- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1605/1605] block/bio-integrity.c:41:6: warning: no previous prototype for function '__bio_integrity_free'
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: f9c4e7b09f7d51f9256fe51b9c40657cd7302530 [1605/1605] block: release bip in a right way in error path config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507021458.HwvZj3Sk-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021458.HwvZj3Sk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021458.HwvZj3Sk-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio-integrity.c:41:6: warning: no previous prototype for function '__bio_integrity_free' [-Wmissing-prototypes] 41 | void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) | ^ block/bio-integrity.c:41:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 41 | void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) | ^ | static 1 warning generated. block/bio-integrity.o: warning: objtool: missing symbol for section .init.text vim +/__bio_integrity_free +41 block/bio-integrity.c 40 > 41 void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) 42 { 43 if (bs && mempool_initialized(&bs->bio_integrity_pool)) { 44 if (bip->bip_vec) 45 bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, 46 bip->bip_slab); 47 mempool_free(bip, &bs->bio_integrity_pool); 48 } else { 49 kfree(bip); 50 } 51 } 52 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1684/1684] drivers/acpi/acpi_adxl.o: warning: objtool: missing symbol for section .text
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: a275b25c978318513b28931cec91c4a10120748b [1684/1684] EDAC, skx_edac: Add address translation for non-volatile DIMMs config: x86_64-buildonly-randconfig-003-20250702 (https://download.01.org/0day-ci/archive/20250702/202507022042.Q1D7bRjT-lkp@…) compiler: clang version 20.1.7 (https://github.com/llvm/llvm-project 6146a88f60492b520a36f8f8f3231e15f3cc6082) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507022042.Q1D7bRjT-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507022042.Q1D7bRjT-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/acpi/acpi_adxl.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2445/2445] drivers/gpu/drm/display/drm_display_helper.o: warning: objtool: drm_dp_set_subconnector_property+0xed: unreachable instruction
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bf2df406d75690971b837e37418494e09d8eec02 commit: 107e8e2d48f2014216a818314d4e1af591b39aed [2445/2445] cpu: Re-enable CPU mitigations by default for !X86 architectures config: x86_64-buildonly-randconfig-2001-20250702 (https://download.01.org/0day-ci/archive/20250702/202507021408.Op6CzldG-lkp@…) compiler: clang version 20.1.7 (https://github.com/llvm/llvm-project 6146a88f60492b520a36f8f8f3231e15f3cc6082) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021408.Op6CzldG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021408.Op6CzldG-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/display/drm_display_helper.o: warning: objtool: drm_dp_subconnector_type+0xa5: unreachable instruction >> drivers/gpu/drm/display/drm_display_helper.o: warning: objtool: drm_dp_set_subconnector_property+0xed: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2445/2445] include/linux/psp-hygon.h:219:5: warning: no previous prototype for 'psp_register_cmd_notifier'
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bf2df406d75690971b837e37418494e09d8eec02 commit: 518c81d56c055affc71650b1ad1ba7f86e5ee867 [2445/2445] arch/x86/kvm: Support tkm virtualization config: x86_64-buildonly-randconfig-2002-20250702 (https://download.01.org/0day-ci/archive/20250702/202507021332.zHwpOcwr-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021332.zHwpOcwr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021332.zHwpOcwr-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/x86/kvm/psp.c:15: >> include/linux/psp-hygon.h:219:5: warning: no previous prototype for 'psp_register_cmd_notifier' [-Wmissing-prototypes] 219 | int psp_register_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> include/linux/psp-hygon.h:220:5: warning: no previous prototype for 'psp_unregister_cmd_notifier' [-Wmissing-prototypes] 220 | int psp_unregister_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kvm/psp.c:105:21: warning: no previous prototype for 'map_tbl_dump' [-Wmissing-prototypes] 105 | void __maybe_unused map_tbl_dump(const char *title, struct addr_map_tbls *tbls) | ^~~~~~~~~~~~ arch/x86/kvm/psp.c:118:21: warning: no previous prototype for 'g2h_tbl_dump' [-Wmissing-prototypes] 118 | void __maybe_unused g2h_tbl_dump(const char *title, struct gpa2hva_tbls *tbls) | ^~~~~~~~~~~~ vim +/psp_register_cmd_notifier +219 include/linux/psp-hygon.h d0b3a770d8e20d chench00 2024-08-01 218 d0b3a770d8e20d chench00 2024-08-01 @219 int psp_register_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } d0b3a770d8e20d chench00 2024-08-01 @220 int psp_unregister_cmd_notifier(uint32_t cmd_id, p2c_notifier_t notifier) { return -ENODEV; } d0b3a770d8e20d chench00 2024-08-01 221 :::::: The code at line 219 was first introduced by commit :::::: d0b3a770d8e20d953fe2a74ea8c4b5f4767c4add crypto: command co-processor: Add another mailbox interrupt support for PSP sending command to X86 :::::: TO: chench00 <chench(a)hygon.cn> :::::: CC: chench00 <chench(a)hygon.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] net/sctp/chunk.c:198:25: warning: data argument not used by format string
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 05834253a093f4e6d9cc31f380de304b540a548e [1605/1605] sctp: frag_point sanity check config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250702/202507021205.lTZLbTRm-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021205.lTZLbTRm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021205.lTZLbTRm-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/sctp/chunk.c:198:25: warning: data argument not used by format string [-Wformat-extra-args] 197 | pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)", | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 198 | __func__, asoc, max_data); | ~~~~~~~~~~~~~~~~^~~~~~~~~ include/linux/printk.h:485:49: note: expanded from macro 'pr_warn_ratelimited' 485 | printk_ratelimited(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~ include/linux/printk.h:469:17: note: expanded from macro 'printk_ratelimited' 469 | printk(fmt, ##__VA_ARGS__); \ | ~~~ ^ 1 warning generated. vim +198 net/sctp/chunk.c 156 157 158 /* A data chunk can have a maximum payload of (2^16 - 20). Break 159 * down any such message into smaller chunks. Opportunistically, fragment 160 * the chunks down to the current MTU constraints. We may get refragmented 161 * later if the PMTU changes, but it is _much better_ to fragment immediately 162 * with a reasonable guess than always doing our fragmentation on the 163 * soft-interrupt. 164 */ 165 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc, 166 struct sctp_sndrcvinfo *sinfo, 167 struct iov_iter *from) 168 { 169 size_t len, first_len, max_data, remaining; 170 size_t msg_len = iov_iter_count(from); 171 struct sctp_shared_key *shkey = NULL; 172 struct list_head *pos, *temp; 173 struct sctp_chunk *chunk; 174 struct sctp_datamsg *msg; 175 int err; 176 177 msg = sctp_datamsg_new(GFP_KERNEL); 178 if (!msg) 179 return ERR_PTR(-ENOMEM); 180 181 /* Note: Calculate this outside of the loop, so that all fragments 182 * have the same expiration. 183 */ 184 if (asoc->peer.prsctp_capable && sinfo->sinfo_timetolive && 185 (SCTP_PR_TTL_ENABLED(sinfo->sinfo_flags) || 186 !SCTP_PR_POLICY(sinfo->sinfo_flags))) 187 msg->expires_at = jiffies + 188 msecs_to_jiffies(sinfo->sinfo_timetolive); 189 190 /* This is the biggest possible DATA chunk that can fit into 191 * the packet 192 */ 193 max_data = asoc->frag_point; 194 if (unlikely(!max_data)) { 195 max_data = sctp_min_frag_point(sctp_sk(asoc->base.sk), 196 sctp_datachk_len(&asoc->stream)); 197 pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)", > 198 __func__, asoc, max_data); 199 } 200 201 /* If the the peer requested that we authenticate DATA chunks 202 * we need to account for bundling of the AUTH chunks along with 203 * DATA. 204 */ 205 if (sctp_auth_send_cid(SCTP_CID_DATA, asoc)) { 206 struct sctp_hmac *hmac_desc = sctp_auth_asoc_get_hmac(asoc); 207 208 if (hmac_desc) 209 max_data -= SCTP_PAD4(sizeof(struct sctp_auth_chunk) + 210 hmac_desc->hmac_len); 211 212 if (sinfo->sinfo_tsn && 213 sinfo->sinfo_ssn != asoc->active_key_id) { 214 shkey = sctp_auth_get_shkey(asoc, sinfo->sinfo_ssn); 215 if (!shkey) { 216 err = -EINVAL; 217 goto errout; 218 } 219 } else { 220 shkey = asoc->shkey; 221 } 222 } 223 224 /* Set first_len and then account for possible bundles on first frag */ 225 first_len = max_data; 226 227 /* Check to see if we have a pending SACK and try to let it be bundled 228 * with this message. Do this if we don't have any data queued already. 229 * To check that, look at out_qlen and retransmit list. 230 * NOTE: we will not reduce to account for SACK, if the message would 231 * not have been fragmented. 232 */ 233 if (timer_pending(&asoc->timers[SCTP_EVENT_TIMEOUT_SACK]) && 234 asoc->outqueue.out_qlen == 0 && 235 list_empty(&asoc->outqueue.retransmit) && 236 msg_len > max_data) 237 first_len -= SCTP_PAD4(sizeof(struct sctp_sack_chunk)); 238 239 /* Encourage Cookie-ECHO bundling. */ 240 if (asoc->state < SCTP_STATE_COOKIE_ECHOED) 241 first_len -= SCTP_ARBITRARY_COOKIE_ECHO_LEN; 242 243 /* Account for a different sized first fragment */ 244 if (msg_len >= first_len) { 245 msg->can_delay = 0; 246 if (msg_len > first_len) 247 SCTP_INC_STATS(sock_net(asoc->base.sk), 248 SCTP_MIB_FRAGUSRMSGS); 249 } else { 250 /* Which may be the only one... */ 251 first_len = msg_len; 252 } 253 254 /* Create chunks for all DATA chunks. */ 255 for (remaining = msg_len; remaining; remaining -= len) { 256 u8 frag = SCTP_DATA_MIDDLE_FRAG; 257 258 if (remaining == msg_len) { 259 /* First frag, which may also be the last */ 260 frag |= SCTP_DATA_FIRST_FRAG; 261 len = first_len; 262 } else { 263 /* Middle frags */ 264 len = max_data; 265 } 266 267 if (len >= remaining) { 268 /* Last frag, which may also be the first */ 269 len = remaining; 270 frag |= SCTP_DATA_LAST_FRAG; 271 272 /* The application requests to set the I-bit of the 273 * last DATA chunk of a user message when providing 274 * the user message to the SCTP implementation. 275 */ 276 if ((sinfo->sinfo_flags & SCTP_EOF) || 277 (sinfo->sinfo_flags & SCTP_SACK_IMMEDIATELY)) 278 frag |= SCTP_DATA_SACK_IMM; 279 } 280 281 chunk = asoc->stream.si->make_datafrag(asoc, sinfo, len, frag, 282 GFP_KERNEL); 283 if (!chunk) { 284 err = -ENOMEM; 285 goto errout; 286 } 287 288 err = sctp_user_addto_chunk(chunk, len, from); 289 if (err < 0) 290 goto errout_chunk_free; 291 292 chunk->shkey = shkey; 293 294 /* Put the chunk->skb back into the form expected by send. */ 295 __skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr - 296 chunk->skb->data); 297 298 sctp_datamsg_assign(msg, chunk); 299 list_add_tail(&chunk->frag_list, &msg->chunks); 300 } 301 302 return msg; 303 304 errout_chunk_free: 305 sctp_chunk_free(chunk); 306 307 errout: 308 list_for_each_safe(pos, temp, &msg->chunks) { 309 list_del_init(pos); 310 chunk = list_entry(pos, struct sctp_chunk, frag_list); 311 sctp_chunk_free(chunk); 312 } 313 sctp_datamsg_put(msg); 314 315 return ERR_PTR(err); 316 } 317 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2999/2999] drivers/crypto/ccp/hygon/hct.c:1343:15: warning: no previous prototype for 'hct_pin_memory'
by kernel test robot 02 Jul '25

02 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e4755f6a2b98f251edcf63f98f416b5d76425f8c commit: b7a218b5c46200f323ac0fe07589e0bf0d648069 [2999/2999] crypto: hct: provides hygon crypto technology ccp device driver. config: x86_64-buildonly-randconfig-2004-20250702 (https://download.01.org/0day-ci/archive/20250702/202507021158.W1ajhxKz-lkp@…) compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250702/202507021158.W1ajhxKz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507021158.W1ajhxKz-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/hct.c:1343:15: warning: no previous prototype for 'hct_pin_memory' [-Wmissing-prototypes] 1343 | struct page **hct_pin_memory(struct hct_private *private, unsigned long uaddr, | ^~~~~~~~~~~~~~ vim +/hct_pin_memory +1343 drivers/crypto/ccp/hygon/hct.c 1342 > 1343 struct page **hct_pin_memory(struct hct_private *private, unsigned long uaddr, 1344 unsigned long ulen, unsigned long *n) 1345 { 1346 unsigned long npages, size; 1347 int npinned; 1348 struct page **pages; 1349 unsigned long first, last; 1350 1351 if (ulen == 0 || uaddr + ulen < uaddr) 1352 return NULL; 1353 1354 first = (uaddr & PAGE_MASK) >> PAGE_SHIFT; 1355 last = ((uaddr + ulen - 1) & PAGE_MASK) >> PAGE_SHIFT; 1356 npages = (last - first + 1); 1357 1358 if (WARN_ON_ONCE(npages > INT_MAX)) 1359 return NULL; 1360 1361 size = npages * sizeof(struct page *); 1362 if (size > PAGE_SIZE) 1363 pages = vmalloc(size); 1364 else 1365 pages = kmalloc(size, GFP_KERNEL); 1366 1367 if (!pages) 1368 return NULL; 1369 1370 /* Pin the user virtual address. */ 1371 npinned = pin_user_pages_fast(uaddr, npages, FOLL_WRITE, pages); 1372 if (npinned != npages) 1373 goto err; 1374 1375 *n = npages; 1376 return pages; 1377 1378 err: 1379 if (npinned > 0) 1380 unpin_user_pages(pages, npinned); 1381 kvfree(pages); 1382 return NULL; 1383 } 1384 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] uprobes: check anon before compound when unregister
by Tengda Wu 02 Jul '25

02 Jul '25

From: Chen Zhongjin <chenzhongjin(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJG91 -------------------------------- In uprobe unregister, if the old_page is a compound page, it will trigger a warning and cause the unregister operation to fail: "uprobe unregister should never work on compound page" If old_page is allocated by uprobe through alloc_page_vma(), this page cannot be compounded, so this warning means old_page is a remapped page after register. In this scenario, check PageAnon() first to determine whether the page is a remapped page. Just pass the PageCompound() check and unregister uprobe safely. Fixes: aa5de305c90c ("kernel/events/uprobes.c: only do FOLL_SPLIT_PMD for uprobe register") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/events/uprobes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index 8a6c5ee003c2..e51dbb0e8a56 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -493,7 +493,7 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm, goto put_old; } - if (WARN(!is_register && PageCompound(old_page), + if (WARN(!is_register && PageAnon(old_page) && PageCompound(old_page), "uprobe unregister should never work on compound page\n")) { ret = -EINVAL; goto put_old; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
by Yuan Can 02 Jul '25

02 Jul '25

From: Liang He <windhl(a)126.com> stable inclusion from stable-v4.19.256 commit b9ca8585c766616563cf3c062c6878f61f83cf00 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9MJ CVE: CVE-2022-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 66efb665cd5ad69b27dca8571bf89fc6b9c628a4 ] We should call the of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Fixes: 40e20d68bb3f ("regulator: of: Add support for parsing regulator_state for suspend state") Signed-off-by: Liang He <windhl(a)126.com> Link: https://lore.kernel.org/r/20220715111027.391032-1-windhl@126.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/regulator/of_regulator.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c index b255590aef36..b2bd7ee46c45 100644 --- a/drivers/regulator/of_regulator.c +++ b/drivers/regulator/of_regulator.c @@ -189,8 +189,12 @@ static void of_get_regulation_constraints(struct device_node *np, } suspend_np = of_get_child_by_name(np, regulator_states[i]); - if (!suspend_np || !suspend_state) + if (!suspend_np) continue; + if (!suspend_state) { + of_node_put(suspend_np); + continue; + } if (!of_property_read_u32(suspend_np, "regulator-mode", &pval)) { -- 2.22.0

2 1

[PATCH OLK-5.10 V1] libnvdimm/labels: Fix divide error in nd_label_data_init()
by Wang Tao 02 Jul '25

02 Jul '25

From: Robert Richter <rrichter(a)amd.com> stable inclusion from stable-v5.10.238 commit 396c46d3f59a18ebcc500640e749f16e197d472b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEE CVE: CVE-2025-38072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef1d3455bbc1922f94a91ed58d3d7db440652959 ] If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check. Signed-off-by: Robert Richter <rrichter(a)amd.com> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)amd.com> Reviewed-by: Ira Weiny <ira.weiny(a)intel.com> Link: https://patch.msgid.link/20250320112223.608320-1-rrichter@amd.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/nvdimm/label.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c index 9251441fd8a3..5251058adc4d 100644 --- a/drivers/nvdimm/label.c +++ b/drivers/nvdimm/label.c @@ -421,7 +421,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd) if (ndd->data) return 0; - if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) { + if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 || + ndd->nsarea.config_size == 0) { dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n", ndd->nsarea.max_xfer, ndd->nsarea.config_size); return -ENXIO; -- 2.34.1

2 1

[PATCH OLK-6.6 V1] libnvdimm/labels: Fix divide error in nd_label_data_init()
by Wang Tao 02 Jul '25

02 Jul '25

From: Robert Richter <rrichter(a)amd.com> stable inclusion from stable-v6.6.93 commit ea3d95e05e97ea20fd6513f647393add16fce3b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEE CVE: CVE-2025-38072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ef1d3455bbc1922f94a91ed58d3d7db440652959 ] If a faulty CXL memory device returns a broken zero LSA size in its memory device information (Identify Memory Device (Opcode 4000h), CXL spec. 3.1, 8.2.9.9.1.1), a divide error occurs in the libnvdimm driver: Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:nd_label_data_init+0x10e/0x800 [libnvdimm] Code and flow: 1) CXL Command 4000h returns LSA size = 0 2) config_size is assigned to zero LSA size (CXL pmem driver): drivers/cxl/pmem.c: .config_size = mds->lsa_size, 3) max_xfer is set to zero (nvdimm driver): drivers/nvdimm/label.c: max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size); 4) A subsequent DIV_ROUND_UP() causes a division by zero: drivers/nvdimm/label.c: /* Make our initial read size a multiple of max_xfer size */ drivers/nvdimm/label.c: read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer, drivers/nvdimm/label.c- config_size); Fix this by checking the config size parameter by extending an existing check. Signed-off-by: Robert Richter <rrichter(a)amd.com> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)amd.com> Reviewed-by: Ira Weiny <ira.weiny(a)intel.com> Link: https://patch.msgid.link/20250320112223.608320-1-rrichter@amd.com Signed-off-by: Ira Weiny <ira.weiny(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/nvdimm/label.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c index 082253a3a956..04f4a049599a 100644 --- a/drivers/nvdimm/label.c +++ b/drivers/nvdimm/label.c @@ -442,7 +442,8 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd) if (ndd->data) return 0; - if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) { + if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0 || + ndd->nsarea.config_size == 0) { dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n", ndd->nsarea.max_xfer, ndd->nsarea.config_size); return -ENXIO; -- 2.34.1

2 1