- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1684/1684] drivers/acpi/acpi_adxl.o: warning: objtool: missing symbol for section .text
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: a275b25c978318513b28931cec91c4a10120748b [1684/1684] EDAC, skx_edac: Add address translation for non-volatile DIMMs config: x86_64-buildonly-randconfig-003-20250702 (https://download.01.org/0day-ci/archive/20250702/202507022042.Q1D7bRjT-lkp@…) compiler: clang version 20.1.7 (https://github.com/llvm/llvm-project 6146a88f60492b520a36f8f8f3231e15f3cc6082) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507022042.Q1D7bRjT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507022042.Q1D7bRjT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/acpi/acpi_adxl.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2445/2445] drivers/gpu/drm/display/drm_display_helper.o: warning: objtool: drm_dp_set_subconnector_property+0xed: unreachable instruction
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bf2df406d75690971b837e37418494e09d8eec02 commit: 107e8e2d48f2014216a818314d4e1af591b39aed [2445/2445] cpu: Re-enable CPU mitigations by default for !X86 architectures config: x86_64-buildonly-randconfig-2001-20250702 (https://download.01.org/0day-ci/archive/20250702/202507021408.Op6CzldG-lkp@…) compiler: clang version 20.1.7 (https://github.com/llvm/llvm-project 6146a88f60492b520a36f8f8f3231e15f3cc6082) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021408.Op6CzldG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021408.Op6CzldG-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/display/drm_display_helper.o: warning: objtool: drm_dp_subconnector_type+0xa5: unreachable instruction >> drivers/gpu/drm/display/drm_display_helper.o: warning: objtool: drm_dp_set_subconnector_property+0xed: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2445/2445] include/linux/psp-hygon.h:219:5: warning: no previous prototype for 'psp_register_cmd_notifier'
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bf2df406d75690971b837e37418494e09d8eec02 commit: 518c81d56c055affc71650b1ad1ba7f86e5ee867 [2445/2445] arch/x86/kvm: Support tkm virtualization config: x86_64-buildonly-randconfig-2002-20250702 (https://download.01.org/0day-ci/archive/20250702/202507021332.zHwpOcwr-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021332.zHwpOcwr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021332.zHwpOcwr-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/x86/kvm/psp.c:15: >> include/linux/psp-hygon.h:219:5: warning: no previous prototype for 'psp_register_cmd_notifier' [-Wmissing-prototypes] 219 | int psp_register_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> include/linux/psp-hygon.h:220:5: warning: no previous prototype for 'psp_unregister_cmd_notifier' [-Wmissing-prototypes] 220 | int psp_unregister_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kvm/psp.c:105:21: warning: no previous prototype for 'map_tbl_dump' [-Wmissing-prototypes] 105 | void __maybe_unused map_tbl_dump(const char *title, struct addr_map_tbls *tbls) | ^~~~~~~~~~~~ arch/x86/kvm/psp.c:118:21: warning: no previous prototype for 'g2h_tbl_dump' [-Wmissing-prototypes] 118 | void __maybe_unused g2h_tbl_dump(const char *title, struct gpa2hva_tbls *tbls) | ^~~~~~~~~~~~ vim +/psp_register_cmd_notifier +219 include/linux/psp-hygon.h d0b3a770d8e20d chench00 2024-08-01 218 d0b3a770d8e20d chench00 2024-08-01 @219 int psp_register_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } d0b3a770d8e20d chench00 2024-08-01 @220 int psp_unregister_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } d0b3a770d8e20d chench00 2024-08-01 221 :::::: The code at line 219 was first introduced by commit :::::: d0b3a770d8e20d953fe2a74ea8c4b5f4767c4add crypto: command co-processor: Add another mailbox interrupt support for PSP sending command to X86 :::::: TO: chench00 <chench(a)hygon.cn> :::::: CC: chench00 <chench(a)hygon.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] net/sctp/chunk.c:198:25: warning: data argument not used by format string
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 05834253a093f4e6d9cc31f380de304b540a548e [1605/1605] sctp: frag_point sanity check config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507021205.lTZLbTRm-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021205.lTZLbTRm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021205.lTZLbTRm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/sctp/chunk.c:198:25: warning: data argument not used by format string [-Wformat-extra-args] 197 | pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 198 | __func__, asoc, max_data); | ~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/printk.h:485:49: note: expanded from macro 'pr_warn_ratelimited' 485 | printk_ratelimited(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~ include/linux/printk.h:469:17: note: expanded from macro 'printk_ratelimited' 469 | printk(fmt, ##__VA_ARGS__); \ | ~~~ ^ 1 warning generated. vim +198 net/sctp/chunk.c 156 157 158 /* A data chunk can have a maximum payload of (2^16 - 20). Break 159 * down any such message into smaller chunks. Opportunistically, fragment 160 * the chunks down to the current MTU constraints. We may get refragmented 161 * later if the PMTU changes, but it is _much better_ to fragment immediately 162 * with a reasonable guess than always doing our fragmentation on the 163 * soft-interrupt. 164 */ 165 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc, 166 struct sctp_sndrcvinfo *sinfo, 167 struct iov_iter *from) 168 { 169 size_t len, first_len, max_data, remaining; 170 size_t msg_len = iov_iter_count(from); 171 struct sctp_shared_key *shkey = NULL; 172 struct list_head *pos, *temp; 173 struct sctp_chunk *chunk; 174 struct sctp_datamsg *msg; 175 int err; 176 177 msg = sctp_datamsg_new(GFP_KERNEL); 178 if (!msg) 179 return ERR_PTR(-ENOMEM); 180 181 /* Note: Calculate this outside of the loop, so that all fragments 182 * have the same expiration. 183 */ 184 if (asoc->peer.prsctp_capable && sinfo->sinfo_timetolive && 185 (SCTP_PR_TTL_ENABLED(sinfo->sinfo_flags) || 186 !SCTP_PR_POLICY(sinfo->sinfo_flags))) 187 msg->expires_at = jiffies + 188 msecs_to_jiffies(sinfo->sinfo_timetolive); 189 190 /* This is the biggest possible DATA chunk that can fit into 191 * the packet 192 */ 193 max_data = asoc->frag_point; 194 if (unlikely(!max_data)) { 195 max_data = sctp_min_frag_point(sctp_sk(asoc->base.sk), 196 sctp_datachk_len(&asoc->stream)); 197 pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)", > 198 __func__, asoc, max_data); 199 } 200 201 /* If the the peer requested that we authenticate DATA chunks 202 * we need to account for bundling of the AUTH chunks along with 203 * DATA. 204 */ 205 if (sctp_auth_send_cid(SCTP_CID_DATA, asoc)) { 206 struct sctp_hmac *hmac_desc = sctp_auth_asoc_get_hmac(asoc); 207 208 if (hmac_desc) 209 max_data -= SCTP_PAD4(sizeof(struct sctp_auth_chunk) + 210 hmac_desc->hmac_len); 211 212 if (sinfo->sinfo_tsn && 213 sinfo->sinfo_ssn != asoc->active_key_id) { 214 shkey = sctp_auth_get_shkey(asoc, sinfo->sinfo_ssn); 215 if (!shkey) { 216 err = -EINVAL; 217 goto errout; 218 } 219 } else { 220 shkey = asoc->shkey; 221 } 222 } 223 224 /* Set first_len and then account for possible bundles on first frag */ 225 first_len = max_data; 226 227 /* Check to see if we have a pending SACK and try to let it be bundled 228 * with this message. Do this if we don't have any data queued already. 229 * To check that, look at out_qlen and retransmit list. 230 * NOTE: we will not reduce to account for SACK, if the message would 231 * not have been fragmented. 232 */ 233 if (timer_pending(&asoc->timers[SCTP_EVENT_TIMEOUT_SACK]) && 234 asoc->outqueue.out_qlen == 0 && 235 list_empty(&asoc->outqueue.retransmit) && 236 msg_len > max_data) 237 first_len -= SCTP_PAD4(sizeof(struct sctp_sack_chunk)); 238 239 /* Encourage Cookie-ECHO bundling. */ 240 if (asoc->state < SCTP_STATE_COOKIE_ECHOED) 241 first_len -= SCTP_ARBITRARY_COOKIE_ECHO_LEN; 242 243 /* Account for a different sized first fragment */ 244 if (msg_len >= first_len) { 245 msg->can_delay = 0; 246 if (msg_len > first_len) 247 SCTP_INC_STATS(sock_net(asoc->base.sk), 248 SCTP_MIB_FRAGUSRMSGS); 249 } else { 250 /* Which may be the only one... */ 251 first_len = msg_len; 252 } 253 254 /* Create chunks for all DATA chunks. */ 255 for (remaining = msg_len; remaining; remaining -= len) { 256 u8 frag = SCTP_DATA_MIDDLE_FRAG; 257 258 if (remaining == msg_len) { 259 /* First frag, which may also be the last */ 260 frag |= SCTP_DATA_FIRST_FRAG; 261 len = first_len; 262 } else { 263 /* Middle frags */ 264 len = max_data; 265 } 266 267 if (len >= remaining) { 268 /* Last frag, which may also be the first */ 269 len = remaining; 270 frag |= SCTP_DATA_LAST_FRAG; 271 272 /* The application requests to set the I-bit of the 273 * last DATA chunk of a user message when providing 274 * the user message to the SCTP implementation. 275 */ 276 if ((sinfo->sinfo_flags & SCTP_EOF) || 277 (sinfo->sinfo_flags & SCTP_SACK_IMMEDIATELY)) 278 frag |= SCTP_DATA_SACK_IMM; 279 } 280 281 chunk = asoc->stream.si->make_datafrag(asoc, sinfo, len, frag, 282 GFP_KERNEL); 283 if (!chunk) { 284 err = -ENOMEM; 285 goto errout; 286 } 287 288 err = sctp_user_addto_chunk(chunk, len, from); 289 if (err < 0) 290 goto errout_chunk_free; 291 292 chunk->shkey = shkey; 293 294 /* Put the chunk->skb back into the form expected by send. */ 295 __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr - 296 chunk->skb->data); 297 298 sctp_datamsg_assign(msg, chunk); 299 list_add_tail(&chunk->frag_list, &msg->chunks); 300 } 301 302 return msg; 303 304 errout_chunk_free: 305 sctp_chunk_free(chunk); 306 307 errout: 308 list_for_each_safe(pos, temp, &msg->chunks) { 309 list_del_init(pos); 310 chunk = list_entry(pos, struct sctp_chunk, frag_list); 311 sctp_chunk_free(chunk); 312 } 313 sctp_datamsg_put(msg); 314 315 return ERR_PTR(err); 316 } 317 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2999/2999] drivers/crypto/ccp/hygon/hct.c:1343:15: warning: no previous prototype for 'hct_pin_memory'
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e4755f6a2b98f251edcf63f98f416b5d76425f8c commit: b7a218b5c46200f323ac0fe07589e0bf0d648069 [2999/2999] crypto: hct: provides hygon crypto technology ccp device driver. config: x86_64-buildonly-randconfig-2004-20250702 (https://download.01.org/0day-ci/archive/20250702/202507021158.W1ajhxKz-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021158.W1ajhxKz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021158.W1ajhxKz-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/hct.c:1343:15: warning: no previous prototype for 'hct_pin_memory' [-Wmissing-prototypes] 1343 | struct page **hct_pin_memory(struct hct_private *private, unsigned long uaddr, | ^~~~~~~~~~~~~~ vim +/hct_pin_memory +1343 drivers/crypto/ccp/hygon/hct.c 1342 > 1343 struct page **hct_pin_memory(struct hct_private *private, unsigned long uaddr, 1344 unsigned long ulen, unsigned long *n) 1345 { 1346 unsigned long npages, size; 1347 int npinned; 1348 struct page **pages; 1349 unsigned long first, last; 1350 1351 if (ulen == 0 || uaddr + ulen < uaddr) 1352 return NULL; 1353 1354 first = (uaddr & PAGE_MASK) >> PAGE_SHIFT; 1355 last = ((uaddr + ulen - 1) & PAGE_MASK) >> PAGE_SHIFT; 1356 npages = (last - first + 1); 1357 1358 if (WARN_ON_ONCE(npages > INT_MAX)) 1359 return NULL; 1360 1361 size = npages * sizeof(struct page *); 1362 if (size > PAGE_SIZE) 1363 pages = vmalloc(size); 1364 else 1365 pages = kmalloc(size, GFP_KERNEL); 1366 1367 if (!pages) 1368 return NULL; 1369 1370 /* Pin the user virtual address. */ 1371 npinned = pin_user_pages_fast(uaddr, npages, FOLL_WRITE, pages); 1372 if (npinned != npages) 1373 goto err; 1374 1375 *n = npages; 1376 return pages; 1377 1378 err: 1379 if (npinned > 0) 1380 unpin_user_pages(pages, npinned); 1381 kvfree(pages); 1382 return NULL; 1383 } 1384 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] uprobes: check anon before compound when unregister
by Tengda Wu 02 Jul '25

02 Jul '25

From: Chen Zhongjin <chenzhongjin(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJG91 -------------------------------- In uprobe unregister, if the old_page is a compound page, it will trigger a warning and cause the unregister operation to fail: "uprobe unregister should never work on compound page" If old_page is allocated by uprobe through alloc_page_vma(), this page cannot be compounded, so this warning means old_page is a remapped page after register. In this scenario, check PageAnon() first to determine whether the page is a remapped page. Just pass the PageCompound() check and unregister uprobe safely. Fixes: aa5de305c90c ("kernel/events/uprobes.c: only do FOLL_SPLIT_PMD for uprobe register") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/events/uprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index 8a6c5ee003c2..e51dbb0e8a56 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -493,7 +493,7 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, goto put_old; } - if (WARN(!is_register && PageCompound(old_page), + if (WARN(!is_register && PageAnon(old_page) && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; goto put_old; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
by Yuan Can 02 Jul '25

02 Jul '25

From: Liang He <windhl(a)126.com> stable inclusion from stable-v4.19.256 commit b9ca8585c766616563cf3c062c6878f61f83cf00 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9MJ CVE: CVE-2022-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 66efb665cd5ad69b27dca8571bf89fc6b9c628a4 ] We should call the of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Fixes: 40e20d68bb3f ("regulator: of: Add support for parsing regulator_state for suspend state") Signed-off-by: Liang He <windhl(a)126.com> Link: https://lore.kernel.org/r/20220715111027.391032-1-windhl@126.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/regulator/of_regulator.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c index b255590aef36..b2bd7ee46c45 100644 --- a/drivers/regulator/of_regulator.c +++ b/drivers/regulator/of_regulator.c @@ -189,8 +189,12 @@ static void of_get_regulation_constraints(struct device_node *np, } suspend_np = of_get_child_by_name(np, regulator_states[i]); - if (!suspend_np || !suspend_state) + if (!suspend_np) continue; + if (!suspend_state) { + of_node_put(suspend_np); + continue; + } if (!of_property_read_u32(suspend_np, "regulator-mode", &pval)) { -- 2.22.0

2 1

[PATCH OLK-5.10 V1] libnvdimm/labels: Fix divide error in nd_label_data_init()
by Wang Tao 02 Jul '25

02 Jul '25

From: Robert Richter <rrichter(a)amd.com> stable inclusion from stable-v5.10.238 commit 396c46d3f59a18ebcc500640e749f16e197d472b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEE CVE: CVE-2025-38072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef1d3455bbc1922f94a91ed58d3d7db440652959 ] If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check. Signed-off-by: Robert Richter <rrichter(a)amd.com> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)amd.com> Reviewed-by: Ira Weiny <ira.weiny(a)intel.com> Link: https://patch.msgid.link/20250320112223.608320-1-rrichter@amd.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/nvdimm/label.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c index 9251441fd8a3..5251058adc4d 100644 --- a/drivers/nvdimm/label.c +++ b/drivers/nvdimm/label.c @@ -421,7 +421,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd) if (ndd->data) return 0; - if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) { + if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 || + ndd->nsarea.config_size == 0) { dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n", ndd->nsarea.max_xfer, ndd->nsarea.config_size); return -ENXIO; -- 2.34.1

2 1

[PATCH OLK-6.6 V1] libnvdimm/labels: Fix divide error in nd_label_data_init()
by Wang Tao 02 Jul '25

02 Jul '25

From: Robert Richter <rrichter(a)amd.com> stable inclusion from stable-v6.6.93 commit ea3d95e05e97ea20fd6513f647393add16fce3b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEE CVE: CVE-2025-38072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef1d3455bbc1922f94a91ed58d3d7db440652959 ] If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check. Signed-off-by: Robert Richter <rrichter(a)amd.com> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)amd.com> Reviewed-by: Ira Weiny <ira.weiny(a)intel.com> Link: https://patch.msgid.link/20250320112223.608320-1-rrichter@amd.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/nvdimm/label.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c index 082253a3a956..04f4a049599a 100644 --- a/drivers/nvdimm/label.c +++ b/drivers/nvdimm/label.c @@ -442,7 +442,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd) if (ndd->data) return 0; - if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) { + if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 || + ndd->nsarea.config_size == 0) { dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n", ndd->nsarea.max_xfer, ndd->nsarea.config_size); return -ENXIO; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] net/tipc/link.c:198: warning: Function parameter or member 'backlog.target_bskb' not described in 'tipc_link'
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: eb923245b9deef21ddd337c4e1e081c407a891fd [1605/1605] tipc: fix unlimited bundling of small messages config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507021034.5BJRugpy-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021034.5BJRugpy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021034.5BJRugpy-lkp@intel.com/ All warnings (new ones prefixed by >>): net/tipc/link.c:198: warning: Function parameter or member 'session' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'snd_nxt_state' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'rcv_nxt_state' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'in_session' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'active' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'if_name' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'rst_cnt' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'drop_point' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'failover_reasm_skb' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'transmq' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'backlog' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'backlog.len' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'backlog.limit' not described in 'tipc_link' >> net/tipc/link.c:198: warning: Function parameter or member 'backlog.target_bskb' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'snd_nxt' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'last_retransm' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'window' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'rcv_unacked' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'deferdq' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'bc_rcvlink' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'bc_sndlink' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'prev_retr' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'prev_from' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'prev_to' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'nack_state' not described in 'tipc_link' net/tipc/link.c:198: warning: Function parameter or member 'bc_peer_is_up' not described in 'tipc_link' net/tipc/link.c:450: warning: Function parameter or member 'net' not described in 'tipc_link_create' net/tipc/link.c:450: warning: Function parameter or member 'self' not described in 'tipc_link_create' net/tipc/link.c:450: warning: Function parameter or member 'peer_id' not described in 'tipc_link_create' net/tipc/link.c:450: warning: Excess function parameter 'n' description in 'tipc_link_create' net/tipc/link.c:450: warning: Excess function parameter 'ownnode' description in 'tipc_link_create' net/tipc/link.c:519: warning: Function parameter or member 'net' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Function parameter or member 'ownnode' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Function parameter or member 'peer' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Function parameter or member 'peer_caps' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Function parameter or member 'bc_sndlink' not described in 'tipc_link_bc_create' net/tipc/link.c:519: warning: Excess function parameter 'n' description in 'tipc_link_bc_create' net/tipc/link.c:903: warning: Function parameter or member 'l' not described in 'tipc_link_xmit' net/tipc/link.c:903: warning: Excess function parameter 'link' description in 'tipc_link_xmit' vim +198 net/tipc/link.c 38206d59390684 Jon Paul Maloy 2015-11-19 78 38206d59390684 Jon Paul Maloy 2015-11-19 79 /** 38206d59390684 Jon Paul Maloy 2015-11-19 80 * struct tipc_link - TIPC link data structure 38206d59390684 Jon Paul Maloy 2015-11-19 81 * @addr: network address of link's peer node 38206d59390684 Jon Paul Maloy 2015-11-19 82 * @name: link name character string 38206d59390684 Jon Paul Maloy 2015-11-19 83 * @media_addr: media address to use when sending messages over link 38206d59390684 Jon Paul Maloy 2015-11-19 84 * @timer: link timer 38206d59390684 Jon Paul Maloy 2015-11-19 85 * @net: pointer to namespace struct 38206d59390684 Jon Paul Maloy 2015-11-19 86 * @refcnt: reference counter for permanent references (owner node & timer) 38206d59390684 Jon Paul Maloy 2015-11-19 87 * @peer_session: link session # being used by peer end of link 38206d59390684 Jon Paul Maloy 2015-11-19 88 * @peer_bearer_id: bearer id used by link's peer endpoint 38206d59390684 Jon Paul Maloy 2015-11-19 89 * @bearer_id: local bearer id used by link 38206d59390684 Jon Paul Maloy 2015-11-19 90 * @tolerance: minimum link continuity loss needed to reset link [in ms] 38206d59390684 Jon Paul Maloy 2015-11-19 91 * @abort_limit: # of unacknowledged continuity probes needed to reset link 38206d59390684 Jon Paul Maloy 2015-11-19 92 * @state: current state of link FSM 38206d59390684 Jon Paul Maloy 2015-11-19 93 * @peer_caps: bitmap describing capabilities of peer node 38206d59390684 Jon Paul Maloy 2015-11-19 94 * @silent_intv_cnt: # of timer intervals without any reception from peer 38206d59390684 Jon Paul Maloy 2015-11-19 95 * @proto_msg: template for control messages generated by link 38206d59390684 Jon Paul Maloy 2015-11-19 96 * @pmsg: convenience pointer to "proto_msg" field 38206d59390684 Jon Paul Maloy 2015-11-19 97 * @priority: current link priority 38206d59390684 Jon Paul Maloy 2015-11-19 98 * @net_plane: current link network plane ('A' through 'H') 35c55c9877f8de Jon Paul Maloy 2016-06-13 99 * @mon_state: cookie with information needed by link monitor 38206d59390684 Jon Paul Maloy 2015-11-19 100 * @backlog_limit: backlog queue congestion thresholds (indexed by importance) 38206d59390684 Jon Paul Maloy 2015-11-19 101 * @exp_msg_count: # of tunnelled messages expected during link changeover 38206d59390684 Jon Paul Maloy 2015-11-19 102 * @reset_rcv_checkpt: seq # of last acknowledged message at time of link reset 38206d59390684 Jon Paul Maloy 2015-11-19 103 * @mtu: current maximum packet size for this link 38206d59390684 Jon Paul Maloy 2015-11-19 104 * @advertised_mtu: advertised own mtu when link is being established 38206d59390684 Jon Paul Maloy 2015-11-19 105 * @transmitq: queue for sent, non-acked messages 38206d59390684 Jon Paul Maloy 2015-11-19 106 * @backlogq: queue for messages waiting to be sent 38206d59390684 Jon Paul Maloy 2015-11-19 107 * @snt_nxt: next sequence number to use for outbound messages 38206d59390684 Jon Paul Maloy 2015-11-19 108 * @last_retransmitted: sequence number of most recently retransmitted message a4dc70d46cf1a0 Jon Maloy 2018-07-06 109 * @stale_cnt: counter for number of identical retransmit attempts a4dc70d46cf1a0 Jon Maloy 2018-07-06 110 * @stale_limit: time when repeated identical retransmits must force link reset 38206d59390684 Jon Paul Maloy 2015-11-19 111 * @ackers: # of peers that needs to ack each packet before it can be released 38206d59390684 Jon Paul Maloy 2015-11-19 112 * @acked: # last packet acked by a certain peer. Used for broadcast. 38206d59390684 Jon Paul Maloy 2015-11-19 113 * @rcv_nxt: next sequence number to expect for inbound messages 38206d59390684 Jon Paul Maloy 2015-11-19 114 * @deferred_queue: deferred queue saved OOS b'cast message received from node 38206d59390684 Jon Paul Maloy 2015-11-19 115 * @unacked_window: # of inbound messages rx'd without ack'ing back to peer 38206d59390684 Jon Paul Maloy 2015-11-19 116 * @inputq: buffer queue for messages to be delivered upwards 38206d59390684 Jon Paul Maloy 2015-11-19 117 * @namedq: buffer queue for name table messages to be delivered upwards 38206d59390684 Jon Paul Maloy 2015-11-19 118 * @next_out: ptr to first unsent outbound message in queue 38206d59390684 Jon Paul Maloy 2015-11-19 119 * @wakeupq: linked list of wakeup msgs waiting for link congestion to abate 38206d59390684 Jon Paul Maloy 2015-11-19 120 * @long_msg_seq_no: next identifier to use for outbound fragmented messages 38206d59390684 Jon Paul Maloy 2015-11-19 121 * @reasm_buf: head of partially reassembled inbound message fragments 38206d59390684 Jon Paul Maloy 2015-11-19 122 * @bc_rcvr: marks that this is a broadcast receiver link 38206d59390684 Jon Paul Maloy 2015-11-19 123 * @stats: collects statistics regarding link activity 38206d59390684 Jon Paul Maloy 2015-11-19 124 */ 38206d59390684 Jon Paul Maloy 2015-11-19 125 struct tipc_link { 38206d59390684 Jon Paul Maloy 2015-11-19 126 u32 addr; 38206d59390684 Jon Paul Maloy 2015-11-19 127 char name[TIPC_MAX_LINK_NAME]; 38206d59390684 Jon Paul Maloy 2015-11-19 128 struct net *net; 38206d59390684 Jon Paul Maloy 2015-11-19 129 38206d59390684 Jon Paul Maloy 2015-11-19 130 /* Management and link supervision data */ 7ea817f4e8322f Jon Maloy 2018-07-10 131 u16 peer_session; 7ea817f4e8322f Jon Maloy 2018-07-10 132 u16 session; 9012de50895601 Jon Maloy 2018-07-10 133 u16 snd_nxt_state; 9012de50895601 Jon Maloy 2018-07-10 134 u16 rcv_nxt_state; 38206d59390684 Jon Paul Maloy 2015-11-19 135 u32 peer_bearer_id; 38206d59390684 Jon Paul Maloy 2015-11-19 136 u32 bearer_id; 38206d59390684 Jon Paul Maloy 2015-11-19 137 u32 tolerance; 38206d59390684 Jon Paul Maloy 2015-11-19 138 u32 abort_limit; 38206d59390684 Jon Paul Maloy 2015-11-19 139 u32 state; 38206d59390684 Jon Paul Maloy 2015-11-19 140 u16 peer_caps; 7ea817f4e8322f Jon Maloy 2018-07-10 141 bool in_session; 38206d59390684 Jon Paul Maloy 2015-11-19 142 bool active; 38206d59390684 Jon Paul Maloy 2015-11-19 143 u32 silent_intv_cnt; e74a386d70c793 Jon Paul Maloy 2016-03-03 144 char if_name[TIPC_MAX_IF_NAME]; 38206d59390684 Jon Paul Maloy 2015-11-19 145 u32 priority; 38206d59390684 Jon Paul Maloy 2015-11-19 146 char net_plane; 35c55c9877f8de Jon Paul Maloy 2016-06-13 147 struct tipc_mon_state mon_state; 88e8ac7000dc7c Jon Paul Maloy 2016-04-15 148 u16 rst_cnt; 38206d59390684 Jon Paul Maloy 2015-11-19 149 38206d59390684 Jon Paul Maloy 2015-11-19 150 /* Failover/synch */ 38206d59390684 Jon Paul Maloy 2015-11-19 151 u16 drop_point; 38206d59390684 Jon Paul Maloy 2015-11-19 152 struct sk_buff *failover_reasm_skb; 38206d59390684 Jon Paul Maloy 2015-11-19 153 38206d59390684 Jon Paul Maloy 2015-11-19 154 /* Max packet negotiation */ 38206d59390684 Jon Paul Maloy 2015-11-19 155 u16 mtu; 38206d59390684 Jon Paul Maloy 2015-11-19 156 u16 advertised_mtu; 38206d59390684 Jon Paul Maloy 2015-11-19 157 38206d59390684 Jon Paul Maloy 2015-11-19 158 /* Sending */ 38206d59390684 Jon Paul Maloy 2015-11-19 159 struct sk_buff_head transmq; 38206d59390684 Jon Paul Maloy 2015-11-19 160 struct sk_buff_head backlogq; 38206d59390684 Jon Paul Maloy 2015-11-19 161 struct { 38206d59390684 Jon Paul Maloy 2015-11-19 162 u16 len; 38206d59390684 Jon Paul Maloy 2015-11-19 163 u16 limit; eb923245b9deef Tuong Lien 2019-10-10 164 struct sk_buff *target_bskb; 38206d59390684 Jon Paul Maloy 2015-11-19 165 } backlog[5]; 38206d59390684 Jon Paul Maloy 2015-11-19 166 u16 snd_nxt; 38206d59390684 Jon Paul Maloy 2015-11-19 167 u16 last_retransm; 38206d59390684 Jon Paul Maloy 2015-11-19 168 u16 window; a4dc70d46cf1a0 Jon Maloy 2018-07-06 169 u16 stale_cnt; a4dc70d46cf1a0 Jon Maloy 2018-07-06 170 unsigned long stale_limit; 38206d59390684 Jon Paul Maloy 2015-11-19 171 38206d59390684 Jon Paul Maloy 2015-11-19 172 /* Reception */ 38206d59390684 Jon Paul Maloy 2015-11-19 173 u16 rcv_nxt; 38206d59390684 Jon Paul Maloy 2015-11-19 174 u32 rcv_unacked; 38206d59390684 Jon Paul Maloy 2015-11-19 175 struct sk_buff_head deferdq; 38206d59390684 Jon Paul Maloy 2015-11-19 176 struct sk_buff_head *inputq; 38206d59390684 Jon Paul Maloy 2015-11-19 177 struct sk_buff_head *namedq; 38206d59390684 Jon Paul Maloy 2015-11-19 178 38206d59390684 Jon Paul Maloy 2015-11-19 179 /* Congestion handling */ 38206d59390684 Jon Paul Maloy 2015-11-19 180 struct sk_buff_head wakeupq; 38206d59390684 Jon Paul Maloy 2015-11-19 181 38206d59390684 Jon Paul Maloy 2015-11-19 182 /* Fragmentation/reassembly */ 38206d59390684 Jon Paul Maloy 2015-11-19 183 struct sk_buff *reasm_buf; 38206d59390684 Jon Paul Maloy 2015-11-19 184 38206d59390684 Jon Paul Maloy 2015-11-19 185 /* Broadcast */ 38206d59390684 Jon Paul Maloy 2015-11-19 186 u16 ackers; 38206d59390684 Jon Paul Maloy 2015-11-19 187 u16 acked; 38206d59390684 Jon Paul Maloy 2015-11-19 188 struct tipc_link *bc_rcvlink; 38206d59390684 Jon Paul Maloy 2015-11-19 189 struct tipc_link *bc_sndlink; 7c4a54b963b68e Jon Paul Maloy 2016-09-01 190 unsigned long prev_retr; 7c4a54b963b68e Jon Paul Maloy 2016-09-01 191 u16 prev_from; 7c4a54b963b68e Jon Paul Maloy 2016-09-01 192 u16 prev_to; 7c4a54b963b68e Jon Paul Maloy 2016-09-01 193 u8 nack_state; 38206d59390684 Jon Paul Maloy 2015-11-19 194 bool bc_peer_is_up; 38206d59390684 Jon Paul Maloy 2015-11-19 195 38206d59390684 Jon Paul Maloy 2015-11-19 196 /* Statistics */ 38206d59390684 Jon Paul Maloy 2015-11-19 197 struct tipc_stats stats; 38206d59390684 Jon Paul Maloy 2015-11-19 @198 }; 38206d59390684 Jon Paul Maloy 2015-11-19 199 :::::: The code at line 198 was first introduced by commit :::::: 38206d5939068415c413ac253be6f364d06e672f tipc: narrow down interface towards struct tipc_link :::::: TO: Jon Paul Maloy <jon.maloy(a)ericsson.com> :::::: CC: David S. Miller <davem(a)davemloft.net> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0