- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 2891/2891] drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1211:6: warning: no previous prototype for function 'hinic3_need_proc_link_event'
by kernel test robot 09 May '25

09 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2e5032bf08eca1f3b062773540ff27c51788390d commit: 79871cd2cd720225eb582c9ed49fb4a96a270b3b [2891/2891] net/hinic3: Synchronize new NIC features and bug fixes config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250510/202505100150.DG1QGwH3-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250510/202505100150.DG1QGwH3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505100150.DG1QGwH3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c:1671:6: warning: no previous prototype for function 'hinic3_is_optical_module_mode' [-Wmissing-prototypes] 1671 | bool hinic3_is_optical_module_mode(void *hwdev) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_comm.c:1671:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1671 | bool hinic3_is_optical_module_mode(void *hwdev) | ^ | static 1 warning generated. -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c:176:5: warning: no previous prototype for function 'hinic3_pci_sriov_check' [-Wmissing-prototypes] 176 | int hinic3_pci_sriov_check(struct hinic3_sriov_info *sriov_info, struct pci_dev *dev, int num_vfs) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_sriov.c:176:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 176 | int hinic3_pci_sriov_check(struct hinic3_sriov_info *sriov_info, struct pci_dev *dev, int num_vfs) | ^ | static 1 warning generated. -- drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:103:6: warning: no previous prototype for function 'hinic3_uld_lock_init' [-Wmissing-prototypes] 103 | void hinic3_uld_lock_init(void) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:103:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 103 | void hinic3_uld_lock_init(void) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:525:5: warning: no previous prototype for function 'hinic3_pdev_is_virtfn' [-Wmissing-prototypes] 525 | u32 hinic3_pdev_is_virtfn(struct pci_dev *pdev) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:525:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 525 | u32 hinic3_pdev_is_virtfn(struct pci_dev *pdev) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:785:5: warning: no previous prototype for function '__set_vroce_func_state' [-Wmissing-prototypes] 785 | int __set_vroce_func_state(struct hinic3_pcidev *pci_adapter) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:785:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 785 | int __set_vroce_func_state(struct hinic3_pcidev *pci_adapter) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:826:6: warning: no previous prototype for function 'slave_host_mgmt_vroce_work' [-Wmissing-prototypes] 826 | void slave_host_mgmt_vroce_work(struct work_struct *work) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:826:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 826 | void slave_host_mgmt_vroce_work(struct work_struct *work) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:834:7: warning: no previous prototype for function 'hinic3_get_roce_uld_by_pdev' [-Wmissing-prototypes] 834 | void *hinic3_get_roce_uld_by_pdev(struct pci_dev *pdev) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:834:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 834 | void *hinic3_get_roce_uld_by_pdev(struct pci_dev *pdev) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:1796:6: warning: no previous prototype for function 'hinic3_set_func_state' [-Wmissing-prototypes] 1796 | void hinic3_set_func_state(struct hinic3_pcidev *pci_adapter) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:1796:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1796 | void hinic3_set_func_state(struct hinic3_pcidev *pci_adapter) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:1822:6: warning: no previous prototype for function 'slave_host_mgmt_work' [-Wmissing-prototypes] 1822 | void slave_host_mgmt_work(struct work_struct *work) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_lld.c:1822:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1822 | void slave_host_mgmt_work(struct work_struct *work) | ^ | static 7 warnings generated. -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c:618:6: warning: no previous prototype for function 'hinic3_write_oshr_info' [-Wmissing-prototypes] 618 | void hinic3_write_oshr_info(struct os_hot_replace_info *out_oshr_info, | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_dev_mgmt.c:618:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 618 | void hinic3_write_oshr_info(struct os_hot_replace_info *out_oshr_info, | ^ | static 1 warning generated. -- >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:865:5: warning: no previous prototype for function 'hinic3_global_func_id_hw' [-Wmissing-prototypes] 865 | u16 hinic3_global_func_id_hw(void *hwdev) | ^ drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:865:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 865 | u16 hinic3_global_func_id_hw(void *hwdev) | ^ | static 1 warning generated. -- >> drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1211:6: warning: no previous prototype for function 'hinic3_need_proc_link_event' [-Wmissing-prototypes] 1211 | bool hinic3_need_proc_link_event(struct hinic3_lld_dev *lld_dev) | ^ drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1211:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1211 | bool hinic3_need_proc_link_event(struct hinic3_lld_dev *lld_dev) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1258:6: warning: no previous prototype for function 'hinic3_need_proc_bond_event' [-Wmissing-prototypes] 1258 | bool hinic3_need_proc_bond_event(struct hinic3_lld_dev *lld_dev) | ^ drivers/net/ethernet/huawei/hinic3/hinic3_main.c:1258:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1258 | bool hinic3_need_proc_bond_event(struct hinic3_lld_dev *lld_dev) | ^ | static 2 warnings generated. -- >> drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:342:5: warning: no previous prototype for function 'hinic3_rx_queue_stat_pack' [-Wmissing-prototypes] 342 | int hinic3_rx_queue_stat_pack(struct hinic3_show_item *item, | ^ drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:342:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 342 | int hinic3_rx_queue_stat_pack(struct hinic3_show_item *item, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:357:5: warning: no previous prototype for function 'hinic3_tx_queue_stat_pack' [-Wmissing-prototypes] 357 | int hinic3_tx_queue_stat_pack(struct hinic3_show_item *item, | ^ drivers/net/ethernet/huawei/hinic3/hinic3_ethtool_stats.c:357:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 357 | int hinic3_tx_queue_stat_pack(struct hinic3_show_item *item, | ^ | static 2 warnings generated. -- >> drivers/net/ethernet/huawei/hinic3/hinic3_dbg.c:689:5: warning: variable 'cos_num' set but not used [-Wunused-but-set-variable] 689 | u8 cos_num, valid_cos_bitmap; | ^ 1 warning generated. -- >> drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c:59:6: warning: variable 'size' set but not used [-Wunused-but-set-variable] 59 | u32 size; | ^ drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c:1757:5: warning: no previous prototype for function 'hinic3_ndo_set_vf_link_state' [-Wmissing-prototypes] 1757 | int hinic3_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link) | ^ drivers/net/ethernet/huawei/hinic3/hinic3_netdev_ops.c:1757:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1757 | int hinic3_ndo_set_vf_link_state(struct net_device *netdev, int vf_id, int link) | ^ | static 2 warnings generated. -- drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c:54: warning: Function parameter or member 'instance' not described in 'hinic3_sm_ctr_rd16' >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c:95: warning: Function parameter or member 'instance' not described in 'hinic3_sm_ctr_rd16_clear' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c:137: warning: Function parameter or member 'instance' not described in 'hinic3_sm_ctr_rd32' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c:179: warning: Function parameter or member 'instance' not described in 'hinic3_sm_ctr_rd32_clear' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c:222: warning: Function parameter or member 'instance' not described in 'hinic3_sm_ctr_rd64_pair' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c:277: warning: Function parameter or member 'instance' not described in 'hinic3_sm_ctr_rd64_pair_clear' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c:319: warning: Function parameter or member 'instance' not described in 'hinic3_sm_ctr_rd64' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hw_api.c:360: warning: Function parameter or member 'instance' not described in 'hinic3_sm_ctr_rd64_clear' -- >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:623:6: warning: no previous prototype for function 'print_port_info' [-Wmissing-prototypes] 623 | void print_port_info(struct hinic3_nic_io *nic_io, | ^ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:623:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 623 | void print_port_info(struct hinic3_nic_io *nic_io, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:802:6: warning: no previous prototype for function 'hinic3_notify_vf_bond_status' [-Wmissing-prototypes] 802 | void hinic3_notify_vf_bond_status(struct hinic3_nic_io *nic_io, | ^ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:802:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 802 | void hinic3_notify_vf_bond_status(struct hinic3_nic_io *nic_io, | ^ | static >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:832:6: warning: no previous prototype for function 'hinic3_notify_all_vfs_bond_changed' [-Wmissing-prototypes] 832 | void hinic3_notify_all_vfs_bond_changed(void *hwdev, u8 bond_status) | ^ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:832:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 832 | void hinic3_notify_all_vfs_bond_changed(void *hwdev, u8 bond_status) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1678:5: warning: no previous prototype for function 'set_fecparam' [-Wmissing-prototypes] 1678 | int set_fecparam(void *hwdev, u8 fecparam) | ^ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1678:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1678 | int set_fecparam(void *hwdev, u8 fecparam) | ^ | static >> drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1706:5: warning: no previous prototype for function 'get_fecparam' [-Wmissing-prototypes] 1706 | int get_fecparam(void *hwdev, u8 *advertised_fec, u8 *supported_fec) | ^ drivers/net/ethernet/huawei/hinic3/hinic3_mag_cfg.c:1706:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1706 | int get_fecparam(void *hwdev, u8 *advertised_fec, u8 *supported_fec) | ^ | static 5 warnings generated. .. vim +/hinic3_need_proc_link_event +1211 drivers/net/ethernet/huawei/hinic3/hinic3_main.c 1210 > 1211 bool hinic3_need_proc_link_event(struct hinic3_lld_dev *lld_dev) 1212 { 1213 int ret = 0; 1214 u16 func_id; 1215 u8 roce_enable = false; 1216 bool is_slave_func = false; 1217 struct hinic3_hw_bond_infos hw_bond_infos = {0}; 1218 1219 if (!lld_dev) 1220 return false; 1221 1222 /* 非slave设备需要处理link down事件 */ 1223 ret = hinic3_is_slave_func(lld_dev->hwdev, &is_slave_func); 1224 if (ret != 0) { 1225 nic_err(&lld_dev->pdev->dev, "NIC get info, lld_dev is null\n"); 1226 return true; 1227 } 1228 1229 if (!is_slave_func) 1230 return true; 1231 1232 /* 未使能了vroce功能，需处理link down事件 */ 1233 func_id = hinic3_global_func_id(lld_dev->hwdev); 1234 ret = hinic3_get_func_vroce_enable(lld_dev->hwdev, func_id, 1235 &roce_enable); 1236 if (ret != 0) 1237 return true; 1238 1239 if (!roce_enable) 1240 return true; 1241 1242 /* 未创建bond,需要处理link down事件 */ 1243 hw_bond_infos.bond_id = HINIC_OVS_BOND_DEFAULT_ID; 1244 1245 ret = hinic3_get_hw_bond_infos(lld_dev->hwdev, &hw_bond_infos, 1246 HINIC3_CHANNEL_COMM); 1247 if (ret != 0) { 1248 pr_err("[ROCE, ERR] Get chipf bond info failed (%d)\n", ret); 1249 return true; 1250 } 1251 1252 if (!hw_bond_infos.valid) 1253 return true; 1254 1255 return false; 1256 } 1257 > 1258 bool hinic3_need_proc_bond_event(struct hinic3_lld_dev *lld_dev) 1259 { 1260 return !hinic3_need_proc_link_event(lld_dev); 1261 } 1262 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ext4: update s_journal_inum if it changes after journal replay
by Zizhi Wo 09 May '25

09 May '25

From: Baokun Li <libaokun1(a)huawei.com> stable inclusion from stable-v5.15.104 commit 499fef2030fb754c68b1c7cb3a799a3bc1d0d925 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5DGP CVE: CVE-2023-53091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3039d8b8692408438a618fac2776b629852663c3 ] When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we have successfully loaded and replayed the journal through the old s_journal_inum. And the new s_journal_inum bypasses some of the checks in ext4_get_journal(), which may trigger a null pointer dereference problem. So if s_journal_inum changes after the journal replay, we ignore the change, and rewrite the current journal_inum to the superblock. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541 Reported-by: Luís Henriques <lhenriques(a)suse.de> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20230107032126.4165860-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/super.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 2adee3847415..6784c94e526e 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5624,8 +5624,11 @@ static int ext4_load_journal(struct super_block *sb, if (!really_read_only && journal_devnum && journal_devnum != le32_to_cpu(es->s_journal_dev)) { es->s_journal_dev = cpu_to_le32(journal_devnum); - - /* Make sure we flush the recovery flag to disk. */ + ext4_commit_super(sb); + } + if (!really_read_only && journal_inum && + journal_inum != le32_to_cpu(es->s_journal_inum)) { + es->s_journal_inum = cpu_to_le32(journal_inum); ext4_commit_super(sb); } -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ext4: update s_journal_inum if it changes after journal replay
by Zizhi Wo 09 May '25

09 May '25

From: Baokun Li <libaokun1(a)huawei.com> stable inclusion from stable-v5.15.104 commit 499fef2030fb754c68b1c7cb3a799a3bc1d0d925 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5DGP CVE: CVE-2023-53091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3039d8b8692408438a618fac2776b629852663c3 ] When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we have successfully loaded and replayed the journal through the old s_journal_inum. And the new s_journal_inum bypasses some of the checks in ext4_get_journal(), which may trigger a null pointer dereference problem. So if s_journal_inum changes after the journal replay, we ignore the change, and rewrite the current journal_inum to the superblock. Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541 Reported-by: Luís Henriques <lhenriques(a)suse.de> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20230107032126.4165860-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/super.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 8761fe5037a6..4ddf9bbbfd4b 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5195,8 +5195,11 @@ static int ext4_load_journal(struct super_block *sb, if (!really_read_only && journal_devnum && journal_devnum != le32_to_cpu(es->s_journal_dev)) { es->s_journal_dev = cpu_to_le32(journal_devnum); - - /* Make sure we flush the recovery flag to disk. */ + ext4_commit_super(sb); + } + if (!really_read_only && journal_inum && + journal_inum != le32_to_cpu(es->s_journal_inum)) { + es->s_journal_inum = cpu_to_le32(journal_inum); ext4_commit_super(sb); } -- 2.39.2

2 1

[PATCH OLK-5.10] ext4: fix off-by-one error in do_split
by Zizhi Wo 09 May '25

09 May '25

From: Artem Sadovnikov <a.sadovnikov(a)ispras.ru> stable inclusion from stable-v5.10.237 commit 515c34cff899eb5dae6aa7eee01c1295b07d81af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BIN CVE: CVE-2025-23150 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 94824ac9a8aaf2fb3c54b4bdde842db80ffa555d upstream. Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847 CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> The following loop is located right above 'if' statement. for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; } 'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Cc: stable(a)vger.kernel.org Fixes: 5872331b3d91 ("ext4: fix potential negative array index in do_split()") Signed-off-by: Artem Sadovnikov <a.sadovnikov(a)ispras.ru> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20250404082804.2567-3-a.sadovnikov@ispras.ru Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index c5eddcd5106b..40e2ffc68990 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -1958,7 +1958,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, * split it in half by count; each resulting block will have at least * half the space free. */ - if (i > 0) + if (i >= 0) split = count - move; else split = count/2; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ext4: fix off-by-one error in do_split
by Zizhi Wo 09 May '25

09 May '25

From: Artem Sadovnikov <a.sadovnikov(a)ispras.ru> stable inclusion from stable-v5.10.237 commit 515c34cff899eb5dae6aa7eee01c1295b07d81af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BIN CVE: CVE-2025-23150 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 94824ac9a8aaf2fb3c54b4bdde842db80ffa555d upstream. Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split. BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847 CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> The following loop is located right above 'if' statement. for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; } 'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Cc: stable(a)vger.kernel.org Fixes: 5872331b3d91 ("ext4: fix potential negative array index in do_split()") Signed-off-by: Artem Sadovnikov <a.sadovnikov(a)ispras.ru> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20250404082804.2567-3-a.sadovnikov@ispras.ru Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index f2208337e5cb..28fb4c0c8a14 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -1814,7 +1814,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, * split it in half by count; each resulting block will have at least * half the space free. */ - if (i > 0) + if (i >= 0) split = count - move; else split = count/2; -- 2.39.2

2 1

openEuler 2026 年 LTS 版本内核选型公示
by Xie XiuQi 09 May '25

09 May '25

各位开发者和用户，经2025年5月9日 openEuler Kernel SIG 会议讨论，拟定继续使用 6.6 内核支撑 openEuler 2026 年 LTS 版本发布，特此公示。公示时间：2025-5-9 18:00 - 2025-5-23 18:00，公示14天。公示期间，如果您有任何意见，请邮件反馈至：xiexiuqi@huawei.com,jason.zeng@intel.com,sanglipeng1@jd.com. 如需反馈意见，请说明您所在的团队，您的联系方式，并详细描述原因。您的反馈意见可能会在社区会议中公开讨论，请不要包含保密信息。 openEuler Kernel SIG 2025年5月9日

1 0

[PATCH OLK-5.10] [Backport] backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
by Yuntao Liu 09 May '25

09 May '25

From: Herve Codina <herve.codina(a)bootlin.com> stable inclusion from stable-v5.10.237 commit 87d947a0607be384bfe7bb0935884a711e35ca07 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJZ CVE: CVE-2025-23144 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 276822a00db3c1061382b41e72cafc09d6a0ec30 ] Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable(). Fixes: ae232e45acf9 ("backlight: add led-backlight driver") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20250122091914.309533-1-herve.codina@bootlin.com Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/backlight/led_bl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c index f54d256e2d54..1020e4405a4d 100644 --- a/drivers/video/backlight/led_bl.c +++ b/drivers/video/backlight/led_bl.c @@ -226,8 +226,11 @@ static int led_bl_remove(struct platform_device *pdev) backlight_device_unregister(bl); led_bl_power_off(priv); - for (i = 0; i < priv->nb_leds; i++) + for (i = 0; i < priv->nb_leds; i++) { + mutex_lock(&priv->leds[i]->led_access); led_sysfs_enable(priv->leds[i]); + mutex_unlock(&priv->leds[i]->led_access); + } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
by Yuntao Liu 09 May '25

09 May '25

From: Herve Codina <herve.codina(a)bootlin.com> stable inclusion from stable-v6.6.88 commit 1c82f5a393d8b9a5c1ea032413719862098afd4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJZ CVE: CVE-2025-23144 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 276822a00db3c1061382b41e72cafc09d6a0ec30 upstream. Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable(). Fixes: ae232e45acf9 ("backlight: add led-backlight driver") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20250122091914.309533-1-herve.codina@bootlin.com Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/backlight/led_bl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c index 032f8bddf872..0e53e427a91d 100644 --- a/drivers/video/backlight/led_bl.c +++ b/drivers/video/backlight/led_bl.c @@ -229,8 +229,11 @@ static void led_bl_remove(struct platform_device *pdev) backlight_device_unregister(bl); led_bl_power_off(priv); - for (i = 0; i < priv->nb_leds; i++) + for (i = 0; i < priv->nb_leds; i++) { + mutex_lock(&priv->leds[i]->led_access); led_sysfs_enable(priv->leds[i]); + mutex_unlock(&priv->leds[i]->led_access); + } } static const struct of_device_id led_bl_of_match[] = { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/amdkfd: Fix an illegal memory access
by Pu Lehui 09 May '25

09 May '25

From: Qu Huang <qu.huang(a)linux.dev> stable inclusion from stable-v4.19.279 commit 5a3fb3b745af0ce46ec2e0c8e507bae45b937334 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5DF7 CVE: CVE-2023-53090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4fc8fff378b2f2039f2a666d9f8c570f4e58352c ] In the kfd_wait_on_events() function, the kfd_event_waiter structure is allocated by alloc_event_waiters(), but the event field of the waiter structure is not initialized; When copy_from_user() fails in the kfd_wait_on_events() function, it will enter exception handling to release the previously allocated memory of the waiter structure; Due to the event field of the waiters structure being accessed in the free_waiters() function, this results in illegal memory access and system crash, here is the crash log: localhost kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x185/0x1e0 localhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082 localhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000 localhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0 localhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64 localhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002 localhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698 localhost kernel: FS: 0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000 localhost kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 localhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0 localhost kernel: Call Trace: localhost kernel: _raw_spin_lock_irqsave+0x30/0x40 localhost kernel: remove_wait_queue+0x12/0x50 localhost kernel: kfd_wait_on_events+0x1b6/0x490 [hydcu] localhost kernel: ? ftrace_graph_caller+0xa0/0xa0 localhost kernel: kfd_ioctl+0x38c/0x4a0 [hydcu] localhost kernel: ? kfd_ioctl_set_trap_handler+0x70/0x70 [hydcu] localhost kernel: ? kfd_ioctl_create_queue+0x5a0/0x5a0 [hydcu] localhost kernel: ? ftrace_graph_caller+0xa0/0xa0 localhost kernel: __x64_sys_ioctl+0x8e/0xd0 localhost kernel: ? syscall_trace_enter.isra.18+0x143/0x1b0 localhost kernel: do_syscall_64+0x33/0x80 localhost kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9 localhost kernel: RIP: 0033:0x152a4dff68d7 Allocate the structure with kcalloc, and remove redundant 0-initialization and a redundant loop condition check. Signed-off-by: Qu Huang <qu.huang(a)linux.dev> Signed-off-by: Felix Kuehling <Felix.Kuehling(a)amd.com> Reviewed-by: Felix Kuehling <Felix.Kuehling(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c index 892077377339..8f23192b6709 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c @@ -529,16 +529,13 @@ static struct kfd_event_waiter *alloc_event_waiters(uint32_t num_events) struct kfd_event_waiter *event_waiters; uint32_t i; - event_waiters = kmalloc_array(num_events, - sizeof(struct kfd_event_waiter), - GFP_KERNEL); + event_waiters = kcalloc(num_events, sizeof(struct kfd_event_waiter), + GFP_KERNEL); if (!event_waiters) return NULL; - for (i = 0; (event_waiters) && (i < num_events) ; i++) { + for (i = 0; i < num_events; i++) init_wait(&event_waiters[i].wait); - event_waiters[i].activated = false; - } return event_waiters; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2025-37830
by Hongbo Li 09 May '25

09 May '25

Fix CVE-2025-37830. Henry Martin (1): cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() drivers/cpufreq/scmi-cpufreq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) -- 2.34.1

2 2