- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
by Yi Yang 23 Sep '25

23 Sep '25

From: Zhang Shurong <zhang_shurong(a)foxmail.com> stable inclusion from stable-v4.19.21 commit adcb73f8ce9aec48b1f85223f401c1574015d8d2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY49I CVE: CVE-2023-53220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1047f9343011f2cedc73c64829686206a7e9fc3f ] In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Zhang Shurong <zhang_shurong(a)foxmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/usb/dvb-usb-v2/az6007.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/media/usb/dvb-usb-v2/az6007.c b/drivers/media/usb/dvb-usb-v2/az6007.c index 746926364535..6bcf30218e51 100644 --- a/drivers/media/usb/dvb-usb-v2/az6007.c +++ b/drivers/media/usb/dvb-usb-v2/az6007.c @@ -795,6 +795,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], if (az6007_xfer_debug) printk(KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n", addr, msgs[i].len); + if (msgs[i].len < 1) { + ret = -EIO; + goto err; + } req = AZ6007_I2C_WR; index = msgs[i].buf[0]; value = addr | (1 << 8); @@ -809,6 +813,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], if (az6007_xfer_debug) printk(KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n", addr, msgs[i].len); + if (msgs[i].len < 1) { + ret = -EIO; + goto err; + } req = AZ6007_I2C_RD; index = msgs[i].buf[0]; value = addr; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] recordmcount: Fix memory leaks in the uwrite function
by Liu Kai 23 Sep '25

23 Sep '25

From: Hao Zeng <zenghao(a)kylinos.cn> stable inclusion from stable-v4.19.284 commit 444ec005404cead222ebce2561a9451c9ee5ad89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBVX CVE: CVE-2023-53318 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fa359d068574d29e7d2f0fdd0ebe4c6a12b5cfb9 ] Common realloc mistake: 'file_append' nulled but not freed upon failure Link: https://lkml.kernel.org/r/20230426010527.703093-1-zenghao@kylinos.cn Signed-off-by: Hao Zeng <zenghao(a)kylinos.cn> Suggested-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- scripts/recordmcount.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c index 4182274a5ab28..ff481b4ae85fa 100644 --- a/scripts/recordmcount.c +++ b/scripts/recordmcount.c @@ -128,6 +128,7 @@ uwrite(int const fd, void const *const buf, size_t const count) { size_t cnt = count; off_t idx = 0; + void *p = NULL; file_updated = 1; @@ -135,7 +136,10 @@ uwrite(int const fd, void const *const buf, size_t const count) off_t aoffset = (file_ptr + count) - file_end; if (aoffset > file_append_size) { - file_append = realloc(file_append, aoffset); + p = realloc(file_append, aoffset); + if (!p) + free(file_append); + file_append = p; file_append_size = aoffset; } if (!file_append) { -- 2.34.1

2 1

[openeuler:OLK-6.6 2909/2909] mm/mem_sampling.c:35:18: warning: unused variable 'mem_sampling_min_value'
by kernel test robot 23 Sep '25

23 Sep '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be758a5796c3d280deb877699c41fd0cd04e1deb commit: 390982f28c5796a1e590381044630b768e6b9696 [2909/2909] mm/mem_sampling: Add sysctl control for NUMA balancing integration config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231319.810I86nl-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231319.810I86nl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231319.810I86nl-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/mem_sampling.c:68:6: warning: no previous prototype for function 'mem_sampling_record_cb_register' [-Wmissing-prototypes] void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) ^ mm/mem_sampling.c:68:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) ^ static mm/mem_sampling.c:85:6: warning: no previous prototype for function 'mem_sampling_record_cb_unregister' [-Wmissing-prototypes] void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) ^ mm/mem_sampling.c:85:1: note: declare 'static' if the function is not intended to be used outside of this translation unit void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) ^ static >> mm/mem_sampling.c:35:18: warning: unused variable 'mem_sampling_min_value' [-Wunused-const-variable] static const int mem_sampling_min_value = MEM_SAMPLING_MIN_VALUE; ^ >> mm/mem_sampling.c:36:18: warning: unused variable 'mem_sampling_max_value' [-Wunused-const-variable] static const int mem_sampling_max_value = MEM_SAMPLING_MAX_VALUE; ^ 4 warnings generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARM_SPE_MEM_SAMPLING Depends on [n]: ARM_SPE_PMU [=n] Selected by [y]: - MEM_SAMPLING [=y] && ARM64 [=y] vim +/mem_sampling_min_value +35 mm/mem_sampling.c 34 > 35 static const int mem_sampling_min_value = MEM_SAMPLING_MIN_VALUE; > 36 static const int mem_sampling_max_value = MEM_SAMPLING_MAX_VALUE; 37 38 /* keep track of who use the SPE */ 39 DEFINE_PER_CPU(enum arm_spe_user_e, arm_spe_user); 40 EXPORT_PER_CPU_SYMBOL_GPL(arm_spe_user); 41 42 enum mem_sampling_saved_state_e { 43 MEM_SAMPLING_STATE_ENABLE, 44 MEM_SAMPLING_STATE_DISABLE, 45 MEM_SAMPLING_STATE_EMPTY, 46 }; 47 enum mem_sampling_saved_state_e mem_sampling_saved_state = MEM_SAMPLING_STATE_EMPTY; 48 49 /* 50 * Callbacks should be registered using mem_sampling_record_cb_register() 51 * by NUMA, DAMON and etc during their initialisation. 52 * Callbacks will be invoked on new hardware pmu records caputured. 53 */ 54 typedef void (*mem_sampling_record_cb_type)(struct mem_sampling_record *record); 55 56 struct mem_sampling_record_cb_list_entry { 57 struct list_head list; 58 mem_sampling_record_cb_type cb; 59 }; 60 LIST_HEAD(mem_sampling_record_cb_list); 61 62 struct mem_sampling_numa_access_work { 63 struct callback_head work; 64 u64 vaddr, paddr; 65 int cpu; 66 }; 67 68 void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) 69 { 70 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 71 72 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 73 if (cb_entry->cb == cb) 74 return; 75 } 76 77 cb_entry = kmalloc(sizeof(struct mem_sampling_record_cb_list_entry), GFP_KERNEL); 78 if (!cb_entry) 79 return; 80 81 cb_entry->cb = cb; 82 list_add(&(cb_entry->list), &mem_sampling_record_cb_list); 83 } 84 > 85 void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) 86 { 87 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 88 89 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 90 if (cb_entry->cb == cb) { 91 list_del(&cb_entry->list); 92 kfree(cb_entry); 93 return; 94 } 95 } 96 } 97 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2909/2909] mm/mem_sampling.c:38:33: sparse: sparse: symbol 'mem_sampling_saved_state' was not declared. Should it be static?
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: be758a5796c3d280deb877699c41fd0cd04e1deb commit: 02f32cc0235e33f7fc3e4910a80d386bc600935c [2909/2909] mm/mem_sampling:: Add proc and cmdline interface to control sampling enable config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231143.zSdArtSF-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231143.zSdArtSF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231143.zSdArtSF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/mem_sampling.c:38:33: sparse: sparse: symbol 'mem_sampling_saved_state' was not declared. Should it be static? mm/mem_sampling.c:51:1: sparse: sparse: symbol 'mem_sampling_record_cb_list' was not declared. Should it be static? mm/mem_sampling.c:53:6: sparse: sparse: symbol 'mem_sampling_record_cb_register' was not declared. Should it be static? mm/mem_sampling.c:70:6: sparse: sparse: symbol 'mem_sampling_record_cb_unregister' was not declared. Should it be static? mm/mem_sampling.c:83:1: sparse: sparse: symbol 'mem_sampling_access_hints' was not declared. Should it be static? vim +/mem_sampling_saved_state +38 mm/mem_sampling.c 32 33 enum mem_sampling_saved_state_e { 34 MEM_SAMPLING_STATE_ENABLE, 35 MEM_SAMPLING_STATE_DISABLE, 36 MEM_SAMPLING_STATE_EMPTY, 37 }; > 38 enum mem_sampling_saved_state_e mem_sampling_saved_state = MEM_SAMPLING_STATE_EMPTY; 39 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] tee: fix NULL pointer dereference in tee_shm_put
by Xiaomeng Zhang 23 Sep '25

23 Sep '25

From: Pei Xiao <xiaopei01(a)kylinos.cn> mainline inclusion from mainline-v6.17-rc5 commit e4a718a3a47e89805c3be9d46a84de1949a98d5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVF CVE: CVE-2025-39865 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15 Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Reviewed-by: Sumit Garg <sumit.garg(a)oss.qualcomm.com> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/tee/tee_shm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index e4c150346a42..b8b306ad4a40 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -433,9 +433,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id); */ void tee_shm_put(struct tee_shm *shm) { - struct tee_device *teedev = shm->ctx->teedev; + struct tee_device *teedev; bool do_release = false; + if (!shm || !shm->ctx || !shm->ctx->teedev) + return; + + teedev = shm->ctx->teedev; mutex_lock(&teedev->mutex); if (refcount_dec_and_test(&shm->refcount)) { /* -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] cpufreq: ACPI: Re-sync CPU boost state on system resume
by Lifeng Zheng 23 Sep '25

23 Sep '25

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICZ7F3 ---------------------------------------------------------------------- During CPU hotunplug events (such as those occurring during suspend/resume cycles), platform firmware may modify the CPU boost state. If boost was disabled prior to CPU removal, it correctly remains disabled upon re-plug. However, if firmware re-enables boost while the CPU is offline, the CPU may return with boost enabled—even if it was originally disabled—once it is hotplugged back in. This leads to inconsistent behavior and violates user or kernel policy expectations. To maintain consistency, ensure the boost state is re-synchronized with the kernel policy when a CPU is hotplugged back in. Note: This re-synchronization is not necessary during the initial call to ->init() for a CPU, as the cpufreq core handles it via cpufreq_online(). At that point, acpi_cpufreq_driver.boost_enabled is initialized to the value returned by boost_state(0). Lifeng Zheng (1): cpufreq: ACPI: Re-sync CPU boost state on system resume drivers/cpufreq/acpi-cpufreq.c | 7 +++++++ 1 file changed, 7 insertions(+) -- 2.33.0

2 2

[openeuler:OLK-6.6 2909/2909] mm/mem_sampling.c:35:1: sparse: sparse: symbol 'mem_sampling_record_cb_list' was not declared. Should it be static?
by kernel test robot 23 Sep '25

23 Sep '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a159deb279dfe156316d8c3957dc7f253686ff83 commit: cc5f4f44852f9eb4feb22a40cbb4e3d1b10c36a0 [2909/2909] mm_monitor/mm_spe: Add PMU based memory sampling abstract layer config: arm64-randconfig-r121-20250923 (https://download.01.org/0day-ci/archive/20250923/202509231035.kkQxDq6u-lkp@…) compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509231035.kkQxDq6u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509231035.kkQxDq6u-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/mem_sampling.c:35:1: sparse: sparse: symbol 'mem_sampling_record_cb_list' was not declared. Should it be static? >> mm/mem_sampling.c:37:6: sparse: sparse: symbol 'mem_sampling_record_cb_register' was not declared. Should it be static? >> mm/mem_sampling.c:54:6: sparse: sparse: symbol 'mem_sampling_record_cb_unregister' was not declared. Should it be static? mm/mem_sampling.c:67:6: sparse: sparse: symbol 'mem_sampling_process' was not declared. Should it be static? vim +/mem_sampling_record_cb_list +35 mm/mem_sampling.c 30 31 struct mem_sampling_record_cb_list_entry { 32 struct list_head list; 33 mem_sampling_record_cb_type cb; 34 }; > 35 LIST_HEAD(mem_sampling_record_cb_list); 36 > 37 void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) 38 { 39 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 40 41 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 42 if (cb_entry->cb == cb) 43 return; 44 } 45 46 cb_entry = kmalloc(sizeof(struct mem_sampling_record_cb_list_entry), GFP_KERNEL); 47 if (!cb_entry) 48 return; 49 50 cb_entry->cb = cb; 51 list_add(&(cb_entry->list), &mem_sampling_record_cb_list); 52 } 53 > 54 void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) 55 { 56 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 57 58 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 59 if (cb_entry->cb == cb) { 60 list_del(&cb_entry->list); 61 kfree(cb_entry); 62 return; 63 } 64 } 65 } 66 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] bpf: Fix memleak due to fentry attach failure
by Pu Lehui 23 Sep '25

23 Sep '25

From: Yafang Shao <laoar.shao(a)gmail.com> mainline inclusion from mainline-v6.5-rc1 commit 108598c39eefbedc9882273ac0df96127a629220 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4GX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms. This meamleak can be verified by a simple bpf program as follows: SEC("fentry/trap_init") int fentry_run() { return 0; } It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms. $ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=static $ echo $((6442453466 & 0x7fffffff)) 2522 Note that there are two left bpf trampoline images, that is because the libbpf will fallback to raw tracepoint if -EINVAL is returned. Fixes: e21aa341785c ("bpf: Fix fexit trampoline.") Signed-off-by: Yafang Shao <laoar.shao(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Song Liu <song(a)kernel.org> Cc: Jiri Olsa <olsajiri(a)gmail.com> Link: https://lore.kernel.org/bpf/20230515130849.57502-2-laoar.shao@gmail.com Conflicts: kernel/bpf/trampoline.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/trampoline.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index af9fea93b488..8c0c4cea89c3 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -153,11 +153,8 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total) return tprogs; } -static void __bpf_tramp_image_put_deferred(struct work_struct *work) +static void bpf_tramp_image_free(struct bpf_tramp_image *im) { - struct bpf_tramp_image *im; - - im = container_of(work, struct bpf_tramp_image, work); bpf_image_ksym_del(&im->ksym); bpf_jit_free_exec(im->image); bpf_jit_uncharge_modmem(1); @@ -165,6 +162,14 @@ static void __bpf_tramp_image_put_deferred(struct work_struct *work) kfree_rcu(im, rcu); } +static void __bpf_tramp_image_put_deferred(struct work_struct *work) +{ + struct bpf_tramp_image *im; + + im = container_of(work, struct bpf_tramp_image, work); + bpf_tramp_image_free(im); +} + /* callback, fexit step 3 or fentry step 2 */ static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu) { @@ -319,7 +324,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) &tr->func.model, flags, tprogs, tr->func.addr); if (err < 0) - goto out; + goto out_free; WARN_ON(tr->cur_image && tr->selector == 0); WARN_ON(!tr->cur_image && tr->selector); @@ -330,7 +335,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) /* first time registering */ err = register_fentry(tr, im->image); if (err) - goto out; + goto out_free; if (tr->cur_image) bpf_tramp_image_put(tr->cur_image); tr->cur_image = im; @@ -338,6 +343,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) out: kfree(tprogs); return err; + +out_free: + bpf_tramp_image_free(im); + goto out; } static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog) -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] blk-ioinf: introduce inflight-based IO QoS controller
by Baokun Li 23 Sep '25

23 Sep '25

Baokun Li (5): blk-ioinf: introduce inflight-based IO QoS controller blk-ioinf: add inflight/lat interface blk-ioinf: dynamically adjust inflight limit to balance workloads blk-ioinf: support percentile latency QoS for oneline workloads blk-ioinf: support per-online-cgroup weights for priority control block/Kconfig | 10 + block/Makefile | 1 + block/blk-ioinf.c | 1370 ++++++++++++++++++++++++++++++++++++++++ block/blk-mq-debugfs.c | 2 + block/blk-rq-qos.h | 1 + include/linux/blk-mq.h | 3 + 6 files changed, 1387 insertions(+) create mode 100644 block/blk-ioinf.c -- 2.46.1

2 6

[openeuler:OLK-6.6 2909/2909] net/oenetcls/oenetcls_flow.c:140:43: error: no member named 'rx_cpu_rmap' in 'struct net_device'
by kernel test robot 23 Sep '25

23 Sep '25

Hi Wang, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a159deb279dfe156316d8c3957dc7f253686ff83 commit: 22d4075bf5ef29ba4b329f954ac28a7de1d69a65 [2909/2909] net/oenetcls: remove oenetcls trace hook config: x86_64-randconfig-r123-20250923 (https://download.01.org/0day-ci/archive/20250923/202509230929.GGNlyoj3-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250923/202509230929.GGNlyoj3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509230929.GGNlyoj3-lkp@intel.com/ All errors (new ones prefixed by >>): net/oenetcls/oenetcls_flow.c:18:6: warning: no previous prototype for function 'is_oecls_config_netdev' [-Wmissing-prototypes] 18 | bool is_oecls_config_netdev(const char *name) | ^ net/oenetcls/oenetcls_flow.c:18:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 18 | bool is_oecls_config_netdev(const char *name) | ^ | static >> net/oenetcls/oenetcls_flow.c:140:43: error: no member named 'rx_cpu_rmap' in 'struct net_device' 140 | if (!skb_rx_queue_recorded(skb) || !dev->rx_cpu_rmap || | ~~~ ^ >> net/oenetcls/oenetcls_flow.c:161:24: error: no member named 'ndo_rx_flow_steer' in 'struct net_device_ops' 161 | rc = dev->netdev_ops->ndo_rx_flow_steer(dev, skb, rxq_index, flow_id); | ~~~~~~~~~~~~~~~ ^ 1 warning and 2 errors generated. vim +140 net/oenetcls/oenetcls_flow.c 4bed6ba0e88f50 Wang Liang 2025-08-26 17 4bed6ba0e88f50 Wang Liang 2025-08-26 @18 bool is_oecls_config_netdev(const char *name) 4bed6ba0e88f50 Wang Liang 2025-08-26 19 { 4bed6ba0e88f50 Wang Liang 2025-08-26 20 struct oecls_netdev_info *netdev_info; 4bed6ba0e88f50 Wang Liang 2025-08-26 21 int netdev_loop; 4bed6ba0e88f50 Wang Liang 2025-08-26 22 4bed6ba0e88f50 Wang Liang 2025-08-26 23 for_each_oecls_netdev(netdev_loop, netdev_info) 4bed6ba0e88f50 Wang Liang 2025-08-26 24 if (strcmp(netdev_info->dev_name, name) == 0) 4bed6ba0e88f50 Wang Liang 2025-08-26 25 return true; 4bed6ba0e88f50 Wang Liang 2025-08-26 26 4bed6ba0e88f50 Wang Liang 2025-08-26 27 return false; 4bed6ba0e88f50 Wang Liang 2025-08-26 28 } 4bed6ba0e88f50 Wang Liang 2025-08-26 29 22d4075bf5ef29 Wang Liang 2025-09-12 30 static bool _oecls_timeout(struct net_device *dev, u16 rxq_index, 22d4075bf5ef29 Wang Liang 2025-09-12 31 u32 flow_id, u16 filter_id) 4bed6ba0e88f50 Wang Liang 2025-08-26 32 { 4bed6ba0e88f50 Wang Liang 2025-08-26 33 struct netdev_rx_queue *rxqueue = dev->_rx + rxq_index; 4bed6ba0e88f50 Wang Liang 2025-08-26 34 struct oecls_dev_flow_table *flow_table; 4bed6ba0e88f50 Wang Liang 2025-08-26 35 struct oecls_dev_flow *rflow; 4bed6ba0e88f50 Wang Liang 2025-08-26 36 bool expire = true; 4bed6ba0e88f50 Wang Liang 2025-08-26 37 unsigned int cpu; 4bed6ba0e88f50 Wang Liang 2025-08-26 38 4bed6ba0e88f50 Wang Liang 2025-08-26 39 rcu_read_lock(); 4bed6ba0e88f50 Wang Liang 2025-08-26 40 flow_table = rcu_dereference(rxqueue->oecls_ftb); 4bed6ba0e88f50 Wang Liang 2025-08-26 41 if (flow_table && flow_id <= flow_table->mask) { 4bed6ba0e88f50 Wang Liang 2025-08-26 42 rflow = &flow_table->flows[flow_id]; 4bed6ba0e88f50 Wang Liang 2025-08-26 43 cpu = READ_ONCE(rflow->cpu); 4bed6ba0e88f50 Wang Liang 2025-08-26 44 oecls_debug("dev:%s, rxq:%d, flow_id:%u, filter_id:%d/%d, cpu:%d\n", dev->name, 4bed6ba0e88f50 Wang Liang 2025-08-26 45 rxq_index, flow_id, filter_id, rflow->filter, cpu); 4bed6ba0e88f50 Wang Liang 2025-08-26 46 4bed6ba0e88f50 Wang Liang 2025-08-26 47 if (rflow->filter == filter_id && cpu < nr_cpu_ids) { 4bed6ba0e88f50 Wang Liang 2025-08-26 48 if (time_before(jiffies, rflow->timeout + OECLS_TIMEOUT)) { 4bed6ba0e88f50 Wang Liang 2025-08-26 49 expire = false; 4bed6ba0e88f50 Wang Liang 2025-08-26 50 } else { 4bed6ba0e88f50 Wang Liang 2025-08-26 51 rflow->isvalid = 0; 4bed6ba0e88f50 Wang Liang 2025-08-26 52 WRITE_ONCE(rflow->cpu, OECLS_NO_CPU); 4bed6ba0e88f50 Wang Liang 2025-08-26 53 } 4bed6ba0e88f50 Wang Liang 2025-08-26 54 } 4bed6ba0e88f50 Wang Liang 2025-08-26 55 } 4bed6ba0e88f50 Wang Liang 2025-08-26 56 rcu_read_unlock(); 4bed6ba0e88f50 Wang Liang 2025-08-26 57 oecls_debug("%s, dev:%s, rxq:%d, flow_id:%u, filter_id:%d, expire:%d\n", __func__, 4bed6ba0e88f50 Wang Liang 2025-08-26 58 dev->name, rxq_index, flow_id, filter_id, expire); 22d4075bf5ef29 Wang Liang 2025-09-12 59 return expire; 4bed6ba0e88f50 Wang Liang 2025-08-26 60 } 4bed6ba0e88f50 Wang Liang 2025-08-26 61 22d4075bf5ef29 Wang Liang 2025-09-12 62 static void _oecls_flow_update(struct sock *sk) 4bed6ba0e88f50 Wang Liang 2025-08-26 63 { 4bed6ba0e88f50 Wang Liang 2025-08-26 64 struct oecls_sock_flow_table *tb; 4bed6ba0e88f50 Wang Liang 2025-08-26 65 unsigned int hash, index; 4bed6ba0e88f50 Wang Liang 2025-08-26 66 u32 val; 4bed6ba0e88f50 Wang Liang 2025-08-26 67 u32 cpu = raw_smp_processor_id(); 4bed6ba0e88f50 Wang Liang 2025-08-26 68 4bed6ba0e88f50 Wang Liang 2025-08-26 69 if (sk->sk_state != TCP_ESTABLISHED) 4bed6ba0e88f50 Wang Liang 2025-08-26 70 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 71 4bed6ba0e88f50 Wang Liang 2025-08-26 72 if (check_appname(current->comm)) 4bed6ba0e88f50 Wang Liang 2025-08-26 73 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 74 4bed6ba0e88f50 Wang Liang 2025-08-26 75 rcu_read_lock(); 4bed6ba0e88f50 Wang Liang 2025-08-26 76 tb = rcu_dereference(oecls_sock_flow_table); 4bed6ba0e88f50 Wang Liang 2025-08-26 77 hash = READ_ONCE(sk->sk_rxhash); 4bed6ba0e88f50 Wang Liang 2025-08-26 78 if (tb && hash) { 4bed6ba0e88f50 Wang Liang 2025-08-26 79 index = hash & tb->mask; 4bed6ba0e88f50 Wang Liang 2025-08-26 80 val = hash & ~oecls_cpu_mask; 4bed6ba0e88f50 Wang Liang 2025-08-26 81 val |= cpu; 4bed6ba0e88f50 Wang Liang 2025-08-26 82 4bed6ba0e88f50 Wang Liang 2025-08-26 83 if (READ_ONCE(tb->ents[index]) != val) { 4bed6ba0e88f50 Wang Liang 2025-08-26 84 WRITE_ONCE(tb->ents[index], val); 4bed6ba0e88f50 Wang Liang 2025-08-26 85 4bed6ba0e88f50 Wang Liang 2025-08-26 86 oecls_debug("[%s] sk:%p, hash:0x%x, index:0x%x, val:0x%x, cpu:%d\n", 4bed6ba0e88f50 Wang Liang 2025-08-26 87 current->comm, sk, hash, index, val, cpu); 4bed6ba0e88f50 Wang Liang 2025-08-26 88 } 4bed6ba0e88f50 Wang Liang 2025-08-26 89 } 4bed6ba0e88f50 Wang Liang 2025-08-26 90 rcu_read_unlock(); 4bed6ba0e88f50 Wang Liang 2025-08-26 91 } 4bed6ba0e88f50 Wang Liang 2025-08-26 92 4bed6ba0e88f50 Wang Liang 2025-08-26 93 static int flow_get_queue_idx(struct net_device *dev, int nid, struct sk_buff *skb) 4bed6ba0e88f50 Wang Liang 2025-08-26 94 { 4bed6ba0e88f50 Wang Liang 2025-08-26 95 struct oecls_netdev_info *netdev_info; 4bed6ba0e88f50 Wang Liang 2025-08-26 96 int netdev_loop; 4bed6ba0e88f50 Wang Liang 2025-08-26 97 u32 hash, index; 4bed6ba0e88f50 Wang Liang 2025-08-26 98 struct oecls_numa_info *numa_info; 4bed6ba0e88f50 Wang Liang 2025-08-26 99 struct oecls_numa_bound_dev_info *bound_dev = NULL; 4bed6ba0e88f50 Wang Liang 2025-08-26 100 int rxq_id, rxq_num, i; 4bed6ba0e88f50 Wang Liang 2025-08-26 101 4bed6ba0e88f50 Wang Liang 2025-08-26 102 numa_info = get_oecls_numa_info(nid); 4bed6ba0e88f50 Wang Liang 2025-08-26 103 if (!numa_info) 4bed6ba0e88f50 Wang Liang 2025-08-26 104 return -1; 4bed6ba0e88f50 Wang Liang 2025-08-26 105 4bed6ba0e88f50 Wang Liang 2025-08-26 106 for_each_oecls_netdev(netdev_loop, netdev_info) { 4bed6ba0e88f50 Wang Liang 2025-08-26 107 if (strcmp(netdev_info->dev_name, dev->name) == 0) { 4bed6ba0e88f50 Wang Liang 2025-08-26 108 bound_dev = &numa_info->bound_dev[netdev_loop]; 4bed6ba0e88f50 Wang Liang 2025-08-26 109 break; 4bed6ba0e88f50 Wang Liang 2025-08-26 110 } 4bed6ba0e88f50 Wang Liang 2025-08-26 111 } 4bed6ba0e88f50 Wang Liang 2025-08-26 112 4bed6ba0e88f50 Wang Liang 2025-08-26 113 if (!bound_dev) 4bed6ba0e88f50 Wang Liang 2025-08-26 114 return -1; 4bed6ba0e88f50 Wang Liang 2025-08-26 115 rxq_num = bitmap_weight(bound_dev->bitmap_rxq, OECLS_MAX_RXQ_NUM_PER_DEV); 4bed6ba0e88f50 Wang Liang 2025-08-26 116 if (rxq_num == 0) 4bed6ba0e88f50 Wang Liang 2025-08-26 117 return -1; 4bed6ba0e88f50 Wang Liang 2025-08-26 118 4bed6ba0e88f50 Wang Liang 2025-08-26 119 hash = skb_get_hash(skb); 4bed6ba0e88f50 Wang Liang 2025-08-26 120 index = hash % rxq_num; 4bed6ba0e88f50 Wang Liang 2025-08-26 121 4bed6ba0e88f50 Wang Liang 2025-08-26 122 i = 0; 4bed6ba0e88f50 Wang Liang 2025-08-26 123 for_each_set_bit(rxq_id, bound_dev->bitmap_rxq, OECLS_MAX_RXQ_NUM_PER_DEV) 4bed6ba0e88f50 Wang Liang 2025-08-26 124 if (index == i++) 4bed6ba0e88f50 Wang Liang 2025-08-26 125 return rxq_id; 4bed6ba0e88f50 Wang Liang 2025-08-26 126 4bed6ba0e88f50 Wang Liang 2025-08-26 127 return -1; 4bed6ba0e88f50 Wang Liang 2025-08-26 128 } 4bed6ba0e88f50 Wang Liang 2025-08-26 129 4bed6ba0e88f50 Wang Liang 2025-08-26 130 static void set_oecls_cpu(struct net_device *dev, struct sk_buff *skb, 4bed6ba0e88f50 Wang Liang 2025-08-26 131 struct oecls_dev_flow *old_rflow, int old_rxq_id, u16 next_cpu) 4bed6ba0e88f50 Wang Liang 2025-08-26 132 { 4bed6ba0e88f50 Wang Liang 2025-08-26 133 struct netdev_rx_queue *rxqueue; 4bed6ba0e88f50 Wang Liang 2025-08-26 134 struct oecls_dev_flow_table *dtb; 4bed6ba0e88f50 Wang Liang 2025-08-26 135 struct oecls_dev_flow *rflow; 4bed6ba0e88f50 Wang Liang 2025-08-26 136 u32 flow_id, hash; 4bed6ba0e88f50 Wang Liang 2025-08-26 137 u16 rxq_index; 4bed6ba0e88f50 Wang Liang 2025-08-26 138 int rc; 4bed6ba0e88f50 Wang Liang 2025-08-26 139 4bed6ba0e88f50 Wang Liang 2025-08-26 @140 if (!skb_rx_queue_recorded(skb) || !dev->rx_cpu_rmap || 4bed6ba0e88f50 Wang Liang 2025-08-26 141 !(dev->features & NETIF_F_NTUPLE)) 4bed6ba0e88f50 Wang Liang 2025-08-26 142 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 143 4bed6ba0e88f50 Wang Liang 2025-08-26 144 rxq_index = flow_get_queue_idx(dev, cpu_to_node(next_cpu), skb); 4bed6ba0e88f50 Wang Liang 2025-08-26 145 if (rxq_index == skb_get_rx_queue(skb) || rxq_index < 0) 4bed6ba0e88f50 Wang Liang 2025-08-26 146 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 147 4bed6ba0e88f50 Wang Liang 2025-08-26 148 rxqueue = dev->_rx + rxq_index; 4bed6ba0e88f50 Wang Liang 2025-08-26 149 dtb = rcu_dereference(rxqueue->oecls_ftb); 4bed6ba0e88f50 Wang Liang 2025-08-26 150 if (!dtb) 4bed6ba0e88f50 Wang Liang 2025-08-26 151 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 152 4bed6ba0e88f50 Wang Liang 2025-08-26 153 hash = skb_get_hash(skb); 4bed6ba0e88f50 Wang Liang 2025-08-26 154 flow_id = hash & dtb->mask; 4bed6ba0e88f50 Wang Liang 2025-08-26 155 rflow = &dtb->flows[flow_id]; 4bed6ba0e88f50 Wang Liang 2025-08-26 156 if (rflow->isvalid && rflow->cpu == next_cpu) { 4bed6ba0e88f50 Wang Liang 2025-08-26 157 rflow->timeout = jiffies; 4bed6ba0e88f50 Wang Liang 2025-08-26 158 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 159 } 4bed6ba0e88f50 Wang Liang 2025-08-26 160 4bed6ba0e88f50 Wang Liang 2025-08-26 @161 rc = dev->netdev_ops->ndo_rx_flow_steer(dev, skb, rxq_index, flow_id); 4bed6ba0e88f50 Wang Liang 2025-08-26 162 oecls_debug("skb:%p, rxq:%d, hash:0x%x, flow_id:%u, old_rxq_id:%d, next_cpu:%d, rc:%d\n", 4bed6ba0e88f50 Wang Liang 2025-08-26 163 skb, rxq_index, hash, flow_id, old_rxq_id, next_cpu, rc); 4bed6ba0e88f50 Wang Liang 2025-08-26 164 if (rc < 0) 4bed6ba0e88f50 Wang Liang 2025-08-26 165 return; 4bed6ba0e88f50 Wang Liang 2025-08-26 166 4bed6ba0e88f50 Wang Liang 2025-08-26 167 rflow->filter = rc; 4bed6ba0e88f50 Wang Liang 2025-08-26 168 rflow->isvalid = 1; 4bed6ba0e88f50 Wang Liang 2025-08-26 169 rflow->timeout = jiffies; 4bed6ba0e88f50 Wang Liang 2025-08-26 170 if (old_rflow->filter == rflow->filter) 4bed6ba0e88f50 Wang Liang 2025-08-26 171 old_rflow->filter = OECLS_NO_FILTER; 4bed6ba0e88f50 Wang Liang 2025-08-26 172 rflow->cpu = next_cpu; 4bed6ba0e88f50 Wang Liang 2025-08-26 173 } 4bed6ba0e88f50 Wang Liang 2025-08-26 174 :::::: The code at line 140 was first introduced by commit :::::: 4bed6ba0e88f50484fd5fb06bd993727b981b718 net/oenetcls: introduce oenetcls for network optimization :::::: TO: Wang Liang <wangliang74(a)huawei.com> :::::: CC: Wang Liang <wangliang74(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0