- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1418/1418] mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool'
by kernel test robot 30 Nov '25

30 Nov '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d495515f012a96ae472e8ee75c66680fbdabaddb commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1418/1418] dhugetlb: backport dynamic hugetlb feature config: x86_64-buildonly-randconfig-003-20250207 (https://download.01.org/0day-ci/archive/20251130/202511300245.MJmB71tp-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251130/202511300245.MJmB71tp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511300245.MJmB71tp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ mm/hugetlb.c:1370:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1370 | void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) | ^ | static In file included from mm/hugetlb.c:14: include/linux/mempolicy.h:329:13: warning: unused function '__do_mbind' [-Wunused-function] 329 | static long __do_mbind(unsigned long start, unsigned long len, | ^~~~~~~~~~ 2 warnings generated. vim +/free_huge_page_to_dhugetlb_pool +1370 mm/hugetlb.c 1324 1325 #ifdef CONFIG_DYNAMIC_HUGETLB 1326 static void free_huge_page_to_dhugetlb_pool(struct page *page, 1327 bool restore_reserve) 1328 { 1329 struct hstate *h = page_hstate(page); 1330 struct dhugetlb_pool *hpool; 1331 1332 hpool = get_dhugetlb_pool_from_dhugetlb_pagelist(page); 1333 if (unlikely(!hpool)) { 1334 pr_err("dhugetlb: free error: get hpool failed\n"); 1335 return; 1336 } 1337 1338 spin_lock(&hpool->lock); 1339 ClearPagePool(page); 1340 set_compound_page_dtor(page, NULL_COMPOUND_DTOR); 1341 if (!hstate_is_gigantic(h)) { 1342 list_add(&page->lru, &hpool->dhugetlb_2M_freelists); 1343 hpool->free_reserved_2M++; 1344 hpool->used_2M--; 1345 if (restore_reserve) { 1346 hpool->mmap_reserved_2M++; 1347 trace_dhugetlb_acct_memory(hpool, 1348 hpool->mmap_reserved_2M, 1349 DHUGETLB_RESV_2M); 1350 } 1351 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_2M, 1352 DHUGETLB_FREE_2M); 1353 } else { 1354 list_add(&page->lru, &hpool->dhugetlb_1G_freelists); 1355 hpool->free_reserved_1G++; 1356 hpool->used_1G--; 1357 if (restore_reserve) { 1358 hpool->mmap_reserved_1G++; 1359 trace_dhugetlb_acct_memory(hpool, 1360 hpool->mmap_reserved_1G, 1361 DHUGETLB_RESV_1G); 1362 } 1363 trace_dhugetlb_alloc_free(hpool, page, hpool->free_reserved_1G, 1364 DHUGETLB_FREE_1G); 1365 } 1366 spin_unlock(&hpool->lock); 1367 dhugetlb_pool_put(hpool); 1368 } 1369 #else > 1370 void free_huge_page_to_dhugetlb_pool(struct page *page, bool restore_reserve) 1371 { 1372 } 1373 #endif 1374 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] net/sched: sch_qfq: Fix CVE-2025-38477
by Dong Chenchen 29 Nov '25

29 Nov '25

Fix CVE-2025-38477 Xiang Mei (2): net/sched: sch_qfq: Fix race condition on qfq_aggregate net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class net/sched/sch_qfq.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] net/sched: Fix backlog accounting in qdisc_dequeue_internal
by Dong Chenchen 29 Nov '25

29 Nov '25

From: William Liu <will(a)willsroot.io> mainline inclusion from mainline-v6.17-rc1 commit 52bf272636bda69587952b35ae97690b8dc89941 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWO33 CVE: CVE-2025-39677 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to the new limit. The problem is the following in the values passed to the subsequent qdisc_tree_reduce_backlog call given a tbf parent: When the tbf parent runs out of tokens, skbs of these qdiscs will be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued, which accounts for both qlen and backlog. However, in the case of qdisc_dequeue_internal, ONLY qlen is accounted for when pulling from gso_skb. This means that these qdiscs are missing a qdisc_qstats_backlog_dec when dropping packets to satisfy the new limit in their change handlers. One can observe this issue with the following (with tc patched to support a limit of 0): export TARGET=fq tc qdisc del dev lo root tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000 echo ''; echo 'add child'; tc -s -d qdisc show dev lo ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null echo ''; echo 'after ping'; tc -s -d qdisc show dev lo tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0 echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo tc qdisc replace dev lo handle 2: parent 1:1 sfq echo ''; echo 'post graft'; tc -s -d qdisc show dev lo The second to last show command shows 0 packets but a positive number (74) of backlog bytes. The problem becomes clearer in the last show command, where qdisc_purge_queue triggers qdisc_tree_reduce_backlog with the positive backlog and causes an underflow in the tbf parent's backlog (4096 Mb instead of 0). To fix this issue, the codepath for all clients of qdisc_dequeue_internal has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel. qdisc_dequeue_internal handles the backlog adjustments for all cases that do not directly use the dequeue handler. The old fq_codel_change limit adjustment loop accumulated the arguments to the subsequent qdisc_tree_reduce_backlog call through the cstats field. However, this is confusing and error prone as fq_codel_dequeue could also potentially mutate this field (which qdisc_dequeue_internal calls in the non gso_skb case), so we have unified the code here with other qdiscs. Fixes: 2d3cbfd6d54a ("net_sched: Flush gso_skb list too during ->change()") Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM") Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc") Signed-off-by: William Liu <will(a)willsroot.io> Reviewed-by: Savino Dicanosa <savy(a)syst3mfailure.io> Link: https://patch.msgid.link/20250812235725.45243-1-will@willsroot.io Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_codel.c net/sched/sch_hhf.c net/sched/sch_pie.c net/sched/sch_fq.c [commit c45bd26c829e, 293c7e2b3e2f, 29f834aa326e and 6c00dc4fdb40 are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/sch_generic.h | 11 ++++++++--- net/sched/sch_codel.c | 12 +++++++----- net/sched/sch_fq.c | 12 +++++++----- net/sched/sch_fq_codel.c | 12 +++++++----- net/sched/sch_fq_pie.c | 12 +++++++----- net/sched/sch_hhf.c | 12 +++++++----- net/sched/sch_pie.c | 12 +++++++----- 7 files changed, 50 insertions(+), 33 deletions(-) diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index f861c7f25a9f..eb038ed8becf 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -1046,12 +1046,17 @@ static inline struct sk_buff *qdisc_dequeue_internal(struct Qdisc *sch, bool dir skb = __skb_dequeue(&sch->gso_skb); if (skb) { sch->q.qlen--; + qdisc_qstats_backlog_dec(sch, skb); return skb; } - if (direct) - return __qdisc_dequeue_head(&sch->q); - else + if (direct) { + skb = __qdisc_dequeue_head(&sch->q); + if (skb) + qdisc_qstats_backlog_dec(sch, skb); + return skb; + } else { return sch->dequeue(sch); + } } static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch) diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c index 63c02040b426..a6e1f44cbb6a 100644 --- a/net/sched/sch_codel.c +++ b/net/sched/sch_codel.c @@ -130,9 +130,9 @@ static const struct nla_policy codel_policy[TCA_CODEL_MAX + 1] = { static int codel_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { + unsigned int dropped_pkts = 0, dropped_bytes = 0; struct codel_sched_data *q = qdisc_priv(sch); struct nlattr *tb[TCA_CODEL_MAX + 1]; - unsigned int qlen, dropped = 0; int err; err = nla_parse_nested_deprecated(tb, TCA_CODEL_MAX, opt, @@ -166,15 +166,17 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt, if (tb[TCA_CODEL_ECN]) q->params.ecn = !!nla_get_u32(tb[TCA_CODEL_ECN]); - qlen = sch->q.qlen; while (sch->q.qlen > sch->limit) { struct sk_buff *skb = qdisc_dequeue_internal(sch, true); - dropped += qdisc_pkt_len(skb); - qdisc_qstats_backlog_dec(sch, skb); + if (!skb) + break; + + dropped_pkts++; + dropped_bytes += qdisc_pkt_len(skb); rtnl_qdisc_drop(skb, sch); } - qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); + qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); sch_tree_unlock(sch); return 0; diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c index 91f5ef6be0f2..2223edfd7aa7 100644 --- a/net/sched/sch_fq.c +++ b/net/sched/sch_fq.c @@ -806,11 +806,11 @@ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = { static int fq_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { + unsigned int dropped_pkts = 0, dropped_bytes = 0; struct fq_sched_data *q = qdisc_priv(sch); struct nlattr *tb[TCA_FQ_MAX + 1]; - int err, drop_count = 0; - unsigned drop_len = 0; u32 fq_log; + int err; err = nla_parse_nested_deprecated(tb, TCA_FQ_MAX, opt, fq_policy, NULL); @@ -900,16 +900,18 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt, err = fq_resize(sch, fq_log); sch_tree_lock(sch); } + while (sch->q.qlen > sch->limit) { struct sk_buff *skb = qdisc_dequeue_internal(sch, false); if (!skb) break; - drop_len += qdisc_pkt_len(skb); + + dropped_pkts++; + dropped_bytes += qdisc_pkt_len(skb); rtnl_kfree_skbs(skb, skb); - drop_count++; } - qdisc_tree_reduce_backlog(sch, drop_count, drop_len); + qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); sch_tree_unlock(sch); return err; diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c index 47b5a056165c..43f9c915157c 100644 --- a/net/sched/sch_fq_codel.c +++ b/net/sched/sch_fq_codel.c @@ -365,6 +365,7 @@ static const struct nla_policy fq_codel_policy[TCA_FQ_CODEL_MAX + 1] = { static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { + unsigned int dropped_pkts = 0, dropped_bytes = 0; struct fq_codel_sched_data *q = qdisc_priv(sch); struct nlattr *tb[TCA_FQ_CODEL_MAX + 1]; u32 quantum = 0; @@ -433,13 +434,14 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, q->memory_usage > q->memory_limit) { struct sk_buff *skb = qdisc_dequeue_internal(sch, false); - q->cstats.drop_len += qdisc_pkt_len(skb); + if (!skb) + break; + + dropped_pkts++; + dropped_bytes += qdisc_pkt_len(skb); rtnl_kfree_skbs(skb, skb); - q->cstats.drop_count++; } - qdisc_tree_reduce_backlog(sch, q->cstats.drop_count, q->cstats.drop_len); - q->cstats.drop_count = 0; - q->cstats.drop_len = 0; + qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); sch_tree_unlock(sch); return 0; diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c index 607c580d75e4..cc0da83cb313 100644 --- a/net/sched/sch_fq_pie.c +++ b/net/sched/sch_fq_pie.c @@ -284,10 +284,9 @@ static struct sk_buff *fq_pie_qdisc_dequeue(struct Qdisc *sch) static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { + unsigned int dropped_pkts = 0, dropped_bytes = 0; struct fq_pie_sched_data *q = qdisc_priv(sch); struct nlattr *tb[TCA_FQ_PIE_MAX + 1]; - unsigned int len_dropped = 0; - unsigned int num_dropped = 0; int err; err = nla_parse_nested(tb, TCA_FQ_PIE_MAX, opt, fq_pie_policy, extack); @@ -359,11 +358,14 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt, while (sch->q.qlen > sch->limit) { struct sk_buff *skb = qdisc_dequeue_internal(sch, false); - len_dropped += qdisc_pkt_len(skb); - num_dropped += 1; + if (!skb) + break; + + dropped_pkts++; + dropped_bytes += qdisc_pkt_len(skb); rtnl_kfree_skbs(skb, skb); } - qdisc_tree_reduce_backlog(sch, num_dropped, len_dropped); + qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); sch_tree_unlock(sch); return 0; diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c index 83fc44f20e31..ad414d072a4f 100644 --- a/net/sched/sch_hhf.c +++ b/net/sched/sch_hhf.c @@ -508,9 +508,9 @@ static const struct nla_policy hhf_policy[TCA_HHF_MAX + 1] = { static int hhf_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { + unsigned int dropped_pkts = 0, dropped_bytes = 0; struct hhf_sched_data *q = qdisc_priv(sch); struct nlattr *tb[TCA_HHF_MAX + 1]; - unsigned int qlen, prev_backlog; int err; u64 non_hh_quantum; u32 new_quantum = q->quantum; @@ -557,15 +557,17 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt, q->hhf_evict_timeout = usecs_to_jiffies(us); } - qlen = sch->q.qlen; - prev_backlog = sch->qstats.backlog; while (sch->q.qlen > sch->limit) { struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + if (!skb) + break; + + dropped_pkts++; + dropped_bytes += qdisc_pkt_len(skb); rtnl_kfree_skbs(skb, skb); } - qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, - prev_backlog - sch->qstats.backlog); + qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); sch_tree_unlock(sch); return 0; diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c index 48c5ab8ec143..b67a38a519e5 100644 --- a/net/sched/sch_pie.c +++ b/net/sched/sch_pie.c @@ -138,9 +138,9 @@ static const struct nla_policy pie_policy[TCA_PIE_MAX + 1] = { static int pie_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { + unsigned int dropped_pkts = 0, dropped_bytes = 0; struct pie_sched_data *q = qdisc_priv(sch); struct nlattr *tb[TCA_PIE_MAX + 1]; - unsigned int qlen, dropped = 0; int err; err = nla_parse_nested_deprecated(tb, TCA_PIE_MAX, opt, pie_policy, @@ -188,15 +188,17 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt, nla_get_u32(tb[TCA_PIE_DQ_RATE_ESTIMATOR]); /* Drop excess packets if new limit is lower */ - qlen = sch->q.qlen; while (sch->q.qlen > sch->limit) { struct sk_buff *skb = qdisc_dequeue_internal(sch, true); - dropped += qdisc_pkt_len(skb); - qdisc_qstats_backlog_dec(sch, skb); + if (!skb) + break; + + dropped_pkts++; + dropped_bytes += qdisc_pkt_len(skb); rtnl_qdisc_drop(skb, sch); } - qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); + qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); sch_tree_unlock(sch); return 0; -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] net/sched: sch_qfq: Fix CVE-2025-38477
by Dong Chenchen 29 Nov '25

29 Nov '25

Fix CVE-2025-38477 Xiang Mei (2): net/sched: sch_qfq: Fix race condition on qfq_aggregate net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class net/sched/sch_qfq.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
by Dong Chenchen 29 Nov '25

29 Nov '25

From: Michal Schmidt <mschmidt(a)redhat.com> stable inclusion from stable-v6.6.107 commit 23431998a37764c464737b855c71a81d50992e98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0R4C CVE: CVE-2025-39911 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 915470e1b44e71d1dd07ee067276f003c3521ee3 ] If request_irq() in i40e_vsi_request_irq_msix() fails in an iteration later than the first, the error path wants to free the IRQs requested so far. However, it uses the wrong dev_id argument for free_irq(), so it does not free the IRQs correctly and instead triggers the warning: Trying to free already-free IRQ 173 WARNING: CPU: 25 PID: 1091 at kernel/irq/manage.c:1829 __free_irq+0x192/0x2c0 Modules linked in: i40e(+) [...] CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: [...] RIP: 0010:__free_irq+0x192/0x2c0 [...] Call Trace: <TASK> free_irq+0x32/0x70 i40e_vsi_request_irq_msix.cold+0x63/0x8b [i40e] i40e_vsi_request_irq+0x79/0x80 [i40e] i40e_vsi_open+0x21f/0x2f0 [i40e] i40e_open+0x63/0x130 [i40e] __dev_open+0xfc/0x210 __dev_change_flags+0x1fc/0x240 netif_change_flags+0x27/0x70 do_setlink.isra.0+0x341/0xc70 rtnl_newlink+0x468/0x860 rtnetlink_rcv_msg+0x375/0x450 netlink_rcv_skb+0x5c/0x110 netlink_unicast+0x288/0x3c0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x3a2/0x3d0 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x82/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]--- Use the same dev_id for free_irq() as for request_irq(). I tested this with inserting code to fail intentionally. Fixes: 493fb30011b3 ("i40e: Move q_vectors from pointer to array to array of pointers") Signed-off-by: Michal Schmidt <mschmidt(a)redhat.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Reviewed-by: Subbaraya Sundeep <sbhatta(a)marvell.com> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index 806cec458a07..510388706127 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -4214,7 +4214,7 @@ static int i40e_vsi_request_irq_msix(struct i40e_vsi *vsi, char *basename) irq_num = pf->msix_entries[base + vector].vector; irq_set_affinity_notifier(irq_num, NULL); irq_update_affinity_hint(irq_num, NULL); - free_irq(irq_num, &vsi->q_vectors[vector]); + free_irq(irq_num, vsi->q_vectors[vector]); } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6] net/mlx5e: Harden uplink netdev access against device unbind
by Dong Chenchen 29 Nov '25

29 Nov '25

From: Jianbo Liu <jianbol(a)nvidia.com> mainline inclusion from mainline-v6.17-rc7 commit 6b4be64fd9fec16418f365c2d8e47a7566e9eba5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0U96 CVE: CVE-2025-39947 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function mlx5_uplink_netdev_get() gets the uplink netdevice pointer from mdev->mlx5e_res.uplink_netdev. However, the netdevice can be removed and its pointer cleared when unbound from the mlx5_core.eth driver. This results in a NULL pointer, causing a kernel panic. BUG: unable to handle page fault for address: 0000000000001300 at RIP: 0010:mlx5e_vport_rep_load+0x22a/0x270 [mlx5_core] Call Trace: <TASK> mlx5_esw_offloads_rep_load+0x68/0xe0 [mlx5_core] esw_offloads_enable+0x593/0x910 [mlx5_core] mlx5_eswitch_enable_locked+0x341/0x420 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x17e/0x3a0 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xd0 genl_family_rcv_msg_doit+0xe0/0x130 genl_rcv_msg+0x183/0x290 netlink_rcv_skb+0x4b/0xf0 genl_rcv+0x24/0x40 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 __sys_sendto+0x119/0x180 do_syscall_64+0x53/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Ensure the pointer is valid before use by checking it for NULL. If it is valid, immediately call netdev_hold() to take a reference, and preventing the netdevice from being freed while it is in use. Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") Signed-off-by: Jianbo Liu <jianbol(a)nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu(a)nvidia.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/1757939074-617281-2-git-send-email-tariqt@nvidia.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h include/linux/mlx5/driver.h drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c [commit 75a543962ecb 25461ce8b3d2 and 8d88e198dcaf are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 27 +++++++++++++++---- .../ethernet/mellanox/mlx5/core/lib/mlx5.h | 15 ++++++++++- include/linux/mlx5/driver.h | 1 + 3 files changed, 37 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c index 751d3ffcd2f6..2bf3dff26c20 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c @@ -1443,12 +1443,21 @@ static const struct mlx5e_profile mlx5e_uplink_rep_profile = { static int mlx5e_vport_uplink_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) { - struct mlx5e_priv *priv = netdev_priv(mlx5_uplink_netdev_get(dev)); struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep); + struct net_device *netdev; + struct mlx5e_priv *priv; + int err; + + netdev = mlx5_uplink_netdev_get(dev); + if (!netdev) + return 0; + priv = netdev_priv(netdev); rpriv->netdev = priv->netdev; - return mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile, - rpriv); + err = mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile, + rpriv); + mlx5_uplink_netdev_put(dev, netdev); + return err; } static void @@ -1560,8 +1569,16 @@ mlx5e_vport_rep_unload(struct mlx5_eswitch_rep *rep) { struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep); struct net_device *netdev = rpriv->netdev; - struct mlx5e_priv *priv = netdev_priv(netdev); - void *ppriv = priv->ppriv; + struct mlx5e_priv *priv; + void *ppriv; + + if (!netdev) { + ppriv = rpriv; + goto free_ppriv; + } + + priv = netdev_priv(netdev); + ppriv = priv->ppriv; if (rep->vport == MLX5_VPORT_UPLINK) { mlx5e_vport_uplink_rep_unload(rpriv); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h index 2b5826a785c4..adcc2bc9c8c8 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h @@ -52,6 +52,19 @@ static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev) static inline struct net_device *mlx5_uplink_netdev_get(struct mlx5_core_dev *mdev) { - return mdev->mlx5e_res.uplink_netdev; + struct mlx5e_resources *mlx5e_res = &mdev->mlx5e_res; + struct net_device *netdev; + + mutex_lock(&mlx5e_res->uplink_netdev_lock); + netdev = mlx5e_res->uplink_netdev; + netdev_hold(netdev, &mlx5e_res->tracker, GFP_KERNEL); + mutex_unlock(&mlx5e_res->uplink_netdev_lock); + return netdev; +} + +static inline void mlx5_uplink_netdev_put(struct mlx5_core_dev *mdev, + struct net_device *netdev) +{ + netdev_put(netdev, &mdev->mlx5e_res.tracker); } #endif diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h index 69d844b34da0..6f4aa4ed1503 100644 --- a/include/linux/mlx5/driver.h +++ b/include/linux/mlx5/driver.h @@ -676,6 +676,7 @@ struct mlx5e_resources { struct mlx5_sq_bfreg bfreg; } hw_objs; struct net_device *uplink_netdev; + netdevice_tracker tracker; struct mutex uplink_netdev_lock; struct mlx5_crypto_dek_priv *dek_priv; }; -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] ixgbevf: Fix CVE-2025-40104
by Dong Chenchen 29 Nov '25

29 Nov '25

Fix CVE-2025-40104 Jedrzej Jagielski (2): ixgbevf: fix getting link speed data for E610 devices ixgbevf: fix mailbox API compatibility by negotiating supported features Piotr Kwapulinski (2): PCI: Add PCI_VDEVICE_SUB helper macro ixgbevf: Add support for Intel(R) E610 device drivers/net/ethernet/intel/ixgbevf/defines.h | 6 +- drivers/net/ethernet/intel/ixgbevf/ipsec.c | 10 + drivers/net/ethernet/intel/ixgbevf/ixgbevf.h | 13 +- .../net/ethernet/intel/ixgbevf/ixgbevf_main.c | 46 ++++- drivers/net/ethernet/intel/ixgbevf/mbx.h | 8 + drivers/net/ethernet/intel/ixgbevf/vf.c | 194 +++++++++++++++--- drivers/net/ethernet/intel/ixgbevf/vf.h | 5 +- include/linux/pci.h | 14 ++ 8 files changed, 257 insertions(+), 39 deletions(-) -- 2.25.1

2 5

[PATCH OLK-5.10] Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed"
by Xingui Yang 29 Nov '25

29 Nov '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID9J6N CVE: NA -------------------------------- This reverts commit d55a2f892d55a05b13f54bf77d03dcb725447239. As a faulty disk may get into an indefinite loop of probe. Fixes: d55a2f892d55 ("scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed") Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> --- drivers/scsi/libsas/sas_internal.h | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h index 0329d7ecff0c..64d4bf97aa91 100644 --- a/drivers/scsi/libsas/sas_internal.h +++ b/drivers/scsi/libsas/sas_internal.h @@ -115,20 +115,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i func, dev->parent ? "exp-attached" : "direct-attached", SAS_ADDR(dev->sas_addr), err); - - /* - * If the device probe failed, the expander phy attached address - * needs to be reset so that the phy will not be treated as flutter - * in the next revalidation - */ - if (dev->parent && !dev_is_expander(dev->dev_type)) { - struct sas_phy *phy = dev->phy; - struct domain_device *parent = dev->parent; - struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; - - memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); - } - sas_unregister_dev(dev->port, dev); } -- 2.33.0

2 1

[PATCH] Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed"
by Xingui Yang 29 Nov '25

29 Nov '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID9J6N CVE: NA -------------------------------- This reverts commit d55a2f892d55a05b13f54bf77d03dcb725447239. As a faulty disk may get into an indefinite loop of probe. Fixes: d55a2f892d55 ("scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed") Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> --- drivers/scsi/libsas/sas_internal.h | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h index 0329d7ecff0c..64d4bf97aa91 100644 --- a/drivers/scsi/libsas/sas_internal.h +++ b/drivers/scsi/libsas/sas_internal.h @@ -115,20 +115,6 @@ static inline void sas_fail_probe(struct domain_device *dev, const char *func, i func, dev->parent ? "exp-attached" : "direct-attached", SAS_ADDR(dev->sas_addr), err); - - /* - * If the device probe failed, the expander phy attached address - * needs to be reset so that the phy will not be treated as flutter - * in the next revalidation - */ - if (dev->parent && !dev_is_expander(dev->dev_type)) { - struct sas_phy *phy = dev->phy; - struct domain_device *parent = dev->parent; - struct ex_phy *ex_phy = &parent->ex_dev.ex_phy[phy->number]; - - memset(ex_phy->attached_sas_addr, 0, SAS_ADDR_SIZE); - } - sas_unregister_dev(dev->port, dev); } -- 2.33.0

1 0

[PATCH v2.1 openEuler-23.09 0/2] XSCHED SUPPORT KO MODE
by Liu Kai 29 Nov '25

29 Nov '25

XSCHED SUPPORT KO MODE Liu Kai (2): xsched ko: xsched support ko mode xsched ko: adapt 910b npu driver for xsched ko ...01-Adapt-910b-npu-driver-for-xsched-ko.txt | 535 ++++++++++++++ drivers/xsched/Makefile | 71 ++ drivers/xsched/hal/syms_lookup.c | 52 ++ drivers/xsched/hal/xcu_group.c | 237 ++++++ drivers/xsched/hal/xsched_npu_interface.c | 383 ++++++++++ drivers/xsched/include/syms_lookup.h | 20 + drivers/xsched/include/vstream.h | 87 +++ drivers/xsched/include/xcu_group.h | 113 +++ drivers/xsched/include/xsched.h | 349 +++++++++ drivers/xsched/include/xsched_ioctl.h | 60 ++ drivers/xsched/include/xsched_npu_interface.h | 118 +++ drivers/xsched/xsched/core.c | 681 ++++++++++++++++++ drivers/xsched/xsched/rt.c | 459 ++++++++++++ drivers/xsched/xsched/xsched.c | 272 +++++++ drivers/xsched/xsched/xsched_ioctl.c | 479 ++++++++++++ 15 files changed, 3916 insertions(+) create mode 100644 drivers/xsched/0001-Adapt-910b-npu-driver-for-xsched-ko.txt create mode 100644 drivers/xsched/Makefile create mode 100644 drivers/xsched/hal/syms_lookup.c create mode 100644 drivers/xsched/hal/xcu_group.c create mode 100644 drivers/xsched/hal/xsched_npu_interface.c create mode 100644 drivers/xsched/include/syms_lookup.h create mode 100644 drivers/xsched/include/vstream.h create mode 100644 drivers/xsched/include/xcu_group.h create mode 100644 drivers/xsched/include/xsched.h create mode 100644 drivers/xsched/include/xsched_ioctl.h create mode 100644 drivers/xsched/include/xsched_npu_interface.h create mode 100644 drivers/xsched/xsched/core.c create mode 100644 drivers/xsched/xsched/rt.c create mode 100644 drivers/xsched/xsched/xsched.c create mode 100644 drivers/xsched/xsched/xsched_ioctl.c -- 2.34.1

2 3