- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] vfio/platform: check the bounds of read/write syscalls
by Tong Tiangen 21 Mar '25

21 Mar '25

From: Alex Williamson <alex.williamson(a)redhat.com> stable inclusion from stable-v5.10.234 commit d19a8650fd3d7aed8d1af1d9a77f979a8430eba1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLDIK CVE: CVE-2025-21687 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream. count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device. Fixes: 6e3f26456009 (“vfio/platform: read and write support for the device fd”) Cc: stable(a)vger.kernel.org Reported-by: Mostafa Saleh <smostafa(a)google.com> Reviewed-by: Eric Auger <eric.auger(a)redhat.com> Reviewed-by: Mostafa Saleh <smostafa(a)google.com> Tested-by: Mostafa Saleh <smostafa(a)google.com> Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/vfio/platform/vfio_platform_common.c [context conflict] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- drivers/vfio/platform/vfio_platform_common.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c index bf06825d977e..f719185f83c0 100644 --- a/drivers/vfio/platform/vfio_platform_common.c +++ b/drivers/vfio/platform/vfio_platform_common.c @@ -413,6 +413,11 @@ static ssize_t vfio_platform_read_mmio(struct vfio_platform_region *reg, { unsigned int done = 0; + if (off >= reg->size) + return -EINVAL; + + count = min_t(size_t, count, reg->size - off); + if (!reg->ioaddr) { reg->ioaddr = ioremap_nocache(reg->addr, reg->size); @@ -490,6 +495,11 @@ static ssize_t vfio_platform_write_mmio(struct vfio_platform_region *reg, { unsigned int done = 0; + if (off >= reg->size) + return -EINVAL; + + count = min_t(size_t, count, reg->size - off); + if (!reg->ioaddr) { reg->ioaddr = ioremap_nocache(reg->addr, reg->size); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
by Jinjiang Tu 21 Mar '25

21 Mar '25

mainline inclusion from mainline-v6.14-rc6 commit cb402bbdabcaa5a765068c5b8673bbfc1c264242 category: bugfix bugzilla: 190517 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------- In dissolve_free_huge_page(), free huge pages are dissolved without adjusting surplus count. However, free huge pages may be accounted as surplus pages, and will lead to wrong surplus count. I reproduce this issue on qemu. The steps are: 1) Node1 is memory-less at first. Hot-add memory to node1 by executing the two commands in qemu monitor: object_add memory-backend-ram,id=mem1,size=1G device_add pc-dimm,id=dimm1,memdev=mem1,node=1 2) online one memory block of Node1 with： echo online_movable > /sys/devices/system/node/node1/memoryX/state 3) create 64 huge pages for node1 4) run a program to reserve (don't consume) all the huge pages 5) echo 0 > nr_huge_pages for node1. After this step, free huge pages in Node1 are surplus. 6) create 80 huge pages for node0 7) offline memory of node1, The memory range to offline contains the free surplus huge pages created in step3) ~ step5) echo offline > /sys/devices/system/node/node1/memoryX/state 8) kill the program in step 4) The result: Node0 Node1 total 80 0 free 80 0 surplus 0 61 To fix it, adjust surplus when destroying huge pages if the node has surplus pages in dissolve_free_hugetlb_folio(). The result with this patch: Node0 Node1 total 80 0 free 80 0 surplus 0 0 Link: https://lkml.kernel.org/r/20250304132106.2872754-1-tujinjiang@huawei.com Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Cc: Jinjiang Tu <tujinjiang(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts, and HVO isn't introduced, so don't need to handle HVO err case.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 69dd1e096a48..ac6f18afdf76 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -1823,6 +1823,7 @@ int dissolve_free_huge_page(struct page *page) if (!page_count(page)) { struct page *head = compound_head(page); struct hstate *h = page_hstate(head); + bool adjust_surplus = false; if (h->free_huge_pages - h->resv_huge_pages == 0) goto out; @@ -1853,7 +1854,9 @@ int dissolve_free_huge_page(struct page *page) SetPageHWPoison(page); ClearPageHWPoison(head); } - remove_hugetlb_page(h, head, false); + if (h->surplus_huge_pages_node[page_to_nid(head)]) + adjust_surplus = true; + remove_hugetlb_page(h, head, adjust_surplus); h->max_huge_pages--; spin_unlock_irq(&hugetlb_lock); update_and_free_page(h, head); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix race when disable/enable UIE in rtc_set_time()
by Xiongfeng Wang 21 Mar '25

21 Mar '25

Yu Liao (2): rtc: Cleanup for UIE timer/polling emulation support rtc: Fix race when disable/enable UIE in rtc_set_time() drivers/rtc/interface.c | 58 +++++++++++++++++++++++------------------ include/linux/rtc.h | 1 + 2 files changed, 33 insertions(+), 26 deletions(-) -- 2.20.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-21853
by Pu Lehui 21 Mar '25

21 Mar '25

Andrii Nakryiko (2): bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic bpf: avoid holding freeze_mutex during mmap operation kernel/bpf/ringbuf.c | 4 ---- kernel/bpf/syscall.c | 25 +++++++++++++++++-------- 2 files changed, 17 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] io_uring/kbuf: reallocate buf lists on upgrade
by Long Li 21 Mar '25

21 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> stable inclusion from stable-v6.6.78 commit 146a185f6c05ee263db715f860620606303c4633 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRNOR CVE: CVE-2025-21836 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8802766324e1f5d414a81ac43365c20142e85603 upstream. IORING_REGISTER_PBUF_RING can reuse an old struct io_buffer_list if it was created for legacy selected buffer and has been emptied. It violates the requirement that most of the field should stay stable after publish. Always reallocate it instead. Cc: stable(a)vger.kernel.org Reported-by: Pumpkin Chang <pumpkin(a)devco.re> Fixes: 2fcabce2d7d34 ("io_uring: disallow mixed provided buffer group registrations") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/kbuf.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 702c08c26cd4..b6fbae874f27 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -301,6 +301,12 @@ void io_destroy_buffers(struct io_ring_ctx *ctx) } } +static void io_destroy_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl) +{ + xa_erase(&ctx->io_bl_xa, bl->bgid); + io_put_bl(ctx, bl); +} + int io_remove_buffers_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_provide_buf *p = io_kiocb_to_cmd(req, struct io_provide_buf); @@ -642,12 +648,13 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) /* if mapped buffer ring OR classic exists, don't allow */ if (bl->is_mapped || !list_empty(&bl->buf_list)) return -EEXIST; - } else { - free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); - if (!bl) - return -ENOMEM; + io_destroy_bl(ctx, bl); } + free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL); + if (!bl) + return -ENOMEM; + if (!(reg.flags & IOU_PBUF_RING_MMAP)) ret = io_pin_pbuf_ring(&reg, bl); else -- 2.39.2

2 1

[PATCH OLK-5.10] io_uring: prevent opcode speculation
by Long Li 21 Mar '25

21 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 1e988c3fe1264708f4f92109203ac5b1d65de50b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU CVE: CVE-2025-21863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable(a)vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.17395684… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/io_uring.c [Context conflict] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 17a4e37a177f..883e2b74f82e 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -7196,6 +7196,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, if (!io_check_restriction(ctx, req, sqe_flags)) return -EACCES; + req->opcode = array_index_nospec(req->opcode, IORING_OP_LAST); + if ((sqe_flags & IOSQE_BUFFER_SELECT) && !io_op_defs[req->opcode].buffer_select) return -EOPNOTSUPP; -- 2.39.2

2 1

[openeuler:OLK-5.10 2816/2816] drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1
by kernel test robot 21 Mar '25

21 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 762816c3c07e052877c68911685e3700fe073298 commit: a0c5bfdbc099daf30cbadb9657803f0cb3f89d0b [2816/2816] drivers: support for rnpm drivers from Mucse Technology N10/N400 config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20250321/202503210356.tFg9vkJQ-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250321/202503210356.tFg9vkJQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503210356.tFg9vkJQ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/mucse/rnpm/rnpm_common.c:12: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ 2 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:20: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:7: warning: variable 'autoneg_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:1232:32: warning: variable 'duplex_changed' set but not used [-Wunused-but-set-variable] 1232 | bool autoneg_changed = false, duplex_changed = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_ethtool.c:2029:6: warning: variable 'dma_ch' set but not used [-Wunused-but-set-variable] 2029 | u32 dma_ch; | ^ 5 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_main.c:32: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:6: warning: no previous prototype for function 'rnpm_pf_service_event_schedule' [-Wmissing-prototypes] 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:245:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 245 | void rnpm_pf_service_event_schedule(struct rnpm_pf_adapter *pf_adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:5: warning: no previous prototype for function 'rnpm_rx_ring_reinit' [-Wmissing-prototypes] 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1768:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1768 | int rnpm_rx_ring_reinit(struct rnpm_adapter *adapter, struct rnpm_ring *rx_ring) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:1957:7: warning: variable 'xdp_xmit' set but not used [-Wunused-but-set-variable] 1957 | bool xdp_xmit = false; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:6: warning: no previous prototype for function 'rnpm_write_eitr' [-Wmissing-prototypes] 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2142:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2142 | void rnpm_write_eitr(struct rnpm_q_vector *q_vector, bool is_rxframe) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:6: warning: variable 'packets' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2387:7: note: uninitialized use occurs here 2387 | if (!packets) | ^~~~~~~ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2381:2: note: remove the 'if' if its condition is always true 2381 | if (!ring_container->ring) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ 2382 | 2383 | packets = ring_container->total_packets; drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2374:37: note: initialize the variable 'packets' to silence this warning 2374 | unsigned int avg_wire_size, packets, bytes; | ^ | = 0 drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring' [-Wmissing-prototypes] 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2969:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2969 | int rnpm_xmit_nop_frame_ring(struct rnpm_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:5: warning: no previous prototype for function 'rnpm_xmit_nop_frame_ring_temp' [-Wmissing-prototypes] 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:2985:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2985 | int rnpm_xmit_nop_frame_ring_temp(struct rnpm_adapter *adapter, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:6: warning: no previous prototype for function 'rnpm_vlan_stags_flag' [-Wmissing-prototypes] 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3851:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3851 | void rnpm_vlan_stags_flag(struct rnpm_adapter *adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:6: warning: no previous prototype for function 'control_mac_rx' [-Wmissing-prototypes] 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:3972:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 3972 | void control_mac_rx(struct rnpm_adapter *adapter, bool on) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:6: warning: no previous prototype for function 'rnpm_pf_service_timer' [-Wmissing-prototypes] 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5689:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5689 | void rnpm_pf_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:6: warning: no previous prototype for function 'rnpm_service_timer' [-Wmissing-prototypes] 5707 | void rnpm_service_timer(struct timer_list *t) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5707:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 5707 | void rnpm_service_timer(struct timer_list *t) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:21: warning: no previous prototype for function 'wait_all_port_resetting' [-Wmissing-prototypes] 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5853:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5853 | __maybe_unused void wait_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:21: warning: no previous prototype for function 'clean_all_port_resetting' [-Wmissing-prototypes] 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_main.c:5865:16: note: declare 'static' if the function is not intended to be used outside of this translation unit 5865 | __maybe_unused void clean_all_port_resetting(struct rnpm_pf_adapter *pf_adapter) | ^ | static -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:11: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:5: warning: no previous prototype for function 'rnpm_reset_pipeline_n10' [-Wmissing-prototypes] 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:448:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 448 | s32 rnpm_reset_pipeline_n10(struct rnpm_hw *hw) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_n10.c:503:6: warning: variable 'status' set but not used [-Wunused-but-set-variable] 503 | s32 status = 0; | ^ 4 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:10: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:24: warning: no previous prototype for function 'mbx_cookie_zalloc' [-Wmissing-prototypes] 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:14:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 14 | struct mbx_req_cookie *mbx_cookie_zalloc(int priv_len) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:5: warning: no previous prototype for function 'rnpm_mbx_write_posted_locked' [-Wmissing-prototypes] 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:28:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 28 | int rnpm_mbx_write_posted_locked(struct rnpm_hw *hw, struct mbx_fw_cmd_req *req) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:6: warning: no previous prototype for function 'rnpm_link_stat_mark_disable' [-Wmissing-prototypes] 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:81:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 81 | void rnpm_link_stat_mark_disable(struct rnpm_hw *hw) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:5: warning: no previous prototype for function 'rnpm_mbx_fw_post_req' [-Wmissing-prototypes] 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:86:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 86 | int rnpm_mbx_fw_post_req(struct rnpm_hw *hw, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:5: warning: no previous prototype for function 'rnpm_fw_send_cmd_wait' [-Wmissing-prototypes] 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:153:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 153 | int rnpm_fw_send_cmd_wait(struct rnpm_hw *hw, | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:5: warning: no previous prototype for function 'rnpm_mbx_lldp_all_ports_enable' [-Wmissing-prototypes] 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:633:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 633 | int rnpm_mbx_lldp_all_ports_enable(struct rnpm_hw *hw, bool enable) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:5: warning: no previous prototype for function 'rnpm_mbx_pluginout_evt_en' [-Wmissing-prototypes] 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:936:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 936 | int rnpm_mbx_pluginout_evt_en(struct rnpm_hw *hw, int in_dir, int enable) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:5: warning: no previous prototype for function 'rnpm_fw_get_capablity' [-Wmissing-prototypes] 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:963:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 963 | int rnpm_fw_get_capablity(struct rnpm_hw *hw, struct phy_abilities *abil) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1153:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] 1153 | int err; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1188:6: warning: variable 'value' set but not used [-Wunused-but-set-variable] 1188 | int value; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:5: warning: no previous prototype for function 'rnpm_fw_reg_read' [-Wmissing-prototypes] 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1184:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1184 | int rnpm_fw_reg_read(struct rnpm_hw *hw, int addr, int sz) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1255:18: warning: variable 'hw' set but not used [-Wunused-but-set-variable] 1255 | struct rnpm_hw *hw; | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:5: warning: no previous prototype for function 'rnpm_get_port_stats2' [-Wmissing-prototypes] 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1476:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1476 | int rnpm_get_port_stats2(struct rnpm_hw *hw, int *pabs, int *pspeed, int *plink) | ^ | static drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1528:9: warning: variable 'err' is uninitialized when used here [-Wuninitialized] 1528 | return err ? -err : 0; | ^~~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.c:1509:9: note: initialize the variable 'err' to silence this warning 1509 | int err; | ^ | = 0 16 warnings generated. -- In file included from drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:17: >> drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1137:45: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1137 | req->loopback.loopback_force_speed_enable = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h:1162:37: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion] 1162 | req->set_phy_reg.recall_qsfp_page = 1; | ^ ~ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:5: warning: no previous prototype for function 'rnpm_mbx_get_pn_sn' [-Wmissing-prototypes] 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ drivers/net/ethernet/mucse/rnpm/rnpm_sysfs.c:263:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 263 | int rnpm_mbx_get_pn_sn(struct rnpm_hw *hw, char pn[33], char sn[33]) | ^ | static 3 warnings generated. vim +/int +1137 drivers/net/ethernet/mucse/rnpm/rnpm_mbx_fw.h 1119 1120 static inline void 1121 build_link_set_loopback_req(struct mbx_fw_cmd_req *req, 1122 void *cookie, 1123 enum LOOPBACK_LEVEL level, 1124 enum LOOPBACK_FORCE_SPEED force_speed) 1125 { 1126 req->flags = 0; 1127 req->opcode = SET_LOOPBACK_MODE; 1128 req->datalen = sizeof(req->loopback); 1129 req->cookie = cookie; 1130 req->reply_lo = 0; 1131 req->reply_hi = 0; 1132 1133 req->loopback.loopback_level = level; 1134 req->loopback.loopback_type = LOOPBACK_TYPE_LOCAL; 1135 if (force_speed != LOOPBACK_FORCE_SPEED_NONE) { 1136 req->loopback.loopback_force_speed = force_speed; > 1137 req->loopback.loopback_force_speed_enable = 1; 1138 } 1139 } 1140 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] arm64: entry: Support hardware xint and xcall
by Jinjie Ruan 20 Mar '25

20 Mar '25

Support hardware xint and xcall. Jinjie Ruan (2): arm64: entry: Support hardware xint arm64: entry: Support hardware xcall arch/Kconfig | 14 ++--- arch/arm64/Kconfig | 12 ++++ arch/arm64/include/asm/sysreg.h | 7 +++ arch/arm64/kernel/cpufeature.c | 100 +++++++++++++++++++++++++++++++ arch/arm64/kernel/entry-common.c | 75 ++++++++++++++++++++--- arch/arm64/kernel/entry.S | 74 +++++++++++++++++++++-- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 36 ++++++++++- 8 files changed, 298 insertions(+), 24 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] io_uring: prevent opcode speculation
by Long Li 20 Mar '25

20 Mar '25

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v6.10-rc2 commit 1e988c3fe1264708f4f92109203ac5b1d65de50b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSVZU CVE: CVE-2025-21863 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sqe->opcode is used for different tables, make sure we santitise it against speculations. Cc: stable(a)vger.kernel.org Fixes: d3656344fea03 ("io_uring: add lookup table for various opcode needs") Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Reviewed-by: Li Zetao <lizetao1(a)huawei.com> Link: https://lore.kernel.org/r/7eddbf31c8ca0a3947f8ed98271acc2b4349c016.17395684… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- io_uring/io_uring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 833fd9b6a1f3..3aaac1023efb 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -2173,6 +2173,8 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req, req->opcode = 0; return io_init_fail_req(req, -EINVAL); } + opcode = array_index_nospec(opcode, IORING_OP_LAST); + def = &io_issue_defs[opcode]; if (unlikely(sqe_flags & ~SQE_COMMON_FLAGS)) { /* enforce forwards compatibility on users */ -- 2.39.2

2 1

[openeuler:OLK-5.10 2816/2816] kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_rude()+0xe0: unreachable instruction
by kernel test robot 20 Mar '25

20 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 762816c3c07e052877c68911685e3700fe073298 commit: 2509f2079e7247ed0d695bdb69c3d019a700a4b8 [2816/2816] rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug config: x86_64-buildonly-randconfig-003-20250320 (https://download.01.org/0day-ci/archive/20250320/202503202016.ACG7odcD-lkp@…) compiler: clang version 20.1.1 (https://github.com/llvm/llvm-project 424c2d9b7e4de40d0804dd374721e6411c27d1d1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250320/202503202016.ACG7odcD-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503202016.ACG7odcD-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/rcu/update.o: warning: objtool: synchronize_rcu_tasks_rude()+0xe0: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0