- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3214/3214] drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:779:20: error: incomplete definition of type 'struct acpi_device'
by kernel test robot 18 Nov '25

18 Nov '25

Hi LeoLiu-oc, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 17cadcdf512f891675c3c9df62bcf05511293ae9 commit: 5d01c9ec4f3b95b0629a38d936f69bc05e494cc9 [3214/3214] pinctrl: Zhaoxin: Add KH-50000 support config: x86_64-buildonly-randconfig-004-20251118 (https://download.01.org/0day-ci/archive/20251118/202511180448.bJpcAwU9-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251118/202511180448.bJpcAwU9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511180448.bJpcAwU9-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:123:6: warning: variable 'value_back' set but not used [-Wunused-but-set-variable] 123 | u16 value_back = 0; | ^ drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:249:6: warning: variable 'pin' set but not used [-Wunused-but-set-variable] 249 | int pin; | ^ drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:270:6: warning: variable 'pin' set but not used [-Wunused-but-set-variable] 270 | int pin; | ^ drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:330:6: warning: variable 'base_offset' set but not used [-Wunused-but-set-variable] 330 | int base_offset = 0; | ^ drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:363:6: warning: variable 'base_offset' set but not used [-Wunused-but-set-variable] 363 | int base_offset = 0; | ^ drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:487:6: warning: variable 'test_mask' set but not used [-Wunused-but-set-variable] 487 | u16 test_mask; | ^ >> drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:779:20: error: incomplete definition of type 'struct acpi_device' 779 | if (!strcmp(adev->pnp.unique_id, table[i]->uid)) { | ~~~~^ include/linux/compiler.h:55:47: note: expanded from macro 'if' 55 | #define if(cond, ...) if ( __trace_if_var( !!(cond , ## __VA_ARGS__) ) ) | ^~~~ include/linux/compiler.h:57:52: note: expanded from macro '__trace_if_var' 57 | #define __trace_if_var(cond) (__builtin_constant_p(cond) ? (cond) : __trace_if_value(cond)) | ^~~~ include/linux/acpi.h:798:8: note: forward declaration of 'struct acpi_device' 798 | struct acpi_device; | ^ >> drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:779:20: error: incomplete definition of type 'struct acpi_device' 779 | if (!strcmp(adev->pnp.unique_id, table[i]->uid)) { | ~~~~^ include/linux/compiler.h:55:47: note: expanded from macro 'if' 55 | #define if(cond, ...) if ( __trace_if_var( !!(cond , ## __VA_ARGS__) ) ) | ^~~~ include/linux/compiler.h:57:61: note: expanded from macro '__trace_if_var' 57 | #define __trace_if_var(cond) (__builtin_constant_p(cond) ? (cond) : __trace_if_value(cond)) | ^~~~ include/linux/acpi.h:798:8: note: forward declaration of 'struct acpi_device' 798 | struct acpi_device; | ^ >> drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c:779:20: error: incomplete definition of type 'struct acpi_device' 779 | if (!strcmp(adev->pnp.unique_id, table[i]->uid)) { | ~~~~^ include/linux/compiler.h:55:47: note: expanded from macro 'if' 55 | #define if(cond, ...) if ( __trace_if_var( !!(cond , ## __VA_ARGS__) ) ) | ^~~~ include/linux/compiler.h:57:86: note: expanded from macro '__trace_if_var' 57 | #define __trace_if_var(cond) (__builtin_constant_p(cond) ? (cond) : __trace_if_value(cond)) | ^~~~ include/linux/compiler.h:68:3: note: expanded from macro '__trace_if_value' 68 | (cond) ? \ | ^~~~ include/linux/acpi.h:798:8: note: forward declaration of 'struct acpi_device' 798 | struct acpi_device; | ^ 6 warnings and 3 errors generated. vim +779 drivers/pinctrl/zhaoxin/pinctrl-zhaoxin.c 996e18349e58a3 leoliu-oc 2024-02-04 765 996e18349e58a3 leoliu-oc 2024-02-04 766 const struct zhaoxin_pinctrl_soc_data *zhaoxin_pinctrl_get_soc_data(struct platform_device *pdev) 996e18349e58a3 leoliu-oc 2024-02-04 767 { 996e18349e58a3 leoliu-oc 2024-02-04 768 const struct zhaoxin_pinctrl_soc_data *data = NULL; 996e18349e58a3 leoliu-oc 2024-02-04 769 const struct zhaoxin_pinctrl_soc_data **table; 996e18349e58a3 leoliu-oc 2024-02-04 770 struct acpi_device *adev; 996e18349e58a3 leoliu-oc 2024-02-04 771 unsigned int i; 996e18349e58a3 leoliu-oc 2024-02-04 772 996e18349e58a3 leoliu-oc 2024-02-04 773 adev = ACPI_COMPANION(&pdev->dev); 996e18349e58a3 leoliu-oc 2024-02-04 774 if (adev) { 996e18349e58a3 leoliu-oc 2024-02-04 775 const void *match = device_get_match_data(&pdev->dev); 996e18349e58a3 leoliu-oc 2024-02-04 776 996e18349e58a3 leoliu-oc 2024-02-04 777 table = (const struct zhaoxin_pinctrl_soc_data **)match; 996e18349e58a3 leoliu-oc 2024-02-04 778 for (i = 0; table[i]; i++) { 996e18349e58a3 leoliu-oc 2024-02-04 @779 if (!strcmp(adev->pnp.unique_id, table[i]->uid)) { 996e18349e58a3 leoliu-oc 2024-02-04 780 data = table[i]; 996e18349e58a3 leoliu-oc 2024-02-04 781 break; 996e18349e58a3 leoliu-oc 2024-02-04 782 } 996e18349e58a3 leoliu-oc 2024-02-04 783 } 996e18349e58a3 leoliu-oc 2024-02-04 784 } else { 996e18349e58a3 leoliu-oc 2024-02-04 785 const struct platform_device_id *id; 996e18349e58a3 leoliu-oc 2024-02-04 786 996e18349e58a3 leoliu-oc 2024-02-04 787 id = platform_get_device_id(pdev); 996e18349e58a3 leoliu-oc 2024-02-04 788 if (!id) 996e18349e58a3 leoliu-oc 2024-02-04 789 return ERR_PTR(-ENODEV); 996e18349e58a3 leoliu-oc 2024-02-04 790 996e18349e58a3 leoliu-oc 2024-02-04 791 table = (const struct zhaoxin_pinctrl_soc_data **)id->driver_data; 996e18349e58a3 leoliu-oc 2024-02-04 792 data = table[pdev->id]; 996e18349e58a3 leoliu-oc 2024-02-04 793 } 996e18349e58a3 leoliu-oc 2024-02-04 794 996e18349e58a3 leoliu-oc 2024-02-04 795 return data ?: ERR_PTR(-ENODATA); 996e18349e58a3 leoliu-oc 2024-02-04 796 } 996e18349e58a3 leoliu-oc 2024-02-04 797 EXPORT_SYMBOL_GPL(zhaoxin_pinctrl_get_soc_data); 996e18349e58a3 leoliu-oc 2024-02-04 798 :::::: The code at line 779 was first introduced by commit :::::: 996e18349e58a3ace519f9c0f32f4e62fc46ec2c Add support Zhaoxin GPIO pinctrl :::::: TO: leoliu-oc <leoliu-oc(a)zhaoxin.com> :::::: CC: leoliu-oc <leoliu-oc(a)zhaoxin.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3214/3214] drivers/crypto/ccp/hygon/ccp-mdev.c:895:17: error: no member named 'numa_node' in 'struct device'
by kernel test robot 18 Nov '25

18 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 17cadcdf512f891675c3c9df62bcf05511293ae9 commit: 592817a30ddc0ef43c7f5b5fe906ae37cf3bea3b [3214/3214] crypto: ccp: add ccp-mdev functionality to the ccp module. config: x86_64-buildonly-randconfig-005-20251118 (https://download.01.org/0day-ci/archive/20251118/202511180451.SpjYxpJv-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251118/202511180451.SpjYxpJv-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511180451.SpjYxpJv-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/crypto/ccp/hygon/ccp-mdev.c:895:17: error: no member named 'numa_node' in 'struct device' 895 | if (pdev->dev.numa_node >= 0) | ~~~~~~~~~ ^ drivers/crypto/ccp/hygon/ccp-mdev.c:896:31: error: no member named 'numa_node' in 'struct device' 896 | addr.numa_node = pdev->dev.numa_node; | ~~~~~~~~~ ^ drivers/crypto/ccp/hygon/ccp-mdev.c:1144:15: warning: no previous prototype for function 'ccp_pin_memory' [-Wmissing-prototypes] 1144 | struct page **ccp_pin_memory(struct ccp_private *private, unsigned long uaddr, | ^ drivers/crypto/ccp/hygon/ccp-mdev.c:1144:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1144 | struct page **ccp_pin_memory(struct ccp_private *private, unsigned long uaddr, | ^ | static drivers/crypto/ccp/hygon/ccp-mdev.c:1542:54: error: no member named 'numa_node' in 'struct device' 1542 | numa_node = ccp_mdev_data.iommu[page_idx].pdev->dev.numa_node; | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ 1 warning and 3 errors generated. vim +895 drivers/crypto/ccp/hygon/ccp-mdev.c 720 721 static long ccp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 722 { 723 struct mdev_state *mdev_state = file->private_data; 724 unsigned long minsz; 725 int ret = 0; 726 727 switch (cmd) { 728 case VFIO_DEVICE_GET_INFO: 729 { 730 struct vfio_device_info info; 731 732 minsz = offsetofend(struct vfio_device_info, num_irqs); 733 734 if (copy_from_user(&info, (void __user *)arg, minsz)) 735 return -EFAULT; 736 737 if (info.argsz < minsz) 738 return -EINVAL; 739 740 ret = ccp_get_device_info(mdev_state, &info); 741 if (ret) 742 return ret; 743 744 memcpy(&mdev_state->dev_info, &info, sizeof(info)); 745 746 if (copy_to_user((void __user *)arg, &info, minsz)) 747 return -EFAULT; 748 749 return 0; 750 } 751 case VFIO_DEVICE_GET_REGION_INFO: 752 { 753 struct vfio_region_info info; 754 u16 cap_type_id = 0; 755 void *cap_type = NULL; 756 757 minsz = offsetofend(struct vfio_region_info, offset); 758 759 if (copy_from_user(&info, (void __user *)arg, minsz)) 760 return -EFAULT; 761 762 if (info.argsz < minsz) 763 return -EINVAL; 764 765 ret = ccp_get_region_info(mdev_state, &info, &cap_type_id, 766 &cap_type); 767 if (ret) 768 return ret; 769 770 if (copy_to_user((void __user *)arg, &info, minsz)) 771 return -EFAULT; 772 773 return 0; 774 } 775 case VFIO_DEVICE_GET_IRQ_INFO: 776 { 777 struct vfio_irq_info info; 778 779 minsz = offsetofend(struct vfio_irq_info, count); 780 781 if (copy_from_user(&info, (void __user *)arg, minsz)) 782 return -EFAULT; 783 784 if ((info.argsz < minsz) || 785 (info.index >= mdev_state->dev_info.num_irqs)) 786 return -EINVAL; 787 788 ret = ccp_get_irq_info(mdev_state, &info); 789 if (ret) 790 return ret; 791 792 if (copy_to_user((void __user *)arg, &info, minsz)) 793 return -EFAULT; 794 795 return 0; 796 } 797 case VFIO_DEVICE_SET_IRQS: 798 { 799 struct vfio_irq_set hdr; 800 u8 *data = NULL; 801 size_t data_size = 0; 802 803 minsz = offsetofend(struct vfio_irq_set, count); 804 805 if (copy_from_user(&hdr, (void __user *)arg, minsz)) 806 return -EFAULT; 807 808 ret = ccp_set_irqs_validate_and_prepare(&hdr, mdev_state->dev_info.num_irqs, 809 mdev_state->dev_info.num_irqs, &data_size); 810 if (ret) 811 return ret; 812 813 if (data_size) { 814 data = memdup_user((void __user *)(arg + minsz), data_size); 815 if (IS_ERR(data)) 816 return PTR_ERR(data); 817 } 818 819 mutex_lock(&mdev_state->ops_lock); 820 ret = ccp_set_irq_efds(mdev_state, &hdr, data); 821 mutex_unlock(&mdev_state->ops_lock); 822 kfree(data); 823 824 return ret; 825 } 826 case VFIO_DEVICE_CCP_SET_MODE: 827 { 828 struct hygon_ccp_dev_wrapper *ccp_wrapper = mdev_state->iommu->wrapper; 829 unsigned long flags; 830 831 if (!write_trylock_irqsave(&ccp_wrapper->q_lock, flags)) 832 return -EAGAIN; 833 834 if (ccp_wrapper->used_mode == arg) { 835 write_unlock_irqrestore(&ccp_wrapper->q_lock, flags); 836 return 0; 837 } 838 839 switch (arg) { 840 case _KERNEL_SPACE_USED: 841 ccp_wrapper->used_mode = _KERNEL_SPACE_USED; 842 ccp_dev_iommu_detach_device(ccp_wrapper->pdev); 843 ccp_dev_queue_switch(ccp_wrapper->cdev); 844 ccp_add_device(ccp_wrapper->cdev); 845 break; 846 case _USER_SPACE_USED: 847 if (ccp_wrapper->del_flag == 0) { 848 ccp_del_device(ccp_wrapper->cdev); 849 ccp_wrapper->del_flag = 1; 850 } 851 if (ccp_dev_kernel_mode_used_state(ccp_wrapper->cdev)) { 852 ret = -EAGAIN; 853 break; 854 } 855 if (ccp_dev_iommu_attach_device(ccp_wrapper->pdev)) { 856 ccp_add_device(ccp_wrapper->cdev); 857 ccp_wrapper->del_flag = 0; 858 ret = -EINVAL; 859 } else { 860 ccp_wrapper->used_mode = _USER_SPACE_USED; 861 ccp_ectx_list_init(ccp_wrapper); 862 ccp_dev_usermode_userid_clear(mdev_state->iommu->id); 863 } 864 break; 865 default: 866 pr_err("arg = %lu, invalid.\n", arg); 867 ret = -EINVAL; 868 break; 869 } 870 871 write_unlock_irqrestore(&ccp_wrapper->q_lock, flags); 872 return ret; 873 } 874 case VFIO_DEVICE_CCP_GET_MODE: 875 { 876 struct hygon_ccp_dev_wrapper *ccp_wrapper = mdev_state->iommu->wrapper; 877 878 if (put_user(ccp_wrapper->used_mode, (int __user *)arg)) 879 return -EFAULT; 880 881 return 0; 882 } 883 case VFIO_DEVICE_GET_PCI_ADDR: 884 { 885 struct pci_dev *pdev = mdev_state->iommu->pdev; 886 struct mccp_pci_addr addr; 887 888 if (copy_from_user(&addr, (void __user *)arg, sizeof(addr))) 889 return -EFAULT; 890 891 addr.domain = pci_domain_nr(pdev->bus); 892 addr.bus = pdev->bus->number; 893 addr.devid = PCI_SLOT(pdev->devfn); 894 addr.function = PCI_FUNC(pdev->devfn); > 895 if (pdev->dev.numa_node >= 0) 896 addr.numa_node = pdev->dev.numa_node; 897 else 898 addr.numa_node = 0; 899 900 if (copy_to_user((void __user *)arg, &addr, sizeof(addr))) 901 return -EFAULT; 902 903 return 0; 904 } 905 case VFIO_DEVICE_GET_PCI_ID: 906 { 907 struct pci_dev *pdev = mdev_state->iommu->pdev; 908 struct mccp_pci_id pid; 909 910 if (copy_from_user(&pid, (void __user *)arg, sizeof(pid))) 911 return -EFAULT; 912 913 pid.class = pdev->class; 914 pid.vendor = pdev->vendor; 915 pid.device = pdev->device; 916 pid.subsystem_vendor = pdev->subsystem_vendor; 917 pid.subsystem_device = pdev->subsystem_device; 918 919 if (copy_to_user((void __user *)arg, &pid, sizeof(pid))) 920 return -EFAULT; 921 922 return 0; 923 } 924 case VFIO_DEVICE_RESET: 925 return ccp_reset(mdev_state); 926 } 927 return -ENOTTY; 928 } 929 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 v11 00/10] Add xcall 2.0 support
by Jinjie Ruan 17 Nov '25

17 Nov '25

Add xcall 2.0 support, which is compatible with xcall1.0, and can be used to dynamic instruction replacement for hardware xcall. Changes in v11: - Fix a bug in prefetch ko. - Fix a warning when concurrent write xcall comm. Changes in v10: - Fix memory leak in parse_xcall_command(). - Fix memory leak in xcall_comm_open(). - Add comment for smp_store_release(&mm->xcall, area). - Add sys_call_data in xcall_area struct. - clear_xcall_area() in __mmdrop() instead of __mmput(). - Add prefetch ko with some cleanup. Chanegs in v9: - /proc/xcall/comm, 0644 -> 0640 - /proc/xcall/comm check proc_mkdir("xcall", NULL) return value, use it as the parent proc_dir_entry for "comm". - Consider next task is NULL for xcall_info_switch(). - Return -EINVAL for error path in parse_xcall_command(). - Use bitmap for check_xcall_prog(). - Fix global-out-of-bounds KASAN bug in xcall_prog_register(). Changes in v8: - Fix no reigister and unregister null-ptr-ref bug by find prog first. - Fix xcall_comm_write write empty null-ptr-ref bug in memdup_user_nul(). - Add empty owner, exceed 64 prog name and repeat syscall check in check_prog(). - Move INIT_LIST_HEAD(&prog->list) to xcall_prog_register() instead of kernel module. Changes in v7: - Fix alternative bug in sync ventry. - Add "xcall" limit for xcall2.0 and hardware xcall. Changes in v6: - Add "xcall=debug" debug mode to use the "fast syscall" for every system call. - Use alternative to reduce the baseline performance noise floor when not set "xcall" on the kernel cmdline - Move binary_path out from xcall struct, and add to xcall_comm struct. - Fix1. insert_xcall_locked() check both "name" and "binary" to avoid repeated attach same name of xcall. - Fix2. Check if it is an executable file for the binary path. - Fix3. Check if it is an absolute path for the binary path. - Fix4. Remove the extra free_xcall_comm(info) in default branch in proc_xcall_command(). - Fix5. Add zero syscall hijack check for xcall_prog_register(). - Use __arm64_sys_ni_syscall() instead of define inv_xcall(). - Replace the -ENOSYS return value with -EINVAL, to avoid the warning. Changes in v5: - Fix build problem. - el0t_64_sync_ventry jump to kernel_ventry to do VMAP_STACK. - Some cleanups. - Merge the three refactor patch. Changes in v4: - Reuse uprobe_write_opcode() instead of use __replace_page() and copy_to_page(). - Handle error for uprobe_write_opcode(). - Support xcall1.0 before 920G. - Change xcall1.0 bitmap to byte array to save check insns. - Use percpu variable to save check insns for xcall1.0. - A little cleanup. Changes in v3: - Add validity checks during xcall registration to prevent out-of-bounds access and null pointer dereferences. - Extract __replace_page() and copy_to_page() from uprobe, to avoid code duplication. - Replace with new compatible refactored code. - Remove unnecessary member, such as old_name. Jinjie Ruan (2): xcall2.0: Support xcall1.0 for hardware xcall openeuler_defconfig: Enable CONFIG_DYNAMIC_XCALL by default Liao Chang (6): xcall2.0: Add userspace proc interface xcall2.0: Add xcall module register interface xcall2.0: Add xcall_area xcall2.0: Hajack syscall with dynamic instruciton replace xcall: Rework the early exception vector of XCALL and SYNC xcall2.0: Add a basic testcase Xinyu Zheng (1): xcall2.0: Introduce xcall epollwait prefetch feature Yipeng Zou (1): xcall: Add debug mode to force fast syscall for all threads arch/arm64/Kconfig.turbo | 13 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/exception.h | 4 +- arch/arm64/include/asm/mmu_context.h | 7 - arch/arm64/include/asm/xcall.h | 155 +++--- arch/arm64/kernel/cpufeature.c | 79 +-- arch/arm64/kernel/entry-common.c | 28 +- arch/arm64/kernel/entry.S | 86 +-- arch/arm64/kernel/probes/uprobes.c | 6 + arch/arm64/kernel/process.c | 5 + arch/arm64/kernel/syscall.c | 14 + arch/arm64/kernel/xcall/Makefile | 3 +- arch/arm64/kernel/xcall/core.c | 405 +++++++++++++++ arch/arm64/kernel/xcall/entry.S | 139 ++++- arch/arm64/kernel/xcall/proc.c | 238 +++++++++ arch/arm64/kernel/xcall/xcall.c | 68 +-- arch/arm64/kvm/sys_regs.c | 1 + drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/xcall/Kconfig | 19 + drivers/staging/xcall/Makefile | 1 + drivers/staging/xcall/dynamic_xcall_test.c | 89 ++++ drivers/staging/xcall/prefetch.c | 577 +++++++++++++++++++++ fs/proc/proc_xcall.c | 144 ++--- include/linux/mm_types.h | 4 + include/linux/xcall.h | 51 ++ kernel/events/uprobes.c | 23 + kernel/fork.c | 3 + mm/mmap.c | 14 +- 29 files changed, 1806 insertions(+), 374 deletions(-) create mode 100644 arch/arm64/kernel/xcall/core.c create mode 100644 arch/arm64/kernel/xcall/proc.c create mode 100644 drivers/staging/xcall/Kconfig create mode 100644 drivers/staging/xcall/Makefile create mode 100644 drivers/staging/xcall/dynamic_xcall_test.c create mode 100644 drivers/staging/xcall/prefetch.c create mode 100644 include/linux/xcall.h -- 2.34.1

2 11

[PATCH OLK-6.6] accel/qaic: Treat remaining == 0 as error in find_and_map_user_pages()
by Zhang Xiaoxu 17 Nov '25

17 Nov '25

From: Youssef Samir <quic_yabdulra(a)quicinc.com> stable inclusion from stable-v6.6.114 commit 48b1d42286bfef7628b1d6c8c28d4e456c90f725 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BC8 CVE: CVE-2025-40172 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 11f08c30a3e4157305ba692f1d44cca5fc9a8fca ] Currently, if find_and_map_user_pages() takes a DMA xfer request from the user with a length field set to 0, or in a rare case, the host receives QAIC_TRANS_DMA_XFER_CONT from the device where resources->xferred_dma_size is equal to the requested transaction size, the function will return 0 before allocating an sgt or setting the fields of the dma_xfer struct. In that case, encode_addr_size_pairs() will try to access the sgt which will lead to a general protection fault. Return an EINVAL in case the user provides a zero-sized ALP, or the device requests continuation after all of the bytes have been transferred. Fixes: 96d3c1cadedb ("accel/qaic: Clean up integer overflow checking in map_user_pages()") Signed-off-by: Youssef Samir <quic_yabdulra(a)quicinc.com> Signed-off-by: Youssef Samir <youssef.abdulrahman(a)oss.qualcomm.com> Reviewed-by: Jeff Hugo <jeff.hugo(a)oss.qualcomm.com> Reviewed-by: Carl Vanderlip <carl.vanderlip(a)oss.qualcomm.com> Signed-off-by: Jeff Hugo <jeff.hugo(a)oss.qualcomm.com> Link: https://lore.kernel.org/r/20251007122320.339654-1-youssef.abdulrahman@oss.q… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/accel/qaic/qaic_control.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c index f3db3fa91dd5..08b78f567853 100644 --- a/drivers/accel/qaic/qaic_control.c +++ b/drivers/accel/qaic/qaic_control.c @@ -407,7 +407,7 @@ static int find_and_map_user_pages(struct qaic_device *qdev, return -EINVAL; remaining = in_trans->size - resources->xferred_dma_size; if (remaining == 0) - return 0; + return -EINVAL; if (check_add_overflow(xfer_start_addr, remaining, &end)) return -EINVAL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
by Zhang Xiaoxu 17 Nov '25

17 Nov '25

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.246 commit 4e1442bae50ed633c2fe8058f47cd79b4ad88b9b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BAH CVE: CVE-2025-40115 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1703fe4f8ae50d1fb6449854e1fcaed1053e3a14 ] During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device. Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal. [83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0 EFLAGS: 00010206 [83428.295817] RAX: 6f702f323a33312d RBX: ff4290ee81292860 RCX: 5000cca25103be32 [83428.295820] RDX: ff85aeafc3137bb8 RSI: ff4290eeb1966c00 RDI: ffffffffc1560845 [83428.295823] RBP: ff85aeafc3137c18 R08: 74726f702f303a33 R09: ff85aeafc3137bb8 [83428.295826] R10: ff85aeafc3137b18 R11: ff4290f5bd60fe68 R12: ff4290ee81290000 [83428.295830] R13: ff4290ee6e345de0 R14: ff4290ee81290000 R15: ff4290ee6e345e30 [83428.295833] FS: 00007fd9472a6740(0000) GS:ff4290f5ce96b000(0000) knlGS:0000000000000000 [83428.295837] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [83428.295840] CR2: 00007f242b4db238 CR3: 00000002372b8006 CR4: 0000000000771ef0 [83428.295844] PKRU: 55555554 [83428.295846] Call Trace: [83428.295848] <TASK> [83428.295850] _dev_printk+0x5c/0x80 [83428.295857] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295863] mpt3sas_transport_port_remove+0x1c7/0x420 [mpt3sas] [83428.295882] _scsih_remove_device+0x21b/0x280 [mpt3sas] [83428.295894] ? _scsih_expander_node_remove+0x108/0x140 [mpt3sas] [83428.295906] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.295910] mpt3sas_device_remove_by_sas_address.part.0+0x8f/0x110 [mpt3sas] [83428.295921] _scsih_expander_node_remove+0x129/0x140 [mpt3sas] [83428.295933] _scsih_expander_node_remove+0x6a/0x140 [mpt3sas] [83428.295944] scsih_remove+0x3f0/0x4a0 [mpt3sas] [83428.295957] pci_device_remove+0x3b/0xb0 [83428.295962] device_release_driver_internal+0x193/0x200 [83428.295968] driver_detach+0x44/0x90 [83428.295971] bus_remove_driver+0x69/0xf0 [83428.295975] pci_unregister_driver+0x2a/0xb0 [83428.295979] _mpt3sas_exit+0x1f/0x300 [mpt3sas] [83428.295991] __do_sys_delete_module.constprop.0+0x174/0x310 [83428.295997] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296000] ? __x64_sys_getdents64+0x9a/0x110 [83428.296005] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296009] ? syscall_trace_enter+0xf6/0x1b0 [83428.296014] do_syscall_64+0x7b/0x2c0 [83428.296019] ? srso_alias_return_thunk+0x5/0xfbef5 [83428.296023] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/scsi/mpt3sas/mpt3sas_transport.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c index 20d36061c217..5927a9ae62f2 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_transport.c +++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c @@ -828,11 +828,9 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, list_for_each_entry_safe(mpt3sas_phy, next_phy, &mpt3sas_port->phy_list, port_siblings) { if ((ioc->logging_level & MPT_DEBUG_TRANSPORT)) - dev_printk(KERN_INFO, &mpt3sas_port->port->dev, - "remove: sas_addr(0x%016llx), phy(%d)\n", - (unsigned long long) - mpt3sas_port->remote_identify.sas_address, - mpt3sas_phy->phy_id); + ioc_info(ioc, "remove: sas_addr(0x%016llx), phy(%d)\n", + (unsigned long long) mpt3sas_port->remote_identify.sas_address, + mpt3sas_phy->phy_id); mpt3sas_phy->phy_belongs_to_port = 0; if (!ioc->remove_host) sas_port_delete_phy(mpt3sas_port->port, -- 2.34.1

2 1

[PATCH OLK-6.6] sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC
by Zhang Xiaoxu 17 Nov '25

17 Nov '25

From: Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de> stable inclusion from stable-v6.6.112 commit 674ff598148a28bae0b5372339de56f2abf0b1d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B4C CVE: CVE-2025-40126 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4fba1713001195e59cfc001ff1f2837dab877efb ] The referenced commit introduced exception handlers on user-space memory references in copy_from_user and copy_to_user. These handlers return from the respective function and calculate the remaining bytes left to copy using the current register contents. This commit fixes a couple of bad calculations. This will fix the return value of copy_from_user and copy_to_user in the faulting case. The behaviour of memcpy stays unchanged. Fixes: cb736fdbb208 ("sparc64: Convert U1copy_{from,to}_user to accurate exception reporting.") Tested-by: John Paul Adrian Glaubitz <glaubitz(a)physik.fu-berlin.de> # on QEMU 10.0.3 Tested-by: René Rebe <rene(a)exactcode.com> # on Ultra 5 UltraSparc IIi Tested-by: Jonathan 'theJPster' Pallant <kernel(a)thejpster.org.uk> # on Sun Netra T1 Signed-off-by: Michael Karcher <kernel(a)mkarcher.dialup.fu-berlin.de> Reviewed-by: Andreas Larsson <andreas(a)gaisler.com> Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-1-1ca72dda195b@mkarcher… Signed-off-by: Andreas Larsson <andreas(a)gaisler.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- arch/sparc/lib/U1memcpy.S | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/arch/sparc/lib/U1memcpy.S b/arch/sparc/lib/U1memcpy.S index 635398ec7540..154fbd35400c 100644 --- a/arch/sparc/lib/U1memcpy.S +++ b/arch/sparc/lib/U1memcpy.S @@ -164,17 +164,18 @@ ENTRY(U1_gs_40_fp) retl add %o0, %o2, %o0 ENDPROC(U1_gs_40_fp) -ENTRY(U1_g3_0_fp) - VISExitHalf - retl - add %g3, %o2, %o0 -ENDPROC(U1_g3_0_fp) ENTRY(U1_g3_8_fp) VISExitHalf add %g3, 8, %g3 retl add %g3, %o2, %o0 ENDPROC(U1_g3_8_fp) +ENTRY(U1_g3_16_fp) + VISExitHalf + add %g3, 16, %g3 + retl + add %g3, %o2, %o0 +ENDPROC(U1_g3_16_fp) ENTRY(U1_o2_0_fp) VISExitHalf retl @@ -547,18 +548,18 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ 62: FINISH_VISCHUNK(o0, f44, f46) 63: UNEVEN_VISCHUNK_LAST(o0, f46, f0) -93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_0_fp) +93: EX_LD_FP(LOAD(ldd, %o1, %f2), U1_g3_8_fp) add %o1, 8, %o1 subcc %g3, 8, %g3 faligndata %f0, %f2, %f8 - EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) + EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) bl,pn %xcc, 95f add %o0, 8, %o0 - EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_0_fp) + EX_LD_FP(LOAD(ldd, %o1, %f0), U1_g3_8_fp) add %o1, 8, %o1 subcc %g3, 8, %g3 faligndata %f2, %f0, %f8 - EX_ST_FP(STORE(std, %f8, %o0), U1_g3_8_fp) + EX_ST_FP(STORE(std, %f8, %o0), U1_g3_16_fp) bge,pt %xcc, 93b add %o0, 8, %o0 -- 2.34.1

2 1

[PATCH OLK-6.6 v11 00/10] Add xcall 2.0 support
by Jinjie Ruan 17 Nov '25

17 Nov '25

Add xcall 2.0 support, which is compatible with xcall1.0, and can be used to dynamic instruction replacement for hardware xcall. Changes in v11: - Fix a bug in prefetch ko. - Fix a warning when concurrent write xcall comm. Changes in v10: - Fix memory leak in parse_xcall_command(). - Fix memory leak in xcall_comm_open(). - Add comment for smp_store_release(&mm->xcall, area). - Add sys_call_data in xcall_area struct. - clear_xcall_area() in __mmdrop() instead of __mmput(). - Add prefetch ko with some cleanup. Chanegs in v9: - /proc/xcall/comm, 0644 -> 0640 - /proc/xcall/comm check proc_mkdir("xcall", NULL) return value, use it as the parent proc_dir_entry for "comm". - Consider next task is NULL for xcall_info_switch(). - Return -EINVAL for error path in parse_xcall_command(). - Use bitmap for check_xcall_prog(). - Fix global-out-of-bounds KASAN bug in xcall_prog_register(). Changes in v8: - Fix no reigister and unregister null-ptr-ref bug by find prog first. - Fix xcall_comm_write write empty null-ptr-ref bug in memdup_user_nul(). - Add empty owner, exceed 64 prog name and repeat syscall check in check_prog(). - Move INIT_LIST_HEAD(&prog->list) to xcall_prog_register() instead of kernel module. Changes in v7: - Fix alternative bug in sync ventry. - Add "xcall" limit for xcall2.0 and hardware xcall. Changes in v6: - Add "xcall=debug" debug mode to use the "fast syscall" for every system call. - Use alternative to reduce the baseline performance noise floor when not set "xcall" on the kernel cmdline - Move binary_path out from xcall struct, and add to xcall_comm struct. - Fix1. insert_xcall_locked() check both "name" and "binary" to avoid repeated attach same name of xcall. - Fix2. Check if it is an executable file for the binary path. - Fix3. Check if it is an absolute path for the binary path. - Fix4. Remove the extra free_xcall_comm(info) in default branch in proc_xcall_command(). - Fix5. Add zero syscall hijack check for xcall_prog_register(). - Use __arm64_sys_ni_syscall() instead of define inv_xcall(). - Replace the -ENOSYS return value with -EINVAL, to avoid the warning. Changes in v5: - Fix build problem. - el0t_64_sync_ventry jump to kernel_ventry to do VMAP_STACK. - Some cleanups. - Merge the three refactor patch. Changes in v4: - Reuse uprobe_write_opcode() instead of use __replace_page() and copy_to_page(). - Handle error for uprobe_write_opcode(). - Support xcall1.0 before 920G. - Change xcall1.0 bitmap to byte array to save check insns. - Use percpu variable to save check insns for xcall1.0. - A little cleanup. Changes in v3: - Add validity checks during xcall registration to prevent out-of-bounds access and null pointer dereferences. - Extract __replace_page() and copy_to_page() from uprobe, to avoid code duplication. - Replace with new compatible refactored code. - Remove unnecessary member, such as old_name. Jinjie Ruan (2): xcall2.0: Support xcall1.0 for hardware xcall openeuler_defconfig: Enable CONFIG_DYNAMIC_XCALL by default Liao Chang (6): xcall2.0: Add userspace proc interface xcall2.0: Add xcall module register interface xcall2.0: Add xcall_area xcall2.0: Hajack syscall with dynamic instruciton replace xcall: Rework the early exception vector of XCALL and SYNC xcall2.0: Add a basic testcase Xinyu Zheng (1): xcall2.0: Introduce xcall epollwait prefetch feature Yipeng Zou (1): xcall: Add debug mode to force fast syscall for all threads arch/arm64/Kconfig.turbo | 13 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/exception.h | 4 +- arch/arm64/include/asm/mmu_context.h | 7 - arch/arm64/include/asm/xcall.h | 155 +++--- arch/arm64/kernel/cpufeature.c | 79 +-- arch/arm64/kernel/entry-common.c | 28 +- arch/arm64/kernel/entry.S | 86 +-- arch/arm64/kernel/probes/uprobes.c | 6 + arch/arm64/kernel/process.c | 5 + arch/arm64/kernel/syscall.c | 14 + arch/arm64/kernel/xcall/Makefile | 3 +- arch/arm64/kernel/xcall/core.c | 415 +++++++++++++++ arch/arm64/kernel/xcall/entry.S | 139 ++++- arch/arm64/kernel/xcall/proc.c | 238 +++++++++ arch/arm64/kernel/xcall/xcall.c | 68 +-- arch/arm64/kvm/sys_regs.c | 1 + drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/xcall/Kconfig | 19 + drivers/staging/xcall/Makefile | 1 + drivers/staging/xcall/dynamic_xcall_test.c | 89 ++++ drivers/staging/xcall/prefetch.c | 577 +++++++++++++++++++++ fs/proc/proc_xcall.c | 144 ++--- include/linux/mm_types.h | 4 + include/linux/xcall.h | 51 ++ kernel/events/uprobes.c | 23 + kernel/fork.c | 3 + mm/mmap.c | 14 +- 29 files changed, 1816 insertions(+), 374 deletions(-) create mode 100644 arch/arm64/kernel/xcall/core.c create mode 100644 arch/arm64/kernel/xcall/proc.c create mode 100644 drivers/staging/xcall/Kconfig create mode 100644 drivers/staging/xcall/Makefile create mode 100644 drivers/staging/xcall/dynamic_xcall_test.c create mode 100644 drivers/staging/xcall/prefetch.c create mode 100644 include/linux/xcall.h -- 2.34.1

2 11

[PATCH OLK-6.6 0/2] memcg: enable asynchronous reclaim for cgroup-v2
by Chen Ridong 17 Nov '25

17 Nov '25

memcg: enable asynchronous reclaim for cgroup-v2 Chen Ridong (2): memcg: change CONFIG_MEMCG_V1_RECLAIM to CONFIG_MEMCG_QOS memcg: enable asynchronous reclaim for cgroup-v2 arch/arm64/configs/openeuler_defconfig | 2 +- arch/riscv/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- include/linux/memcontrol.h | 4 ++-- init/Kconfig | 10 +++++++-- mm/memcontrol.c | 30 ++++++++++++++++---------- 6 files changed, 32 insertions(+), 18 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-6.6 3212/3212] drivers/pinctrl/zhaoxin/pinctrl-kx7000.c:307:23: warning: overlapping comparisons always evaluate to true
by kernel test robot 17 Nov '25

17 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 1814a55bda7a73d33ecfdcf11802a1bc667c2e3e commit: 5d01c9ec4f3b95b0629a38d936f69bc05e494cc9 [3212/3212] pinctrl: Zhaoxin: Add KH-50000 support config: x86_64-randconfig-r073-20251117 (https://download.01.org/0day-ci/archive/20251117/202511171908.GkIEY88E-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251117/202511171908.GkIEY88E-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511171908.GkIEY88E-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/pinctrl/zhaoxin/pinctrl-kx7000.c:307:23: warning: overlapping comparisons always evaluate to true [-Wtautological-overlap-compare] 307 | else if (pin >= 0x62 || pin <= 0x70) | ~~~~~~~~~~~~^~~~~~~~~~~~~~ drivers/pinctrl/zhaoxin/pinctrl-kx7000.c:305:23: warning: overlapping comparisons always evaluate to true [-Wtautological-overlap-compare] 305 | else if (pin >= 0x57 || pin <= 0x5F) | ~~~~~~~~~~~~^~~~~~~~~~~~~~ 2 warnings generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +307 drivers/pinctrl/zhaoxin/pinctrl-kx7000.c 288 289 static enum zx_gpio_type kx7000_gpio_type(struct zhaoxin_pinctrl *pctrl, unsigned int pin) 290 { 291 if (pin >= 0xE && pin <= 0x13) 292 return ZX_TYPE_PGPIO; 293 else if (pin >= 0x16 && pin <= 0x28) 294 return ZX_TYPE_PGPIO; 295 else if (pin >= 0x29 && pin <= 0x32) 296 return ZX_TYPE_GPIO; 297 else if (pin == 0x35 || pin == 0x3B) 298 return ZX_TYPE_PGPIO; 299 else if (pin >= 0x42 && pin <= 0x47) 300 return ZX_TYPE_PGPIO; 301 else if (pin == 0x4E || pin == 0x50) 302 return ZX_TYPE_PGPIO; 303 else if (pin == 0x52 || pin == 0x55) 304 return ZX_TYPE_PGPIO; 305 else if (pin >= 0x57 || pin <= 0x5F) 306 return ZX_TYPE_PGPIO; > 307 else if (pin >= 0x62 || pin <= 0x70) 308 return ZX_TYPE_PGPIO; 309 else 310 return ZX_TYPE_ERROR; 311 } 312 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
by Zhang Kunbo 17 Nov '25

17 Nov '25

From: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> stable inclusion from stable-v6.6.113 commit ed30811fbed40751deb952bde534aa2632dc0bf7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BWA CVE: CVE-2025-40207 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream. v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would cause v4l2_subdev_call_state_try() to crash. Add proper error handling to v4l2_subdev_call_state_try(). Signed-off-by: Tomi Valkeinen <tomi.valkeinen(a)ideasonboard.com> Fixes: 982c0487185b ("media: subdev: Add v4l2_subdev_call_state_try() macro") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/all/aJTNtpDUbTz7eyJc%40stanley.mountain/ Cc: stable(a)vger.kernel.org Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Sakari Ailus <sakari.ailus(a)linux.intel.com> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- include/media/v4l2-subdev.h | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h index b4fcd0164048..c2c6dcced8bc 100644 --- a/include/media/v4l2-subdev.h +++ b/include/media/v4l2-subdev.h @@ -1879,19 +1879,23 @@ extern const struct v4l2_subdev_ops v4l2_subdev_call_wrappers; * * Note: only legacy non-MC drivers may need this macro. */ -#define v4l2_subdev_call_state_try(sd, o, f, args...) \ - ({ \ - int __result; \ - static struct lock_class_key __key; \ - const char *name = KBUILD_BASENAME \ - ":" __stringify(__LINE__) ":state->lock"; \ - struct v4l2_subdev_state *state = \ - __v4l2_subdev_state_alloc(sd, name, &__key); \ - v4l2_subdev_lock_state(state); \ - __result = v4l2_subdev_call(sd, o, f, state, ##args); \ - v4l2_subdev_unlock_state(state); \ - __v4l2_subdev_state_free(state); \ - __result; \ +#define v4l2_subdev_call_state_try(sd, o, f, args...) \ + ({ \ + int __result; \ + static struct lock_class_key __key; \ + const char *name = KBUILD_BASENAME \ + ":" __stringify(__LINE__) ":state->lock"; \ + struct v4l2_subdev_state *state = \ + __v4l2_subdev_state_alloc(sd, name, &__key); \ + if (IS_ERR(state)) { \ + __result = PTR_ERR(state); \ + } else { \ + v4l2_subdev_lock_state(state); \ + __result = v4l2_subdev_call(sd, o, f, state, ##args); \ + v4l2_subdev_unlock_state(state); \ + __v4l2_subdev_state_free(state); \ + } \ + __result; \ }) /** -- 2.34.1

2 1