- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/4] blk-ioinf: introduce inflight-based IO QoS controller
by Baokun Li 28 Oct '25

28 Oct '25

Baokun Li (4): blk-ioinf: introduce inflight-based IO QoS controller blk-ioinf: add rqos/inflight/stat debufs interface blk-ioinf: dynamically adjust inflight limit to balance workloads blk-ioinf: support percentile latency QoS for oneline workloads block/Kconfig | 10 + block/Makefile | 1 + block/blk-ioinf.c | 1260 ++++++++++++++++++++++++++++++++++++++++ block/blk-mq-debugfs.c | 2 + block/blk-rq-qos.h | 1 + include/linux/blk-mq.h | 3 + 6 files changed, 1277 insertions(+) create mode 100644 block/blk-ioinf.c -- 2.46.1

2 5

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix use-after-free
by Yuan Can 28 Oct '25

28 Oct '25

From: Zhengping Jiang <jiangzp(a)google.com> stable inclusion from stable-v4.19.293 commit 1a40c56e8bff3e424724d78a9a6b3272dd8a371d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBVV CVE: CVE-2023-53305 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ] Fix potential use-after-free in l2cap_le_command_rej. Signed-off-by: Zhengping Jiang <jiangzp(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 22e971808536..cdb0a9f6f9fd 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -5712,9 +5712,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, if (!chan) goto done; + chan = l2cap_chan_hold_unless_zero(chan); + if (!chan) + goto done; + l2cap_chan_lock(chan); l2cap_chan_del(chan, ECONNREFUSED); l2cap_chan_unlock(chan); + l2cap_chan_put(chan); done: mutex_unlock(&conn->chan_lock); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
by Yuan Can 28 Oct '25

28 Oct '25

From: Su Hui <suhui(a)nfschina.com> stable inclusion from stable-v4.19.291 commit e4cccff1e7ab6ea30995b6fbbb007d02647e025c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VHK CVE: CVE-2023-53648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 79597c8bf64ca99eab385115743131d260339da5 ] smatch error: sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error: we previously assumed 'rac97' could be null (see line 2072) remove redundant assignment, return error if rac97 is NULL. Fixes: da3cec35dd3c ("ALSA: Kill snd_assert() in sound/pci/*") Signed-off-by: Su Hui <suhui(a)nfschina.com> Link: https://lore.kernel.org/r/20230615021732.1972194-1-suhui@nfschina.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- sound/pci/ac97/ac97_codec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c index fee9ffecd584..202f8bc0a78a 100644 --- a/sound/pci/ac97/ac97_codec.c +++ b/sound/pci/ac97/ac97_codec.c @@ -2026,8 +2026,8 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template, .dev_disconnect = snd_ac97_dev_disconnect, }; - if (rac97) - *rac97 = NULL; + if (!rac97) + return -EINVAL; if (snd_BUG_ON(!bus || !template)) return -EINVAL; if (snd_BUG_ON(template->num >= 4)) -- 2.22.0

2 1

[openeuler:OLK-6.6 3050/3050] drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_sysfs.c:23:12: sparse: sparse: symbol 'nbl_sysfs_qos_name' was not declared. Should it be static?
by kernel test robot 28 Oct '25

28 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: cb364ed0578ca246dd52b84bed98cfaa40affb38 commit: 468b0cd7b1e1c131b3ee7d2ea8b96521d3faad8b [3050/3050] net:nebula-matrix:Add S1000 SNIC driver support config: x86_64-randconfig-123-20251028 (https://download.01.org/0day-ci/archive/20251028/202510281430.S9EMJbna-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251028/202510281430.S9EMJbna-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510281430.S9EMJbna-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_sysfs.c:23:12: sparse: sparse: symbol 'nbl_sysfs_qos_name' was not declared. Should it be static? >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_sysfs.c:47:12: sparse: sparse: symbol 'nbl_sysfs_mirror_name' was not declared. Should it be static? -- >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:345:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] block:5 @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:345:21: sparse: expected unsigned int [usertype] block:5 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:345:21: sparse: got restricted __le16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:346:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] module:5 @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:346:22: sparse: expected unsigned int [usertype] module:5 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:346:22: sparse: got restricted __le16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:347:21: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] table:4 @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:347:21: sparse: expected unsigned int [usertype] table:4 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:347:21: sparse: got restricted __le16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:348:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] opcode:8 @@ got restricted __le16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:348:22: sparse: expected unsigned int [usertype] opcode:8 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:348:22: sparse: got restricted __le16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:349:26: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] param_high @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:349:26: sparse: expected unsigned int [usertype] param_high drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:349:26: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:350:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] param_low @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:350:25: sparse: expected unsigned int [usertype] param_low drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:350:25: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:359:29: sparse: sparse: invalid assignment: |= drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:359:29: sparse: left side has type unsigned int [usertype] :16 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:359:29: sparse: right side has type restricted __le16 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:360:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] send_high @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:360:33: sparse: expected unsigned int [usertype] send_high drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:360:33: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:361:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] send_low @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:361:32: sparse: expected unsigned int [usertype] send_low drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:361:32: sparse: got restricted __le32 [usertype] drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:366:29: sparse: sparse: invalid assignment: |= drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:366:29: sparse: left side has type unsigned int [usertype] :16 drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:366:29: sparse: right side has type restricted __le16 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:367:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] recv_high @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:367:33: sparse: expected unsigned int [usertype] recv_high drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:367:33: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:368:32: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] recv_low @@ got restricted __le32 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:368:32: sparse: expected unsigned int [usertype] recv_low drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:368:32: sparse: got restricted __le32 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_channel/nbl_cmdq.c:479:35: sparse: sparse: cast to restricted __le16 -- >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:320:45: sparse: sparse: cast to restricted __be16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:321:45: sparse: sparse: cast to restricted __be16 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:324:41: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:325:41: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:328:41: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:329:41: sparse: sparse: cast to restricted __be32 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:336:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:337:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:338:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:339:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:342:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:343:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:344:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:345:41: sparse: sparse: cast to restricted __be64 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:349:44: sparse: sparse: cast to restricted __be16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:350:44: sparse: sparse: cast to restricted __be16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:353:44: sparse: sparse: cast to restricted __be16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:354:44: sparse: sparse: cast to restricted __be16 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_fd.c:832:6: sparse: sparse: symbol 'flow_type_name' was not declared. Should it be static? -- >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:590:71: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] *ip @@ got restricted __be32 * @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:590:71: sparse: expected unsigned int [usertype] *ip drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:590:71: sparse: got restricted __be32 * >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:594:29: sparse: sparse: cast to restricted __be32 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:640:71: sparse: sparse: incorrect type in initializer (different base types) @@ expected unsigned int [usertype] *ip @@ got restricted __be32 * @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:640:71: sparse: expected unsigned int [usertype] *ip drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:640:71: sparse: got restricted __be32 * drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_hw_leonis/nbl_tc_flow_filter_leonis.c:644:29: sparse: sparse: cast to restricted __be32 -- drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:49:27: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected unsigned char [noderef] [usertype] __iomem *notify_addr @@ got unsigned char [usertype] * @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:49:27: sparse: expected unsigned char [noderef] [usertype] __iomem *notify_addr drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:49:27: sparse: got unsigned char [usertype] * >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1340:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] len @@ got unsigned short [usertype] len @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1340:22: sparse: expected restricted __le32 [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1340:22: sparse: got unsigned short [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1402:23: sparse: sparse: cast to restricted __le16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1658:39: sparse: sparse: cast to restricted __le16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1760:48: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] *irq_enable_base @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1760:48: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1760:48: sparse: got unsigned char [usertype] *irq_enable_base drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1977:22: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] len @@ got unsigned int [assigned] size @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1977:22: sparse: expected restricted __le32 [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1977:22: sparse: got unsigned int [assigned] size drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2012:30: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] len @@ got unsigned int [assigned] size @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2012:30: sparse: expected restricted __le32 [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2012:30: sparse: got unsigned int [assigned] size drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2680:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] len @@ got unsigned int [assigned] [usertype] pkthdr_len @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2680:33: sparse: expected restricted __le32 [usertype] len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2680:33: sparse: got unsigned int [assigned] [usertype] pkthdr_len drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2709:25: sparse: sparse: bad assignment (+=) to restricted __le32 >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2862:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] vlan_proto @@ got restricted __be16 [usertype] @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2862:36: sparse: expected unsigned short [usertype] vlan_proto drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2862:36: sparse: got restricted __be16 [usertype] >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2867:36: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned short [usertype] vlan_proto @@ got restricted __be16 [usertype] vlan_proto @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2867:36: sparse: expected unsigned short [usertype] vlan_proto drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2867:36: sparse: got restricted __be16 [usertype] vlan_proto >> drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2871:54: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] vlan_proto @@ got unsigned short [usertype] vlan_proto @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2871:54: sparse: expected restricted __be16 [usertype] vlan_proto drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:2871:54: sparse: got unsigned short [usertype] vlan_proto drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3030:40: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3031:32: sparse: sparse: restricted __le32 degrades to integer drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3400:24: sparse: sparse: cast to restricted __le16 drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3562:56: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got unsigned char [usertype] *irq_enable_base @@ drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3562:56: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:3562:56: sparse: got unsigned char [usertype] *irq_enable_base drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1382:9: sparse: sparse: context imbalance in 'nbl_res_txrx_xmit_xdp_buff' - different lock contexts for basic block drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1520:9: sparse: sparse: context imbalance in 'nbl_res_txrx_xdp_xmit' - different lock contexts for basic block drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1535:9: sparse: sparse: context imbalance in 'nbl_res_txrx_update_xdp_tail_locked' - different lock contexts for basic block drivers/net/ethernet/nebula-matrix/nbl/nbl_hw/nbl_txrx.c:1581:23: sparse: sparse: restricted __le32 degrades to integer vim +/nbl_sysfs_qos_name +23 drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_sysfs.c 22 > 23 const char *const nbl_sysfs_qos_name[] = { 24 /* rdma */ 25 "save", 26 "tc2pri", 27 "sq_pri_map", 28 "raq_pri_map", 29 "pri_imap", 30 "pfc_imap", 31 "db_to_csch_en", 32 "sw_db_csch_th", 33 "csch_qlen_th", 34 "poll_wgt", 35 "sp_wrr", 36 "tc_wgt", 37 38 "pfc", 39 "pfc_buffer", 40 "trust", 41 "dscp2prio", 42 "rdma_bw", 43 "rdma_rate", 44 "net_rate", 45 }; 46 > 47 const char *const nbl_sysfs_mirror_name[] = { 48 "configure_down_mirror", 49 "configure_up_mirror", 50 }; 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3256/3256] arch/x86/kvm/x86.c:8661:5: sparse: sparse: symbol '__kvm_vcpu_halt' was not declared. Should it be static?
by kernel test robot 28 Oct '25

28 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: e5b3f6c2a77fa1ef4962e1a3875f03706af77ccd commit: c499a3120204c834ff963c43d90a5ff33194b34c [3256/3256] KVM: SVM: Add support for booting APs in an SEV-ES guest config: x86_64-randconfig-122-20251028 (https://download.01.org/0day-ci/archive/20251028/202510281231.vqq8hCtx-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251028/202510281231.vqq8hCtx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510281231.vqq8hCtx-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/x86/kvm/x86.c:3138:38: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const [noderef] __user * @@ got unsigned char [usertype] * @@ arch/x86/kvm/x86.c:3138:38: sparse: expected void const [noderef] __user * arch/x86/kvm/x86.c:3138:38: sparse: got unsigned char [usertype] * >> arch/x86/kvm/x86.c:8661:5: sparse: sparse: symbol '__kvm_vcpu_halt' was not declared. Should it be static? arch/x86/kvm/x86.c:8772:15: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:8772:15: sparse: struct kvm_apic_map [noderef] __rcu * arch/x86/kvm/x86.c:8772:15: sparse: struct kvm_apic_map * arch/x86/kvm/x86.c:11225:32: sparse: sparse: Using plain integer as NULL pointer arch/x86/kvm/x86.c:11278:16: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:11278:16: sparse: struct kvm_apic_map [noderef] __rcu * arch/x86/kvm/x86.c:11278:16: sparse: struct kvm_apic_map * arch/x86/kvm/x86.c:11279:15: sparse: sparse: incompatible types in comparison expression (different address spaces): arch/x86/kvm/x86.c:11279:15: sparse: struct kvm_pmu_event_filter [noderef] __rcu * arch/x86/kvm/x86.c:11279:15: sparse: struct kvm_pmu_event_filter * arch/x86/kvm/x86.c: note: in included file (through include/linux/notifier.h, include/linux/memory_hotplug.h, include/linux/mmzone.h, ...): include/linux/srcu.h:182:9: sparse: sparse: context imbalance in 'vcpu_enter_guest' - unexpected unlock vim +/__kvm_vcpu_halt +8661 arch/x86/kvm/x86.c 8660 > 8661 int __kvm_vcpu_halt(struct kvm_vcpu *vcpu, int state, int reason) 8662 { 8663 ++vcpu->stat.halt_exits; 8664 if (lapic_in_kernel(vcpu)) { 8665 vcpu->arch.mp_state = state; 8666 return 1; 8667 } else { 8668 vcpu->run->exit_reason = reason; 8669 return 0; 8670 } 8671 } 8672 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] xhci: Remove device endpoints from bandwidth list when freeing the device
by Chen Jinghuang 28 Oct '25

28 Oct '25

From: Mathias Nyman <mathias.nyman(a)linux.intel.com> stable inclusion from stable-v4.19.264 commit cebbc8d335d6bcc1316584f779c08f80287c6af8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0U9S CVE: CVE-2022-50470 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5aed5b7c2430ce318a8e62f752f181e66f0d1053 upstream. Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed. If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller. So check and delete endpoints that are still on the bandwidth list when freeing the virt device. Solves a list_del corruption kernel crash when unbinding xhci-pci, caused by xhci_mem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list. This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge) Cc: stable(a)vger.kernel.org Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Tested-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20221024142720.4122053-5-mathias.nyman@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/usb/host/xhci-mem.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index 76d13bed7c15..0dfba22250f6 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -906,15 +906,19 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) if (dev->eps[i].stream_info) xhci_free_stream_info(xhci, dev->eps[i].stream_info); - /* Endpoints on the TT/root port lists should have been removed - * when usb_disable_device() was called for the device. - * We can't drop them anyway, because the udev might have gone - * away by this point, and we can't tell what speed it was. + /* + * Endpoints are normally deleted from the bandwidth list when + * endpoints are dropped, before device is freed. + * If host is dying or being removed then endpoints aren't + * dropped cleanly, so delete the endpoint from list here. + * Only applicable for hosts with software bandwidth checking. */ - if (!list_empty(&dev->eps[i].bw_endpoint_list)) - xhci_warn(xhci, "Slot %u endpoint %u " - "not removed from BW list!\n", - slot_id, i); + + if (!list_empty(&dev->eps[i].bw_endpoint_list)) { + list_del_init(&dev->eps[i].bw_endpoint_list); + xhci_dbg(xhci, "Slot %u endpoint %u not removed from BW list!\n", + slot_id, i); + } } /* If this is a hub, free the TT(s) from the TT list */ xhci_free_tt_info(xhci, dev, slot_id); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mm/slub: avoid accessing metadata when pointer is invalid in object_err()
by Zhang Qilong 28 Oct '25

28 Oct '25

From: Li Qiong <liqiong(a)nfschina.com> stable inclusion from stable-v5.4.299 commit 872f2c34ff232af1e65ad2df86d61163c8ffad42 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0R2Y CVE: CVE-2025-39902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b4efccec8d06ceb10a7d34d7b1c449c569d53770 ] object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata. Fixes: 81819f0fc828 ("SLUB core") Cc: <stable(a)vger.kernel.org> Signed-off-by: Li Qiong <liqiong(a)nfschina.com> Reviewed-by: Harry Yoo <harry.yoo(a)oracle.com> Reviewed-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> [ struct page + print_page_info() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/slub.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index a67bcc57a770..4afdf67e4c58 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -711,11 +711,16 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p) void object_err(struct kmem_cache *s, struct page *page, u8 *object, char *reason) { slab_bug(s, "%s", reason); - print_trailer(s, page, object); + if (!object || !check_valid_pointer(s, page, object)) { + print_page_info(page); + pr_err("Invalid pointer 0x%p\n", object); + } else { + print_trailer(s, page, object); + } } static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page, const char *fmt, ...) { -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] scsi: qla4xxx: Prevent a potential error pointer dereference
by Zhang Qilong 28 Oct '25

28 Oct '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.4.297 commit d0225f41ee70611ca88ccb22c8542ecdfa7faea8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWO34 CVE: CVE-2025-39676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9dcf111dd3e7ed5fce82bb108e3a3fc001c07225 ] The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL. Fixes: 13483730a13b ("[SCSI] qla4xxx: fix flash/ddb support") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/aJwnVKS9tHsw1tEu@stanley.mountain Reviewed-by: Chris Leech <cleech(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/qla4xxx/ql4_os.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index 8d42f20ba7e5..2d11451a800e 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -6594,10 +6594,12 @@ static struct iscsi_endpoint *qla4xxx_get_ep_fwdb(struct scsi_qla_host *ha, addr->sin_port = htons(le16_to_cpu(fw_ddb_entry->port)); } ep = qla4xxx_ep_connect(ha->host, (struct sockaddr *)dst_addr, 0); vfree(dst_addr); + if (IS_ERR(ep)) + return NULL; return ep; } static int qla4xxx_verify_boot_idx(struct scsi_qla_host *ha, uint16_t idx) { -- 2.43.0

2 1

[PATCH OLK-6.6 00/11] KVM: arm64: Errata management for VM Live migration
by Jinqian Yang 28 Oct '25

28 Oct '25

Patch#30 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#31 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#32 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#33 KVM: arm64: Allow userspace to change the implementation ID registers Reference: https://lore.kernel.org/all/20250225005401.679536-1-oliver.upton@linux.dev/ selftest相关未合入 Patch#34 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#35 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#36 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#37 arm64: Make _midr_in_range_list() an exported function Patch#38 smccc/kvm_guest: Enable errata based on implementation CPUs Reference: https://lore.kernel.org/all/20250221140229.12588-1-shameerali.kolothum.thod… selftest相关未合入 Patch#39 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reference: https://lore.kernel.org/all/20250327163613.2516073-1-oliver.upton@linux.dev/ 单patch合入 Patch#40 smccc: kvm_guest: Fix kernel builds for 32 bit arm Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… 单patch合入 Oliver Upton (3): KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Sebastian Ott (2): KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (6): arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 18 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 40 ++-- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_host.h | 13 ++ arch/arm64/include/uapi/asm/kvm.h | 12 + arch/arm64/kernel/cpu_errata.c | 75 ++++++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/proton-pack.c | 20 +- arch/arm64/kvm/arm.c | 9 + arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 ++- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 ++ arch/arm64/kvm/sys_regs.c | 245 ++++++++++++--------- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/efi/libstub/arm64.c | 17 ++ drivers/firmware/smccc/kvm_guest.c | 66 ++++++ drivers/perf/arm_pmuv3.c | 2 +- drivers/platform/mpam/mpam_devices.c | 6 +- include/linux/arm-smccc.h | 16 ++ include/uapi/linux/kvm.h | 3 + 24 files changed, 447 insertions(+), 167 deletions(-) -- 2.33.0

2 12

[PATCH openEuler-1.0-LTS 0/3] Fix CVE-2023-53719
by Yi Yang 28 Oct '25

28 Oct '25

1. drivers: provide devm_platform_ioremap_resource() 2. serial: arc_uart: fix of_iomap leak in `arc_serial_probe` 3. drivers: fix a typo in the kernel doc for devm_platform_ioremap_resource() Bartosz Golaszewski (2): drivers: provide devm_platform_ioremap_resource() drivers: fix a typo in the kernel doc for devm_platform_ioremap_resource() Ke Zhang (1): serial: arc_uart: fix of_iomap leak in `arc_serial_probe` drivers/base/platform.c | 18 ++++++++++++++++++ drivers/tty/serial/arc_uart.c | 7 ++++--- include/linux/platform_device.h | 3 +++ 3 files changed, 25 insertions(+), 3 deletions(-) -- 2.25.1

2 4