- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1739/1739] kernel/cgroup/cgroup.c:5286:48: sparse: sparse: incorrect type in argument 1 (different address spaces)
by kernel test robot 30 Oct '25

30 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1afc352b4572c02bd3b5c9195481f393af060e44 commit: 0bc0d0d57edacd59ebe38d05ad9c4b2bc185aa51 [1739/1739] dhugetlb: backport dynamic hugetlb feature config: arm64-randconfig-r121-20250728 (https://download.01.org/0day-ci/archive/20251030/202510300549.PPuMkgHB-lkp@…) compiler: aarch64-linux-gcc (GCC) 8.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510300549.PPuMkgHB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510300549.PPuMkgHB-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/cgroup/cgroup.c:5286:48: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] <asn:4> * @@ kernel/cgroup/cgroup.c:5286:48: sparse: expected struct cgroup_subsys_state *css kernel/cgroup/cgroup.c:5286:48: sparse: got struct cgroup_subsys_state [noderef] <asn:4> * kernel/cgroup/cgroup.c:2685:20: sparse: sparse: context imbalance in 'cgroup_procs_write_start' - wrong count at exit kernel/cgroup/cgroup.c:2741:9: sparse: sparse: context imbalance in 'cgroup_procs_write_finish' - wrong count at exit kernel/cgroup/cgroup.c:2874:9: sparse: sparse: context imbalance in 'cgroup_lock_and_drain_offline' - wrong count at exit kernel/cgroup/cgroup.c:4528:16: sparse: sparse: context imbalance in 'cgroup_procs_write' - wrong count at exit kernel/cgroup/cgroup.c:4580:16: sparse: sparse: context imbalance in 'cgroup_threads_write' - wrong count at exit vim +5286 kernel/cgroup/cgroup.c 5234 5235 /** 5236 * cgroup_destroy_locked - the first stage of cgroup destruction 5237 * @cgrp: cgroup to be destroyed 5238 * 5239 * css's make use of percpu refcnts whose killing latency shouldn't be 5240 * exposed to userland and are RCU protected. Also, cgroup core needs to 5241 * guarantee that css_tryget_online() won't succeed by the time 5242 * ->css_offline() is invoked. To satisfy all the requirements, 5243 * destruction is implemented in the following two steps. 5244 * 5245 * s1. Verify @cgrp can be destroyed and mark it dying. Remove all 5246 * userland visible parts and start killing the percpu refcnts of 5247 * css's. Set up so that the next stage will be kicked off once all 5248 * the percpu refcnts are confirmed to be killed. 5249 * 5250 * s2. Invoke ->css_offline(), mark the cgroup dead and proceed with the 5251 * rest of destruction. Once all cgroup references are gone, the 5252 * cgroup is RCU-freed. 5253 * 5254 * This function implements s1. After this step, @cgrp is gone as far as 5255 * the userland is concerned and a new cgroup with the same name may be 5256 * created. As cgroup doesn't care about the names internally, this 5257 * doesn't cause any problem. 5258 */ 5259 static int cgroup_destroy_locked(struct cgroup *cgrp) 5260 __releases(&cgroup_mutex) __acquires(&cgroup_mutex) 5261 { 5262 struct cgroup *tcgrp, *parent = cgroup_parent(cgrp); 5263 struct cgroup_subsys_state *css; 5264 struct cgrp_cset_link *link; 5265 int ssid; 5266 5267 lockdep_assert_held(&cgroup_mutex); 5268 5269 /* 5270 * Only migration can raise populated from zero and we're already 5271 * holding cgroup_mutex. 5272 */ 5273 if (cgroup_is_populated(cgrp)) 5274 return -EBUSY; 5275 5276 /* 5277 * Make sure there's no live children. We can't test emptiness of 5278 * ->self.children as dead children linger on it while being 5279 * drained; otherwise, "rmdir parent/child parent" may fail. 5280 */ 5281 if (css_has_online_children(&cgrp->self)) 5282 return -EBUSY; 5283 5284 #ifdef CONFIG_MEMCG 5285 /* If we use dynamic hugetlb, make sure dhugtlb_pool is free */ > 5286 if (!dhugetlb_pool_is_free(cgrp->subsys[memory_cgrp_id])) 5287 return -EBUSY; 5288 #endif 5289 /* 5290 * Mark @cgrp and the associated csets dead. The former prevents 5291 * further task migration and child creation by disabling 5292 * cgroup_lock_live_group(). The latter makes the csets ignored by 5293 * the migration path. 5294 */ 5295 cgrp->self.flags &= ~CSS_ONLINE; 5296 5297 spin_lock_irq(&css_set_lock); 5298 list_for_each_entry(link, &cgrp->cset_links, cset_link) 5299 link->cset->dead = true; 5300 spin_unlock_irq(&css_set_lock); 5301 5302 /* initiate massacre of all css's */ 5303 for_each_css(css, ssid, cgrp) 5304 kill_css(css); 5305 5306 /* clear and remove @cgrp dir, @cgrp has an extra ref on its kn */ 5307 css_clear_dir(&cgrp->self); 5308 kernfs_remove(cgrp->kn); 5309 5310 if (parent && cgroup_is_threaded(cgrp)) 5311 parent->nr_threaded_children--; 5312 5313 spin_lock_irq(&css_set_lock); 5314 for (tcgrp = cgroup_parent(cgrp); tcgrp; tcgrp = cgroup_parent(tcgrp)) { 5315 tcgrp->nr_descendants--; 5316 tcgrp->nr_dying_descendants++; 5317 } 5318 spin_unlock_irq(&css_set_lock); 5319 5320 cgroup1_check_for_release(parent); 5321 5322 /* put the base reference */ 5323 percpu_ref_kill(&cgrp->self.refcnt); 5324 5325 return 0; 5326 }; 5327 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3257/3257] kernel/sched/fair.c:9944:50: error: invalid use of undefined type 'struct task_group'
by kernel test robot 30 Oct '25

30 Oct '25

Hi Cheng, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5860abf4ca1c1e5ced0d4787886db4195a9c54ea commit: 433c0b72564239cf3086f563d5ca32a10e4ffd3f [3257/3257] sched/fair: Count the number of tasks marked as steal_task on cfs_rq config: x86_64-randconfig-015-20251029 (https://download.01.org/0day-ci/archive/20251030/202510300412.XOY1Sf5f-lkp@…) compiler: gcc-13 (Debian 13.3.0-16) 13.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510300412.XOY1Sf5f-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510300412.XOY1Sf5f-lkp@intel.com/ All errors (new ones prefixed by >>): kernel/sched/fair.c: In function 'group_steal_enabled': kernel/sched/fair.c:4483:38: error: implicit declaration of function 'is_tg_steal' [-Werror=implicit-function-declaration] 4483 | return group_steal_used() && is_tg_steal(steal_task); | ^~~~~~~~~~~ kernel/sched/fair.c: In function 'overload_clear': kernel/sched/fair.c:4489:23: warning: variable 'time' set but not used [-Wunused-but-set-variable] 4489 | unsigned long time; | ^~~~ kernel/sched/fair.c: In function 'overload_set': kernel/sched/fair.c:4517:23: warning: variable 'time' set but not used [-Wunused-but-set-variable] 4517 | unsigned long time; | ^~~~ kernel/sched/fair.c: At top level: kernel/sched/fair.c:6013:6: warning: no previous prototype for 'init_cfs_bandwidth' [-Wmissing-prototypes] 6013 | void init_cfs_bandwidth(struct cfs_bandwidth *cfs_b) {} | ^~~~~~~~~~~~~~~~~~ kernel/sched/fair.c: In function 'select_task_rq_fair': kernel/sched/fair.c:8191:23: warning: variable 'time' set but not used [-Wunused-but-set-variable] 8191 | unsigned long time; | ^~~~ kernel/sched/fair.c: In function 'pick_next_task_fair': kernel/sched/fair.c:9185:23: warning: variable 'time' set but not used [-Wunused-but-set-variable] 9185 | unsigned long time; | ^~~~ kernel/sched/fair.c: In function 'can_migrate_task_llc': >> kernel/sched/fair.c:9944:50: error: invalid use of undefined type 'struct task_group' 9944 | if (group_steal_used() && !is_tg_steal(tg->steal_task)) | ^~ kernel/sched/fair.c: At top level: kernel/sched/fair.c:13961:6: warning: no previous prototype for 'free_fair_sched_group' [-Wmissing-prototypes] 13961 | void free_fair_sched_group(struct task_group *tg) { } | ^~~~~~~~~~~~~~~~~~~~~ kernel/sched/fair.c:13963:5: warning: no previous prototype for 'alloc_fair_sched_group' [-Wmissing-prototypes] 13963 | int alloc_fair_sched_group(struct task_group *tg, struct task_group *parent) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/sched/fair.c:13968:6: warning: no previous prototype for 'online_fair_sched_group' [-Wmissing-prototypes] 13968 | void online_fair_sched_group(struct task_group *tg) { } | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/fair.c:13970:6: warning: no previous prototype for 'unregister_fair_sched_group' [-Wmissing-prototypes] 13970 | void unregister_fair_sched_group(struct task_group *tg) { } | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +9944 kernel/sched/fair.c 9929 9930 #ifdef CONFIG_SCHED_STEAL 9931 /* 9932 * Return true if task @p can migrate from @rq to @dst_rq in the same LLC. 9933 * No need to test for co-locality, and no need to test task_hot(), as sharing 9934 * LLC provides cache warmth at that level. 9935 */ 9936 static bool 9937 can_migrate_task_llc(struct task_struct *p, struct rq *rq, struct rq *dst_rq) 9938 { 9939 int dst_cpu = dst_rq->cpu; 9940 struct task_group *tg = task_group(p); 9941 9942 lockdep_assert_rq_held(rq); 9943 > 9944 if (group_steal_used() && !is_tg_steal(tg->steal_task)) 9945 return false; 9946 9947 if (throttled_lb_pair(tg, cpu_of(rq), dst_cpu)) 9948 return false; 9949 9950 if (!cpumask_test_cpu(dst_cpu, p->cpus_ptr)) { 9951 schedstat_inc(p->se.statistics.nr_failed_migrations_affine); 9952 return false; 9953 } 9954 9955 if (task_running(rq, p)) { 9956 schedstat_inc(p->se.statistics.nr_failed_migrations_running); 9957 return false; 9958 } 9959 9960 return true; 9961 } 9962 #endif 9963 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1739/1739] mm/page_alloc.c:4648:27: sparse: sparse: invalid assignment: &=
by kernel test robot 30 Oct '25

30 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 1afc352b4572c02bd3b5c9195481f393af060e44 commit: 875ffd41499ee5a3512da409cbd4c2ffd32b3cfa [1739/1739] mm: Do limit checking after memory allocation for memory reliable config: arm64-randconfig-r121-20250728 (https://download.01.org/0day-ci/archive/20251030/202510300315.AULNBBrr-lkp@…) compiler: aarch64-linux-gcc (GCC) 8.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510300315.AULNBBrr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510300315.AULNBBrr-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c:141:1: sparse: sparse: symbol '__pcpu_scope_pcpu_drain' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer >> mm/page_alloc.c:4648:27: sparse: sparse: invalid assignment: &= mm/page_alloc.c:4648:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4648:27: sparse: right side has type int In file included from mm/page_alloc.c:70: mm/page_alloc.c: In function 'deferred_init_memmap': include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] .kc_thread_func = (ktask_thread_func)(thread_func), 15- ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 18- ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1730:3: note: in expansion of macro 'DEFINE_KTASK_CTL' DEFINE_KTASK_CTL(ctl, deferred_init_chunk, &args, ^~~~~~~~~~~~~~~~ include/linux/ktask.h:123:21: warning: cast between incompatible function types from 'int (*)(long unsigned int, long unsigned int, struct deferred_args *)' to 'int (*)(void *, void *, void *)' [-Wcast-function-type] .kc_thread_func = (ktask_thread_func)(thread_func), 24- ^ include/linux/ktask.h:139:3: note: in expansion of macro 'KTASK_CTL_INITIALIZER' KTASK_CTL_INITIALIZER(thread_func, func_arg, min_chunk_size) 27- ^~~~~~~~~~~~~~~~~~~~~ mm/page_alloc.c:1746:3: note: in expansion of macro 'DEFINE_KTASK_CTL' DEFINE_KTASK_CTL(ctl, deferred_free_chunk, &args, ^~~~~~~~~~~~~~~~ mm/page_alloc.c:3083: warning: Function parameter or member 'mt' not described in '__putback_isolated_page' vim +4648 mm/page_alloc.c 4606 4607 /* 4608 * return true means memory allocation need retry and flag ___GFP_RELIABILITY 4609 * must be cleared. 4610 */ 4611 static inline bool check_after_alloc(gfp_t *gfp_mask, unsigned int order, 4612 int preferred_nid, nodemask_t *nodemask, 4613 struct page **_page) 4614 { 4615 if (!mem_reliable_is_enabled()) 4616 return false; 4617 4618 if (!(*gfp_mask & ___GFP_RELIABILITY)) 4619 return false; 4620 4621 if (!*_page) 4622 goto out_retry; 4623 4624 if (*gfp_mask & __GFP_NOFAIL) 4625 goto out; 4626 4627 /* check water mark, reserver mirrored mem for kernel */ 4628 if (!mem_reliable_watermark_ok(1 << order)) 4629 goto out_free_page; 4630 4631 /* percpu counter is not initialized, ignore limit check */ 4632 if (!mem_reliable_counter_initialized()) 4633 goto out; 4634 4635 /* spcial user task, systemd is limited by task_reliable_limit */ 4636 if (((current->flags & PF_RELIABLE) || is_global_init(current)) && 4637 !reliable_mem_limit_check(1 << order)) 4638 goto out_free_page; 4639 4640 goto out; 4641 4642 out_free_page: 4643 __free_pages(*_page, order); 4644 *_page = NULL; 4645 4646 out_retry: 4647 if (reliable_allow_fb_enabled() || is_global_init(current)) { > 4648 *gfp_mask &= ~___GFP_RELIABILITY; 4649 return true; 4650 } 4651 4652 if (*gfp_mask & (__GFP_NORETRY | __GFP_RETRY_MAYFAIL | __GFP_THISNODE)) 4653 goto out; 4654 4655 /* Coredumps can quickly deplete all memory reserves */ 4656 if (current->flags & PF_DUMPCORE) 4657 goto out; 4658 /* The OOM killer will not help higher order allocs */ 4659 if (order > PAGE_ALLOC_COSTLY_ORDER) 4660 goto out; 4661 4662 /* oom here */ 4663 mem_reliable_out_of_memory(*gfp_mask, order, preferred_nid, 4664 nodemask); 4665 out: 4666 return false; 4667 } 4668 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3257/3257] fs/xfs/xfs_acl.o: warning: objtool: .text.unlikely: unexpected end of section
by kernel test robot 30 Oct '25

30 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 5860abf4ca1c1e5ced0d4787886db4195a9c54ea commit: f2c902d8c653f8021f9761092a27f7b9db42b662 [3257/3257] tracing: Make tracepoint lockdep check actually test something config: x86_64-randconfig-013-20251029 (https://download.01.org/0day-ci/archive/20251030/202510300342.0lpOlnRP-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510300342.0lpOlnRP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510300342.0lpOlnRP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/xfs/xfs_acl.o: warning: objtool: .text.unlikely: unexpected end of section -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ptp: Add a upper bound on max_vclocks
by Xiaomeng Zhang 29 Oct '25

29 Oct '25

From: I Viswanath <viswanathiyyappan(a)gmail.com> mainline inclusion from mainline-v6.18-rc1 commit e9f35294e18da82162004a2f35976e7031aaf7f9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WIB CVE: CVE-2025-40057 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported WARNING in max_vclocks_store. This occurs when the argument max is too large for kcalloc to handle. Extend the guard to guard against values that are too large for kcalloc Reported-by: syzbot+94d20db923b9f51be0df(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=94d20db923b9f51be0df Tested-by: syzbot+94d20db923b9f51be0df(a)syzkaller.appspotmail.com Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") Signed-off-by: I Viswanath <viswanathiyyappan(a)gmail.com> Acked-by: Richard Cochran <richardcochran(a)gmail.com> Link: https://patch.msgid.link/20250925155908.5034-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/ptp/ptp_private.h drivers/ptp/ptp_sysfs.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/ptp/ptp_private.h | 1 + drivers/ptp/ptp_sysfs.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/ptp/ptp_private.h b/drivers/ptp/ptp_private.h index 0021f4773f7e..e58b5959e17c 100644 --- a/drivers/ptp/ptp_private.h +++ b/drivers/ptp/ptp_private.h @@ -20,6 +20,7 @@ #define PTP_MAX_TIMESTAMPS 128 #define PTP_BUF_TIMESTAMPS 30 #define PTP_DEFAULT_MAX_VCLOCKS 20 +#define PTP_MAX_VCLOCKS_LIMIT (KMALLOC_MAX_SIZE/(sizeof(int))) struct timestamp_event_queue { struct ptp_extts_event buf[PTP_MAX_TIMESTAMPS]; diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c index aefc06ae5d09..02111e6d87a1 100644 --- a/drivers/ptp/ptp_sysfs.c +++ b/drivers/ptp/ptp_sysfs.c @@ -282,7 +282,7 @@ static ssize_t max_vclocks_store(struct device *dev, size_t size; u32 max; - if (kstrtou32(buf, 0, &max) || max == 0) + if (kstrtou32(buf, 0, &max) || max == 0 || max > PTP_MAX_VCLOCKS_LIMIT) return -EINVAL; if (max == ptp->max_vclocks) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] iommu/vt-d: Clean up si_domain in the init_dmars() error path
by Wang Wensheng 29 Oct '25

29 Oct '25

From: Jerry Snitselaar <jsnitsel(a)redhat.com> stable inclusion from stable-v4.19.264 commit 5cecfe151874b835331efe086bbdcaeaf64f6b90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0U9W CVE: CVE-2022-50482 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 620bf9f981365c18cc2766c53d92bf8131c63f32 ] A splat from kmem_cache_destroy() was seen with a kernel prior to commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mempool") when there was a failure in init_dmars(), because the iommu_domain cache still had objects. While the mempool code is now gone, there still is a leak of the si_domain memory if init_dmars() fails. So clean up si_domain in the init_dmars() error path. Cc: Lu Baolu <baolu.lu(a)linux.intel.com> Cc: Joerg Roedel <joro(a)8bytes.org> Cc: Will Deacon <will(a)kernel.org> Cc: Robin Murphy <robin.murphy(a)arm.com> Fixes: 86080ccc223a ("iommu/vt-d: Allocate si_domain in init_dmars()") Signed-off-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Link: https://lore.kernel.org/r/20221010144842.308890-1-jsnitsel@redhat.com Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/intel-iommu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c index fb63abcf6592..df2da0d648f6 100644 --- a/drivers/iommu/intel-iommu.c +++ b/drivers/iommu/intel-iommu.c @@ -2842,10 +2842,11 @@ static int __init si_domain_init(int hw) if (!si_domain) return -EFAULT; if (md_domain_init(si_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) { domain_exit(si_domain); + si_domain = NULL; return -EFAULT; } pr_debug("Identity mapping domain allocated\n"); @@ -3545,10 +3546,14 @@ static int __init init_dmars(void) free_iommu: for_each_active_iommu(iommu, drhd) { disable_dmar_iommu(iommu); free_dmar_iommu(iommu); } + if (si_domain) { + domain_exit(si_domain); + si_domain = NULL; + } kfree(g_iommus); error: return ret; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: Fix potential memory leaks
by Wang Wensheng 29 Oct '25

29 Oct '25

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v4.19.262 commit 46f0aed47673e275d682af60ed26dcc28add8eae category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0UAB CVE: CVE-2022-50484 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6382da0828995af87aa8b8bef28cc61aceb4aff3 upstream. When the driver hits -ENOMEM at allocating a URB or a buffer, it aborts and goes to the error path that releases the all previously allocated resources. However, when -ENOMEM hits at the middle of the sync EP URB allocation loop, the partially allocated URBs might be left without released, because ep->nurbs is still zero at that point. Fix it by setting ep->nurbs at first, so that the error handler loops over the full URB list. Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220930100151.19461-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- sound/usb/endpoint.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c index aeb74cc6ceff..1a788013f3dc 100644 --- a/sound/usb/endpoint.c +++ b/sound/usb/endpoint.c @@ -814,10 +814,11 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep) ep->syncbuf = usb_alloc_coherent(ep->chip->dev, SYNC_URBS * 4, GFP_KERNEL, &ep->sync_dma); if (!ep->syncbuf) return -ENOMEM; + ep->nurbs = SYNC_URBS; for (i = 0; i < SYNC_URBS; i++) { struct snd_urb_ctx *u = &ep->urb[i]; u->index = i; u->ep = ep; u->packets = 1; @@ -833,12 +834,10 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep) u->urb->interval = 1 << ep->syncinterval; u->urb->context = u; u->urb->complete = snd_complete_urb; } - ep->nurbs = SYNC_URBS; - return 0; out_of_memory: release_urbs(ep, 0); return -ENOMEM; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] iommu/vt-d: Clean up si_domain in the init_dmars() error path
by Wang Wensheng 29 Oct '25

29 Oct '25

From: Jerry Snitselaar <jsnitsel(a)redhat.com> [ Upstream commit 620bf9f981365c18cc2766c53d92bf8131c63f32 ] A splat from kmem_cache_destroy() was seen with a kernel prior to commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mempool") when there was a failure in init_dmars(), because the iommu_domain cache still had objects. While the mempool code is now gone, there still is a leak of the si_domain memory if init_dmars() fails. So clean up si_domain in the init_dmars() error path. Cc: Lu Baolu <baolu.lu(a)linux.intel.com> Cc: Joerg Roedel <joro(a)8bytes.org> Cc: Will Deacon <will(a)kernel.org> Cc: Robin Murphy <robin.murphy(a)arm.com> Fixes: 86080ccc223a ("iommu/vt-d: Allocate si_domain in init_dmars()") Signed-off-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Link: https://lore.kernel.org/r/20221010144842.308890-1-jsnitsel@redhat.com Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/intel-iommu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c index fb63abcf6592..df2da0d648f6 100644 --- a/drivers/iommu/intel-iommu.c +++ b/drivers/iommu/intel-iommu.c @@ -2842,10 +2842,11 @@ static int __init si_domain_init(int hw) if (!si_domain) return -EFAULT; if (md_domain_init(si_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) { domain_exit(si_domain); + si_domain = NULL; return -EFAULT; } pr_debug("Identity mapping domain allocated\n"); @@ -3545,10 +3546,14 @@ static int __init init_dmars(void) free_iommu: for_each_active_iommu(iommu, drhd) { disable_dmar_iommu(iommu); free_dmar_iommu(iommu); } + if (si_domain) { + domain_exit(si_domain); + si_domain = NULL; + } kfree(g_iommus); error: return ret; -- 2.22.0

2 1

[PATCH OLK-5.10] ice: Fix memory corruption in VF driver
by Xiaomeng Zhang 29 Oct '25

29 Oct '25

From: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> mainline inclusion from mainline-v5.19-rc3 commit efe41860008e57fb6b69855b4b93fdf34bc42798 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3Y9 CVE: CVE-2022-49722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------- Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when it requests a reset. If PF driver assumes that VF is disabled, while VF still has queues configured, VF may unmap DMA resources. In such scenario device still can map packets to memory, which ends up silently corrupting it. Previously, VF driver could experience memory corruption, which lead to crash: [ 5119.170157] BUG: unable to handle kernel paging request at 00001b9780003237 [ 5119.170166] PGD 0 P4D 0 [ 5119.170173] Oops: 0002 [#1] PREEMPT_RT SMP PTI [ 5119.170181] CPU: 30 PID: 427592 Comm: kworker/u96:2 Kdump: loaded Tainted: G W I --------- - - 4.18.0-372.9.1.rt7.166.el8.x86_64 #1 [ 5119.170189] Hardware name: Dell Inc. PowerEdge R740/014X06, BIOS 2.3.10 08/15/2019 [ 5119.170193] Workqueue: iavf iavf_adminq_task [iavf] [ 5119.170219] RIP: 0010:__page_frag_cache_drain+0x5/0x30 [ 5119.170238] Code: 0f 0f b6 77 51 85 f6 74 07 31 d2 e9 05 df ff ff e9 90 fe ff ff 48 8b 05 49 db 33 01 eb b4 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <f0> 29 77 34 74 01 c3 48 8b 07 f6 c4 80 74 0f 0f b6 77 51 85 f6 74 [ 5119.170244] RSP: 0018:ffffa43b0bdcfd78 EFLAGS: 00010282 [ 5119.170250] RAX: ffffffff896b3e40 RBX: ffff8fb282524000 RCX: 0000000000000002 [ 5119.170254] RDX: 0000000049000000 RSI: 0000000000000000 RDI: 00001b9780003203 [ 5119.170259] RBP: ffff8fb248217b00 R08: 0000000000000022 R09: 0000000000000009 [ 5119.170262] R10: 2b849d6300000000 R11: 0000000000000020 R12: 0000000000000000 [ 5119.170265] R13: 0000000000001000 R14: 0000000000000009 R15: 0000000000000000 [ 5119.170269] FS: 0000000000000000(0000) GS:ffff8fb1201c0000(0000) knlGS:0000000000000000 [ 5119.170274] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5119.170279] CR2: 00001b9780003237 CR3: 00000008f3e1a003 CR4: 00000000007726e0 [ 5119.170283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5119.170286] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5119.170290] PKRU: 55555554 [ 5119.170292] Call Trace: [ 5119.170298] iavf_clean_rx_ring+0xad/0x110 [iavf] [ 5119.170324] iavf_free_rx_resources+0xe/0x50 [iavf] [ 5119.170342] iavf_free_all_rx_resources.part.51+0x30/0x40 [iavf] [ 5119.170358] iavf_virtchnl_completion+0xd8a/0x15b0 [iavf] [ 5119.170377] ? iavf_clean_arq_element+0x210/0x280 [iavf] [ 5119.170397] iavf_adminq_task+0x126/0x2e0 [iavf] [ 5119.170416] process_one_work+0x18f/0x420 [ 5119.170429] worker_thread+0x30/0x370 [ 5119.170437] ? process_one_work+0x420/0x420 [ 5119.170445] kthread+0x151/0x170 [ 5119.170452] ? set_kthread_struct+0x40/0x40 [ 5119.170460] ret_from_fork+0x35/0x40 [ 5119.170477] Modules linked in: iavf sctp ip6_udp_tunnel udp_tunnel mlx4_en mlx4_core nfp tls vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache sunrpc intel_rapl_msr iTCO_wdt iTCO_vendor_support dell_smbios wmi_bmof dell_wmi_descriptor dcdbas kvm_intel kvm irqbypass intel_rapl_common isst_if_common skx_edac irdma nfit libnvdimm x86_pkg_temp_thermal i40e intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ib_uverbs rapl ipmi_ssif intel_cstate intel_uncore mei_me pcspkr acpi_ipmi ib_core mei lpc_ich i2c_i801 ipmi_si ipmi_devintf wmi ipmi_msghandler acpi_power_meter xfs libcrc32c sd_mod t10_pi sg mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ice ahci drm libahci crc32c_intel libata tg3 megaraid_sas [ 5119.170613] i2c_algo_bit dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: iavf] [ 5119.170627] CR2: 00001b9780003237 Fixes: ec4f5a436bdf ("ice: Check if VF is disabled for Opcode and other operations") Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> Co-developed-by: Slawomir Laba <slawomirx.laba(a)intel.com> Signed-off-by: Slawomir Laba <slawomirx.laba(a)intel.com> Signed-off-by: Mateusz Palczewski <mateusz.palczewski(a)intel.com> Tested-by: Konrad Jankowski <konrad0.jankowski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c drivers/net/ethernet/intel/ice/ice_vf_lib.c [Due to previous commit c5afbe99b778('ice: Add helper function to get the VF's VSI') not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c index a980d337861d..dc27850adb56 100644 --- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c @@ -1261,6 +1261,18 @@ static bool ice_is_vf_disabled(struct ice_vf *vf) test_bit(ICE_VF_STATE_DIS, vf->vf_states)); } +/** + * ice_get_vf_vsi - get VF's VSI based on the stored index + * @vf: VF used to get VSI + */ +struct ice_vsi *ice_get_vf_vsi(struct ice_vf *vf) +{ + if (vf->lan_vsi_idx == ICE_NO_VSI) + return NULL; + + return vf->pf->vsi[vf->lan_vsi_idx]; +} + /** * ice_reset_vf - Reset a particular VF * @vf: pointer to the VF structure @@ -1291,6 +1303,11 @@ bool ice_reset_vf(struct ice_vf *vf, bool is_vflr) } if (ice_is_vf_disabled(vf)) { + vsi = ice_get_vf_vsi(vf); + if (WARN_ON(!vsi)) + return -EINVAL; + ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, vf->vf_id); + ice_vsi_stop_all_rx_rings(vsi); dev_dbg(dev, "VF is already disabled, there is no need for resetting it, telling VM, all is fine %d\n", vf->vf_id); return true; -- 2.34.1

2 1

[PATCH OLK-6.6] tty: n_gsm: Don't block input queue by waiting MSC
by Yi Yang 29 Oct '25

29 Oct '25

From: Seppo Takalo <seppo.takalo(a)nordicsemi.no> stable inclusion from stable-v6.6.112 commit c36785f9de03df56ff9b8eca30fa681a12b2310d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WGP CVE: CVE-2025-40071 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3cf0b3c243e56bc43be560617416c1d9f301f44c ] Currently gsm_queue() processes incoming frames and when opening a DLC channel it calls gsm_dlci_open() which calls gsm_modem_update(). If basic mode is used it calls gsm_modem_upd_via_msc() and it cannot block the input queue by waiting the response to come into the same input queue. Instead allow sending Modem Status Command without waiting for remote end to respond. Define a new function gsm_modem_send_initial_msc() for this purpose. As MSC is only valid for basic encoding, it does not do anything for advanced or when convergence layer type 2 is used. Fixes: 48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open") Signed-off-by: Seppo Takalo <seppo.takalo(a)nordicsemi.no> Link: https://lore.kernel.org/r/20250827123221.1148666-1-seppo.takalo@nordicsemi.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/n_gsm.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 8559ba1361c6..901f5c8311fb 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -460,6 +460,7 @@ static int gsm_send_packet(struct gsm_mux *gsm, struct gsm_msg *msg); static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr); static void gsmld_write_trigger(struct gsm_mux *gsm); static void gsmld_write_task(struct work_struct *work); +static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci); /** * gsm_fcs_add - update FCS @@ -2173,7 +2174,7 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) pr_debug("DLCI %d goes open.\n", dlci->addr); /* Send current modem state */ if (dlci->addr) { - gsm_modem_update(dlci, 0); + gsm_modem_send_initial_msc(dlci); } else { /* Start keep-alive control */ gsm->ka_num = 0; @@ -4156,6 +4157,28 @@ static int gsm_modem_upd_via_msc(struct gsm_dlci *dlci, u8 brk) return gsm_control_wait(dlci->gsm, ctrl); } +/** + * gsm_modem_send_initial_msc - Send initial modem status message + * + * @dlci channel + * + * Send an initial MSC message after DLCI open to set the initial + * modem status lines. This is only done for basic mode. + * Does not wait for a response as we cannot block the input queue + * processing. + */ +static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci) +{ + u8 modembits[2]; + + if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT) + return 0; + + modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ + modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; + return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2); +} + /** * gsm_modem_update - send modem status line state * @dlci: channel -- 2.25.1

2 1