- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3355/3355] drivers/xcu/xcu_group.c:41:5: warning: no previous prototype for function '__xcu_group_attach'
by kernel test robot 28 Nov '25

28 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ae3faae9efa6dabe1e7613b5e5d3758ffaefb86a commit: b7261a251299bfdababe53a848084af2ecfcc1ae [3355/3355] xcu: Add base NPU driver support config: loongarch-allyesconfig (https://download.01.org/0day-ci/archive/20251128/202511281657.lWcX7PhK-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9e9fe08b16ea2c4d9867fb4974edf2a3776d6ece) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251128/202511281657.lWcX7PhK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511281657.lWcX7PhK-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/xcu/xcu_group.c:41:5: warning: no previous prototype for function '__xcu_group_attach' [-Wmissing-prototypes] 41 | int __xcu_group_attach(struct xcu_group *new_group, | ^ drivers/xcu/xcu_group.c:41:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 41 | int __xcu_group_attach(struct xcu_group *new_group, | ^ | static 1 warning generated. vim +/__xcu_group_attach +41 drivers/xcu/xcu_group.c 40 > 41 int __xcu_group_attach(struct xcu_group *new_group, 42 struct xcu_group *previous_group) 43 { 44 int id = new_group->id; 45 46 if (id == -1) 47 id = idr_alloc(&previous_group->next_layer, new_group, 0, 48 INT_MAX, GFP_KERNEL); 49 else 50 id = idr_alloc(&previous_group->next_layer, new_group, id, 51 id + 1, GFP_KERNEL); 52 53 if (id < 0) { 54 XSCHED_ERR("Fail to attach xcu_group: id conflict @ %s\n", 55 __func__); 56 return -EEXIST; 57 } 58 new_group->id = id; 59 new_group->previous_layer = previous_group; 60 61 return 0; 62 } 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] page_pool: Track DMA-mapped pages and unmap them when destroying the pool
by Dong Chenchen 28 Nov '25

28 Nov '25

Track DMA-mapped pages and unmap them when destroying the pool Dong Chenchen (1): page_pool: Fix kabi broken in struct page_pool Jakub Kicinski (1): net: page_pool: factor out releasing DMA from releasing the page Jesper Dangaard Brouer (1): mm/page_pool: catch page_pool memory leaks Toke Høiland-Jørgensen (3): page_pool: Move pp_magic check into helper functions page_pool: Track DMA-mapped pages and unmap them when destroying the pool page_pool: Fix PP_MAGIC_MASK to avoid crashing on some 32-bit arches .../net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +- include/linux/mm.h | 68 ++++++++ include/linux/poison.h | 4 + include/net/page_pool/types.h | 6 +- mm/page_alloc.c | 3 + net/core/page_pool.c | 148 +++++++++++++++--- net/core/skbuff.c | 9 +- net/core/xdp.c | 4 +- 8 files changed, 215 insertions(+), 31 deletions(-) -- 2.25.1

2 7

[openeuler:OLK-6.6 3406/3406] htmldocs: ./include/ub/cdma/cdma_api.h:94: warning: Function parameter or member 'trans_mode' not described in 'queue_cfg'
by kernel test robot 28 Nov '25

28 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 4e0f6ff6542664d2a6d350e8490d042a466aa0e6 commit: 27d2c29e4512954c7efcee4fa62b13fd67ce0f93 [3406/3406] ub: cdma: add CDMA driver-api documentation description reproduce: (https://download.01.org/0day-ci/archive/20251128/202511280817.PxN8S1S4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511280817.PxN8S1S4-lkp@intel.com/ All warnings (new ones prefixed by >>): Error: Cannot open file ./include/linux/tty_port.h Error: Cannot open file ./include/linux/tty_port.h Error: Cannot open file ./include/linux/tty.h Error: Cannot open file ./include/linux/tty.h Error: Cannot open file ./include/linux/tty.h >> ./include/ub/cdma/cdma_api.h:94: warning: Function parameter or member 'trans_mode' not described in 'queue_cfg' ./include/ub/ubase/ubase_comm_ctrlq.h:90: warning: Function parameter or member 'is_async' not described in 'ubase_ctrlq_msg' ./include/ub/ubase/ubase_comm_dev.h:318: warning: Function parameter or member 'sl_num' not described in 'ubase_adev_qos' ./include/ub/ubase/ubase_comm_dev.h:318: warning: Function parameter or member 'sl' not described in 'ubase_adev_qos' ./include/ub/ubase/ubase_comm_dev.h:318: warning: Function parameter or member 'tp_sl_num' not described in 'ubase_adev_qos' ./include/ub/ubase/ubase_comm_dev.h:318: warning: Function parameter or member 'tp_sl' not described in 'ubase_adev_qos' -- WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 8.2.3 -function tty_port ./include/linux/tty_port.h' failed with return code 1 WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 8.2.3 -function tty_port_operations ./include/linux/tty_port.h' failed with return code 1 WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 8.2.3 -function tty_kref_get ./include/linux/tty.h' failed with return code 1 WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 8.2.3 -function TTY Struct Flags ./include/linux/tty.h' failed with return code 1 WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 8.2.3 -function tty_struct ./include/linux/tty.h' failed with return code 1 >> Documentation/driver-api/ub/cdma.rst:137: WARNING: Bullet list ends without a blank line; unexpected unindent. [docutils] >> Documentation/driver-api/ub/cdma.rst:137: WARNING: Inline emphasis start-string without end-string. [docutils] >> Documentation/driver-api/ub/cdma.rst:138: WARNING: Definition list ends without a blank line; unexpected unindent. [docutils] Documentation/driver-api/ub/index.rst:3: ERROR: Undefined substitution referenced: "copy". [docutils] Documentation/driver-api/ub/ubus:6: ./include/ub/ubus/ubus.h:317: WARNING: Inline emphasis start-string without end-string. [docutils] WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 8.2.3 -internal ./include/linux/usb/gadget.h' failed with return code 2 WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 8.2.3 -internal ./include/linux/usb/composite.h' failed with return code 2 WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 8.2.3 -function typec_altmode_driver -function typec_altmode_ops ./include/linux/usb/typec_altmode.h' failed with return code 1 vim +94 ./include/ub/cdma/cdma_api.h 3aa7aa335383c2 Zhipeng Lu 2025-08-29 74 27d2c29e451295 Zhipeng Lu 2025-11-24 75 /** 27d2c29e451295 Zhipeng Lu 2025-11-24 76 * struct queue_cfg - DMA queue config structure 27d2c29e451295 Zhipeng Lu 2025-11-24 77 * @queue_depth: queue depth 27d2c29e451295 Zhipeng Lu 2025-11-24 78 * @priority: the priority of JFS, ranging from [0, 15] 27d2c29e451295 Zhipeng Lu 2025-11-24 79 * @user_ctx: user private data information, optional 27d2c29e451295 Zhipeng Lu 2025-11-24 80 * @dcna: remote device CNA 27d2c29e451295 Zhipeng Lu 2025-11-24 81 * @rmt_eid: remote device EID 27d2c29e451295 Zhipeng Lu 2025-11-24 82 * @rsv_bitmap: reserved field bitmap 27d2c29e451295 Zhipeng Lu 2025-11-24 83 * @rsvd: reserved field array 27d2c29e451295 Zhipeng Lu 2025-11-24 84 */ eecfd8889f72f8 Zhipeng Lu 2025-08-28 85 struct queue_cfg { eecfd8889f72f8 Zhipeng Lu 2025-08-28 86 u32 queue_depth; eecfd8889f72f8 Zhipeng Lu 2025-08-28 87 u8 priority; eecfd8889f72f8 Zhipeng Lu 2025-08-28 88 u64 user_ctx; eecfd8889f72f8 Zhipeng Lu 2025-08-28 89 u32 dcna; eecfd8889f72f8 Zhipeng Lu 2025-08-28 90 struct dev_eid rmt_eid; eecfd8889f72f8 Zhipeng Lu 2025-08-28 91 u32 trans_mode; 34c67ed8f4c107 Zhipeng Lu 2025-11-11 92 u32 rsv_bitmap; 34c67ed8f4c107 Zhipeng Lu 2025-11-11 93 u32 rsvd[6]; eecfd8889f72f8 Zhipeng Lu 2025-08-28 @94 }; eecfd8889f72f8 Zhipeng Lu 2025-08-28 95 :::::: The code at line 94 was first introduced by commit :::::: eecfd8889f72f8c03c8af731e508dc3cb46b4b14 ub: cdma: support for allocating queue :::::: TO: Zhipeng Lu <luzhipeng8(a)h-partners.com> :::::: CC: Zhipeng Lu <luzhipeng8(a)h-partners.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Fixes of page cache limit
by Zhang Qilong 28 Nov '25

28 Nov '25

Zhang Qilong (2): mm: Add page cache limit check before queueing shrink worker mm: Replace deferrable timer with delay timer for shrink worker mm/page_cache_limit.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10 0/2] Fixes of page cache limit
by Zhang Qilong 28 Nov '25

28 Nov '25

Zhang Qilong (2): mm: Add page cache limit check before queueing shrink worker mm: Replace deferrable timer with delay timer for shrink worker mm/page_cache_limit.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] sched: Fix race between yield_to() and try_to_wake_up()
by Xia Fukun 28 Nov '25

28 Nov '25

From: Tianchen Ding <dtcccc(a)linux.alibaba.com> mainline inclusion from mainline-v6.18-rc1 commit 5d808c78d97251af1d3a3e4f253e7d6c39fd871e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CE7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We met a SCHED_WARN in set_next_buddy(): __warn_printk set_next_buddy yield_to_task_fair yield_to kvm_vcpu_yield_to [kvm] ... After a short dig, we found the rq_lock held by yield_to() may not be exactly the rq that the target task belongs to. There is a race window against try_to_wake_up(). CPU0 target_task blocking on CPU1 lock rq0 & rq1 double check task_rq == p_rq, ok woken to CPU2 (lock task_pi & rq2) task_rq = rq2 yield_to_task_fair (w/o lock rq2) In this race window, yield_to() is operating the task w/o the correct lock. Fix this by taking task pi_lock first. Fixes: d95f41220065 ("sched: Add yield_to(task, preempt) functionality") Signed-off-by: Tianchen Ding <dtcccc(a)linux.alibaba.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20241231055020.6521-1-dtcccc@linux.alibaba.com Conflicts: kernel/sched/syscalls.c kernel/sched/core.c [Context differences.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 2740e9b918f5..d9afdd7e588e 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9042,7 +9042,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) unsigned long flags; int yielded = 0; - local_irq_save(flags); + raw_spin_lock_irqsave(&p->pi_lock, flags); rq = this_rq(); again: @@ -9085,7 +9085,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) out_unlock: double_rq_unlock(rq, p_rq); out_irq: - local_irq_restore(flags); + raw_spin_unlock_irqrestore(&p->pi_lock, flags); if (yielded > 0) schedule(); -- 2.34.1

2 1

[PATCH OLK-5.10] sched: Fix race between yield_to() and try_to_wake_up()
by Xia Fukun 28 Nov '25

28 Nov '25

From: Tianchen Ding <dtcccc(a)linux.alibaba.com> mainline inclusion from mainline-v6.18-rc1 commit 5d808c78d97251af1d3a3e4f253e7d6c39fd871e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CE7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We met a SCHED_WARN in set_next_buddy(): __warn_printk set_next_buddy yield_to_task_fair yield_to kvm_vcpu_yield_to [kvm] ... After a short dig, we found the rq_lock held by yield_to() may not be exactly the rq that the target task belongs to. There is a race window against try_to_wake_up(). CPU0 target_task blocking on CPU1 lock rq0 & rq1 double check task_rq == p_rq, ok woken to CPU2 (lock task_pi & rq2) task_rq = rq2 yield_to_task_fair (w/o lock rq2) In this race window, yield_to() is operating the task w/o the correct lock. Fix this by taking task pi_lock first. Fixes: d95f41220065 ("sched: Add yield_to(task, preempt) functionality") Signed-off-by: Tianchen Ding <dtcccc(a)linux.alibaba.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20241231055020.6521-1-dtcccc@linux.alibaba.com Conflicts: kernel/sched/syscalls.c kernel/sched/core.c [Context differences.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 5d2937935b47..a7af86e1234c 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -7372,7 +7372,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) unsigned long flags; int yielded = 0; - local_irq_save(flags); + raw_spin_lock_irqsave(&p->pi_lock, flags); rq = this_rq(); again: @@ -7415,7 +7415,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) out_unlock: double_rq_unlock(rq, p_rq); out_irq: - local_irq_restore(flags); + raw_spin_unlock_irqrestore(&p->pi_lock, flags); if (yielded > 0) schedule(); -- 2.34.1

2 1

[PATCH OLK-5.10] iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
by Jiacheng Yu 28 Nov '25

28 Nov '25

From: Pavel Paklov <Pavel.Paklov(a)cyberprotect.ru> stable inclusion from stable-v5.15.182 commit 466d9da267079a8d3b69fa72dfa3a732e1f6dbb5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC991Z CVE: CVE-2025-37927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8dee308e4c01dea48fc104d37f92d5b58c50b96c upstream. There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn't take into account the lengths of individual hid and uid buffers so the check is insufficient in some cases. For example if the length of hid string is 4 and the length of the uid string is 260, the length of str will be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer which size is 256. The same applies to the hid string with length 13 and uid string with length 250. Check the length of hid and uid strings separately to prevent buffer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") Cc: stable(a)vger.kernel.org Signed-off-by: Pavel Paklov <Pavel.Paklov(a)cyberprotect.ru> Link: https://lore.kernel.org/r/20250325092259.392844-1-Pavel.Paklov@cyberprotect… Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/iommu/amd/init.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 3c9e01a5a558..d0a4ec42fd12 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3280,6 +3280,14 @@ static int __init parse_ivrs_acpihid(char *str) while (*uid == '0' && *(uid + 1)) uid++; + if (strlen(hid) >= ACPIHID_HID_LEN) { + pr_err("Invalid command line: hid is too long\n"); + return 1; + } else if (strlen(uid) >= ACPIHID_UID_LEN) { + pr_err("Invalid command line: uid is too long\n"); + return 1; + } + i = early_acpihid_map_size++; memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
by Jiacheng Yu 28 Nov '25

28 Nov '25

From: Pavel Paklov <Pavel.Paklov(a)cyberprotect.ru> stable inclusion from stable-v6.6.90 commit 13d67528e1ae4486e9ab24b70122fab104c73c29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC991Z CVE: CVE-2025-37927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8dee308e4c01dea48fc104d37f92d5b58c50b96c upstream. There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn't take into account the lengths of individual hid and uid buffers so the check is insufficient in some cases. For example if the length of hid string is 4 and the length of the uid string is 260, the length of str will be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer which size is 256. The same applies to the hid string with length 13 and uid string with length 250. Check the length of hid and uid strings separately to prevent buffer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") Cc: stable(a)vger.kernel.org Signed-off-by: Pavel Paklov <Pavel.Paklov(a)cyberprotect.ru> Link: https://lore.kernel.org/r/20250325092259.392844-1-Pavel.Paklov@cyberprotect… Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/iommu/amd/init.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 4beddd8cc420..e3d4a23b66fd 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3690,6 +3690,14 @@ static int __init parse_ivrs_acpihid(char *str) while (*uid == '0' && *(uid + 1)) uid++; + if (strlen(hid) >= ACPIHID_HID_LEN) { + pr_err("Invalid command line: hid is too long\n"); + return 1; + } else if (strlen(uid) >= ACPIHID_UID_LEN) { + pr_err("Invalid command line: uid is too long\n"); + return 1; + } + i = early_acpihid_map_size++; memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); -- 2.43.0

2 1

[PATCH OLK-6.6 v7 0/5] bugfix for xcall2.0
by Xinyu Zheng 28 Nov '25

28 Nov '25

Xinyu Zheng (5): xcall2.0: prefetch: fix value name typos in __do_sys_epoll_pwait xcall2.0: prefetch: keep prefetch module name same with file name xcall2.0: add xcall_subdir_create help to create subdir below /proc/xcall xcall2.0: Fix mem leak in proc_xcall_command xcall2.0: prefetch: introduce struct prefetch_mm_data arch/arm64/include/asm/xcall.h | 4 +- arch/arm64/kernel/xcall/core.c | 25 ++++- arch/arm64/kernel/xcall/proc.c | 61 ++---------- drivers/staging/xcall/prefetch.c | 159 +++++++++++++++++++++---------- include/linux/xcall.h | 1 + 5 files changed, 143 insertions(+), 107 deletions(-) -- 2.34.1

2 6