI2C_REG_CR); 295 296 reinit_completion(&i2c->complete); 297 298 tcr_val |= ZXI2C_TCR_READ | (msg->addr & 0x7f); 299 300 writew(tcr_val, base + ZXI2C_REG_TCR); 301 302 if (!first) { 303 val = readw(base + ZXI2C_REG_CR); 304 val |= ZXI2C_CR_CPU_RDY; 305 writew(val, base + ZXI2C_REG_CR); 306 } 307 308 if (!wait_for_completion_timeout(&i2c->complete, ZXI2C_TIMEOUT)) 309 return -ETIMEDOUT; 310 311 return i2c->ret; 312 } 313 > 314 int zxi2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) 315 { 316 struct i2c_msg *msg; 317 int i; 318 int ret = 0; 319 struct zxi2c *i2c = i2c_get_adapdata(adap); 320 321 i2c->mode = ZXI2C_BYTE_MODE; 322 for (i = 0; ret >= 0 && i < num; i++) { 323 i2c->msg = msg = &msgs[i]; 324 i2c->xfered_len = 0; 325 if (msg->len == 0) 326 return -EIO; 327 328 if (msg->flags & I2C_M_RD) 329 ret = zxi2c_read(i2c, msg, i == 0); 330 else 331 ret = zxi2c_write(i2c, msg, (i + 1) == num); 332 } 333 334 return (ret < 0) ? ret : i; 335 } 336 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] page_pool: Fix use-after-free in page_pool_recycle_in_ring
by Dong Chenchen 27 Aug '25

27 Aug '25

mainline inclusion from mainline-v6.16-rc1 commit 271683bb2cf32e5126c592b5d5e6a756fa374fd9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUI9J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------- syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline] root cause is: page_pool_recycle_in_ring ptr_ring_produce spin_lock(&r->producer_lock); WRITE_ONCE(r->queue[r->producer++], ptr) //recycle last page to pool page_pool_release page_pool_scrub page_pool_empty_ring ptr_ring_consume page_pool_return_page //release all page __page_pool_destroy free_percpu(pool->recycle_stats); free(pool) //free spin_unlock(&r->producer_lock); //pool->ring uaf read recycle_stat_inc(pool, ring); page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled. recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning. Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Link: https://lore.kernel.org/netdev/20250513083123.3514193-1-dongchenchen2@huawe… Fixes: ff7d6b27f894 ("page_pool: refurbish version of page_pool code") Reported-by: syzbot+204a4382fcb3311f3858(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=204a4382fcb3311f3858 Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Reviewed-by: Mina Almasry <almasrymina(a)google.com> Link: https://patch.msgid.link/20250527114152.3119109-1-dongchenchen2@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/page_pool.c [commit 4dec64c52e24 and 7aee8429eedd are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/core/page_pool.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/net/core/page_pool.c b/net/core/page_pool.c index 2f2f63c8cf4b..cb7238043a33 100644 --- a/net/core/page_pool.c +++ b/net/core/page_pool.c @@ -140,9 +140,9 @@ u64 *page_pool_ethtool_stats_get(u64 *data, void *stats) EXPORT_SYMBOL(page_pool_ethtool_stats_get); #else -#define alloc_stat_inc(pool, __stat) -#define recycle_stat_inc(pool, __stat) -#define recycle_stat_add(pool, __stat, val) +#define alloc_stat_inc(...) do { } while (0) +#define recycle_stat_inc(...) do { } while (0) +#define recycle_stat_add(...) do { } while (0) #endif static bool page_pool_producer_lock(struct page_pool *pool) @@ -547,19 +547,16 @@ static void page_pool_return_page(struct page_pool *pool, struct page *page) static bool page_pool_recycle_in_ring(struct page_pool *pool, struct page *page) { - int ret; - /* BH protection not needed if current is softirq */ - if (in_softirq()) - ret = ptr_ring_produce(&pool->ring, page); - else - ret = ptr_ring_produce_bh(&pool->ring, page); + bool in_softirq, ret; - if (!ret) { + /* BH protection not needed if current is softirq */ + in_softirq = page_pool_producer_lock(pool); + ret = !__ptr_ring_produce(&pool->ring, page); + if (ret) recycle_stat_inc(pool, ring); - return true; - } + page_pool_producer_unlock(pool, in_softirq); - return false; + return ret; } /* Only allow direct recycling in special circumstances, into the @@ -848,10 +845,14 @@ static void page_pool_scrub(struct page_pool *pool) static int page_pool_release(struct page_pool *pool) { + bool in_softirq; int inflight; page_pool_scrub(pool); inflight = page_pool_inflight(pool); + /* Acquire producer lock to make sure producers have exited. */ + in_softirq = page_pool_producer_lock(pool); + page_pool_producer_unlock(pool, in_softirq); if (!inflight) page_pool_free(pool); -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] bpf, sockmap: Fix CVE-2025-38154
by Dong Chenchen 27 Aug '25

27 Aug '25

Fix CVE-2025-38154 Jiayuan Chen (2): bpf, sockmap: fix duplicated data transmission bpf, sockmap: Avoid using sk_socket after free when sending net/core/skmsg.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
by Dong Chenchen 27 Aug '25

27 Aug '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.16-rc1 commit b85e3367a5716ed3662a4fe266525190d2af76df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4OD CVE: CVE-2025-38201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. Similar to: b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX") Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_set_pipapo.c [commit 07ace0bbe03b and 9f439bd6ef4f are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 4274831b6e67..ebd0f704c863 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -667,6 +667,11 @@ static int pipapo_resize(struct nft_pipapo_field *f, int old_rules, int rules) } mt: + if (rules > (INT_MAX / sizeof(*new_mt))) { + kvfree(new_lt); + return -ENOMEM; + } + new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL); if (!new_mt) { kvfree(new_lt); @@ -1359,6 +1364,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) src->bsize * sizeof(*dst->lt) * src->groups * NFT_PIPAPO_BUCKETS(src->bb)); + if (src->rules > (INT_MAX / sizeof(*src->mt))) + goto out_mt; + dst->mt = kvmalloc(src->rules * sizeof(*src->mt), GFP_KERNEL); if (!dst->mt) goto out_mt; -- 2.25.1

2 1

[PATCH OLK-6.6] net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()
by Dong Chenchen 27 Aug '25

27 Aug '25

From: Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> stable inclusion from stable-v6.6.95 commit 66bba1fd5bad548c03f7e42669a59f3f4d8211cc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4NT CVE: CVE-2025-38183 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e353b0854d3a1a31cb061df8d022fbfea53a0f24 ] Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8). This seems correct and aligns with the PTP interrupt status register (PTP_INT_STS) specifications. However, lan743x_ptp_io_event_clock_get() writes to ptp->extts[] with only LAN743X_PTP_N_EXTTS(4) elements, using channel as an index: lan743x_ptp_io_event_clock_get(..., u8 channel,...) { ... /* Update Local timestamp */ extts = &ptp->extts[channel]; extts->ts.tv_sec = sec; ... } To avoid an out-of-bounds write and utilize all the supported GPIO inputs, set LAN743X_PTP_N_EXTTS to 8. Detected using the static analysis tool - Svace. Fixes: 60942c397af6 ("net: lan743x: Add support for PTP-IO Event Input External Timestamp (extts)") Signed-off-by: Alexey Kodanev <aleksei.kodanev(a)bell-sw.com> Reviewed-by: Jacob Keller <jacob.e.keller(a)intel.com> Acked-by: Rengarajan S <rengarajan.s(a)microchip.com> Link: https://patch.msgid.link/20250616113743.36284-1-aleksei.kodanev@bell-sw.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/microchip/lan743x_ptp.h [commit b1de3c0df7ab is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/microchip/lan743x_ptp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/microchip/lan743x_ptp.h b/drivers/net/ethernet/microchip/lan743x_ptp.h index e26d4eff7133..b7f2d425427d 100644 --- a/drivers/net/ethernet/microchip/lan743x_ptp.h +++ b/drivers/net/ethernet/microchip/lan743x_ptp.h @@ -18,9 +18,9 @@ */ #define LAN743X_PTP_N_EVENT_CHAN 2 #define LAN743X_PTP_N_PEROUT LAN743X_PTP_N_EVENT_CHAN -#define LAN743X_PTP_N_EXTTS 4 -#define LAN743X_PTP_N_PPS 0 #define PCI11X1X_PTP_IO_MAX_CHANNELS 8 +#define LAN743X_PTP_N_EXTTS PCI11X1X_PTP_IO_MAX_CHANNELS +#define LAN743X_PTP_N_PPS 0 struct lan743x_adapter; -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] net: xfrm: Fix CVE-2025-38097
by Dong Chenchen 27 Aug '25

27 Aug '25

Fix CVE-2025-38097 Dong Chenchen (1): net: xfrm: Fix kabi breakage of struct xfrm_state Sabrina Dubroca (1): espintcp: remove encap socket caching to avoid reference leak net/ipv4/esp4.c | 49 ++++--------------------------------------- net/ipv6/esp6.c | 49 ++++--------------------------------------- net/xfrm/xfrm_state.c | 3 --- 3 files changed, 8 insertions(+), 93 deletions(-) -- 2.25.1

2 3