- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] parisc: Fix double SIGFPE crash
by Ye Bin 08 Jul '25

08 Jul '25

From: Helge Deller <deller(a)gmx.de> stable inclusion from stable-v6.6.90 commit 6a098c51d18ec99485668da44294565c43dbc106 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC9958 CVE: CVE-2025-37991 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit de3629baf5a33af1919dec7136d643b0662e85ef upstream. Camm noticed that on parisc a SIGFPE exception will crash an application with a second SIGFPE in the signal handler. Dave analyzed it, and it happens because glibc uses a double-word floating-point store to atomically update function descriptors. As a result of lazy binding, we hit a floating-point store in fpe_func almost immediately. When the T bit is set, an assist exception trap occurs when when the co-processor encounters *any* floating-point instruction except for a double store of register %fr0. The latter cancels all pending traps. Let's fix this by clearing the Trap (T) bit in the FP status register before returning to the signal handler in userspace. The issue can be reproduced with this test program: root@parisc:~# cat fpe.c static void fpe_func(int sig, siginfo_t *i, void *v) { sigset_t set; sigemptyset(&set); sigaddset(&set, SIGFPE); sigprocmask(SIG_UNBLOCK, &set, NULL); printf("GOT signal %d with si_code %ld\n", sig, i->si_code); } int main() { struct sigaction action = { .sa_sigaction = fpe_func, .sa_flags = SA_RESTART|SA_SIGINFO }; sigaction(SIGFPE, &action, 0); feenableexcept(FE_OVERFLOW); return printf("%lf\n",1.7976931348623158E308*1.7976931348623158E308); } root@parisc:~# gcc fpe.c -lm root@parisc:~# ./a.out Floating point exception root@parisc:~# strace -f ./a.out execve("./a.out", ["./a.out"], 0xf9ac7034 /* 20 vars */) = 0 getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0 ... rt_sigaction(SIGFPE, {sa_handler=0x1110a, sa_mask=[], sa_flags=SA_RESTART|SA_SIGINFO}, NULL, 8) = 0 --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0x1078f} --- --- SIGFPE {si_signo=SIGFPE, si_code=FPE_FLTOVF, si_addr=0xf8f21237} --- +++ killed by SIGFPE +++ Floating point exception Signed-off-by: Helge Deller <deller(a)gmx.de> Suggested-by: John David Anglin <dave.anglin(a)bell.net> Reported-by: Camm Maguire <camm(a)maguirefamily.org> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- arch/parisc/math-emu/driver.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/arch/parisc/math-emu/driver.c b/arch/parisc/math-emu/driver.c index 6ce427b58836..ecd27b48d61f 100644 --- a/arch/parisc/math-emu/driver.c +++ b/arch/parisc/math-emu/driver.c @@ -103,9 +103,19 @@ handle_fpe(struct pt_regs *regs) memcpy(regs->fr, frcopy, sizeof regs->fr); if (signalcode != 0) { - force_sig_fault(signalcode >> 24, signalcode & 0xffffff, - (void __user *) regs->iaoq[0]); - return -1; + int sig = signalcode >> 24; + + if (sig == SIGFPE) { + /* + * Clear floating point trap bit to avoid trapping + * again on the first floating-point instruction in + * the userspace signal handler. + */ + regs->fr[0] &= ~(1ULL << 38); + } + force_sig_fault(sig, signalcode & 0xffffff, + (void __user *) regs->iaoq[0]); + return -1; } return signalcode ? -1 : 0; -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amdkfd: Fix mode1 reset crash issue
by Ye Bin 08 Jul '25

08 Jul '25

From: Philip Yang <Philip.Yang(a)amd.com> stable inclusion from stable-v6.6.80 commit 89af6b39f028c130d4362f57042927f005423e6a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6M0E CVE: CVE-2025-37854 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f0b4440cdc1807bb6ec3dce0d6de81170803569b ] If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes. After process abort exit, user queues still use the GPU to access system memory before h/w is reset while KFD cleanup worker free system memory and free VRAM. There is use-after-free race bug that KFD allocate and reuse the freed system memory, and user queue write to the same system memory to corrupt the data structure and cause driver crash. To fix this race, KFD cleanup worker terminate user queues, then flush reset_domain wq to wait for any GPU ongoing reset complete, and then free outstanding BOs. Signed-off-by: Philip Yang <Philip.Yang(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Felix Kuehling <felix.kuehling(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c index 64346c71c62a..a6d08dee74f6 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c @@ -35,6 +35,7 @@ #include <linux/pm_runtime.h> #include "amdgpu_amdkfd.h" #include "amdgpu.h" +#include "amdgpu_reset.h" struct mm_struct; @@ -1110,6 +1111,17 @@ static void kfd_process_remove_sysfs(struct kfd_process *p) p->kobj = NULL; } +/* + * If any GPU is ongoing reset, wait for reset complete. + */ +static void kfd_process_wait_gpu_reset_complete(struct kfd_process *p) +{ + int i; + + for (i = 0; i < p->n_pdds; i++) + flush_workqueue(p->pdds[i]->dev->adev->reset_domain->wq); +} + /* No process locking is needed in this function, because the process * is not findable any more. We must assume that no other thread is * using it any more, otherwise we couldn't safely free the process @@ -1123,6 +1135,11 @@ static void kfd_process_wq_release(struct work_struct *work) kfd_process_dequeue_from_all_devices(p); pqm_uninit(&p->pqm); + /* + * If GPU in reset, user queues may still running, wait for reset complete. + */ + kfd_process_wait_gpu_reset_complete(p); + /* Signal the eviction fence after user mode queues are * destroyed. This allows any BOs to be freed without * triggering pointless evictions or waiting for fences. -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] fix CVE-2025-38118
by Ye Bin 08 Jul '25

08 Jul '25

Luiz Augusto von Dentz (2): Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete Bluetooth: MGMT: Fix sparse errors include/net/bluetooth/hci_core.h | 1 - net/bluetooth/hci_core.c | 4 +--- net/bluetooth/mgmt.c | 39 ++++++++++---------------------- 3 files changed, 13 insertions(+), 31 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset()
by Ye Bin 08 Jul '25

08 Jul '25

From: Tianyang Zhang <zhangtianyang(a)loongson.cn> stable inclusion from stable-v6.6.95 commit b427d98d55217b53c88643579fbbd8a4c351a105 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4OF CVE: CVE-2025-38195 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ee084fa96123ede8b0563a1b5a9b23adc43cd50d upstream. ERROR INFO: CPU 25 Unable to handle kernel paging request at virtual address 0x0 ... Call Trace: [<900000000023c30c>] huge_pte_offset+0x3c/0x58 [<900000000057fd4c>] hugetlb_follow_page_mask+0x74/0x438 [<900000000051fee8>] __get_user_pages+0xe0/0x4c8 [<9000000000522414>] faultin_page_range+0x84/0x380 [<9000000000564e8c>] madvise_vma_behavior+0x534/0xa48 [<900000000056689c>] do_madvise+0x1bc/0x3e8 [<9000000000566df4>] sys_madvise+0x24/0x38 [<90000000015b9e88>] do_syscall+0x78/0x98 [<9000000000221f18>] handle_syscall+0xb8/0x158 In some cases, pmd may be NULL and rely on NULL as the return value for processing, so it is necessary to determine this situation here. Cc: stable(a)vger.kernel.org Fixes: bd51834d1cf6 ("LoongArch: Return NULL from huge_pte_offset() for invalid PMD") Signed-off-by: Tianyang Zhang <zhangtianyang(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- arch/loongarch/mm/hugetlbpage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/mm/hugetlbpage.c b/arch/loongarch/mm/hugetlbpage.c index aca52c42e94e..fb09fb70661e 100644 --- a/arch/loongarch/mm/hugetlbpage.c +++ b/arch/loongarch/mm/hugetlbpage.c @@ -47,7 +47,8 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, pmd = pmd_offset(pud, addr); } } - return pmd_none(pmdp_get(pmd)) ? NULL : (pte_t *) pmd; + + return (!pmd || pmd_none(pmdp_get(pmd))) ? NULL : (pte_t *) pmd; } int pmd_huge(pmd_t pmd) -- 2.34.1

2 1

[PATCH OLK-6.6] fbcon: Make sure modelist not set on unregistered console
by Yifan Qiao 08 Jul '25

08 Jul '25

From: Kees Cook <kees(a)kernel.org> stable inclusion from stable-v6.6.95 commit 519ba75728ee8cd561dce25fc52a2ec5c47171dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4O9 CVE: CVE-2025-38198 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cedc1b63394a866bf8663a3e40f4546f1d28c8d8 ] It looks like attempting to write to the "store_modes" sysfs node will run afoul of unregistered consoles: UBSAN: array-index-out-of-bounds in drivers/video/fbdev/core/fbcon.c:122:28 index -1 is out of range for type 'fb_info *[32]' ... fbcon_info_from_console+0x192/0x1a0 drivers/video/fbdev/core/fbcon.c:122 fbcon_new_modelist+0xbf/0x2d0 drivers/video/fbdev/core/fbcon.c:3048 fb_new_modelist+0x328/0x440 drivers/video/fbdev/core/fbmem.c:673 store_modes+0x1c9/0x3e0 drivers/video/fbdev/core/fbsysfs.c:113 dev_attr_store+0x55/0x80 drivers/base/core.c:2439 static struct fb_info *fbcon_registered_fb[FB_MAX]; ... static signed char con2fb_map[MAX_NR_CONSOLES]; ... static struct fb_info *fbcon_info_from_console(int console) ... return fbcon_registered_fb[con2fb_map[console]]; If con2fb_map contains a -1 things go wrong here. Instead, return NULL, as callers of fbcon_info_from_console() are trying to compare against existing "info" pointers, so error handling should kick in correctly. Reported-by: syzbot+a7d4444e7b6e743572f7(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/679d0a8f.050a0220.163cdc.000c.GAE@google.com/ Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 405d587450ef..b46719b95a8a 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -115,9 +115,14 @@ static signed char con2fb_map_boot[MAX_NR_CONSOLES]; static struct fb_info *fbcon_info_from_console(int console) { + signed char fb; WARN_CONSOLE_UNLOCKED(); - return fbcon_registered_fb[con2fb_map[console]]; + fb = con2fb_map[console]; + if (fb < 0 || fb >= ARRAY_SIZE(fbcon_registered_fb)) + return NULL; + + return fbcon_registered_fb[fb]; } static int logo_lines; -- 2.39.2

2 1

[PATCH OLK-5.10 00/12] RDMA/hns: Stability and Security Fixes and Improvements
by huangdonghua 08 Jul '25

08 Jul '25

Fixes issues such as memory leaks, invalid access, information leakage, and parameter errors. Improves parameter validation and resource initialization to enhance driver stability and security. Chengchang Tang (1): RDMA/hns: Fix accessing invalid dip_ctx during destroying QP Junxian Huang (7): RDMA/hns: Add check between dca_min_size and dca_max_size RDMA/hns: Fix accessing uninitialized resources RDMA/hns: Fix poe memory leak in error flow RDMA/hns: Fix descriptions of stars api RDMA/hns: Fix divide-by-zero error in dca debugfs RDMA/hns: Use __free_page() to free pages allocated with alloc_page() RDMA/hns: Fix unmatched condition in error flow Yuyu Li (2): RDMA/hns: Fix congestion control algorithm parameter range RDMA/hns: Fix scc_param failed logic judgments wenglianfa (2): RDMA/hns: Fix address information leakage of DCA memory RDMA/hns: Fix double destruction of rsv_qp drivers/infiniband/hw/hns/hns_roce_dca.c | 5 +-- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 7 ++++ drivers/infiniband/hw/hns/hns_roce_device.h | 2 ++ drivers/infiniband/hw/hns/hns_roce_ext.h | 22 ++++++++++++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 34 ++++++++++++-------- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 22 +++++++++---- drivers/infiniband/hw/hns/hns_roce_main.c | 20 ++++-------- drivers/infiniband/hw/hns/hns_roce_qp.c | 2 ++ drivers/infiniband/hw/hns/hns_roce_sysfs.c | 3 +- 9 files changed, 79 insertions(+), 38 deletions(-) -- 2.33.0

2 13

[PATCH OLK-6.6 0/2] CVE-2025-37842
by Gu Bowen 08 Jul '25

08 Jul '25

Fix CVE-2025-37842. Han Xu (1): spi: fsl-qspi: use devm function instead of driver remove Kevin Hao (1): spi: fsl-qspi: Fix double cleanup in probe error path drivers/spi/spi-fsl-qspi.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/6] net: Fix CVE-2025-38000
by Dong Chenchen 08 Jul '25

08 Jul '25

Fix CVE-2025-38000 Cong Wang (4): sch_drr: make drr_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_qfq: make qfq_qlen_notify() idempotent sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() Dong Chenchen (1): sch_cbq: make cbq_qlen_notify() idempotent Lion Ackermann (1): net/sched: Always pass notifications when child class becomes empty net/sched/sch_api.c | 19 +++++-------------- net/sched/sch_cbq.c | 3 ++- net/sched/sch_drr.c | 7 ++++--- net/sched/sch_hfsc.c | 14 +++++++++----- net/sched/sch_qfq.c | 7 +++++-- 5 files changed, 25 insertions(+), 25 deletions(-) -- 2.25.1

2 7

[openeuler:OLK-6.6 2467/2467] drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_probe.c:549:5: error: no previous prototype for 'sss_pci_probe'
by kernel test robot 08 Jul '25

08 Jul '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6b0fae63a73913be2bf981e780e69590ccb489ed commit: 1ff5e78839ab1038757ebfd00f0a26ae53e64bda [2467/2467] improve 3SNIC 910/920/930 NIC driver config: x86_64-randconfig-102-20250706 (https://download.01.org/0day-ci/archive/20250708/202507080923.Gxei1X4A-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250708/202507080923.Gxei1X4A-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507080923.Gxei1X4A-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_probe.c:277:5: error: no previous prototype for 'sss_attach_uld_driver' [-Werror=missing-prototypes] 277 | int sss_attach_uld_driver(struct sss_pci_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_probe.c:549:5: error: no previous prototype for 'sss_pci_probe' [-Werror=missing-prototypes] 549 | int sss_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) | ^~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_remove.c:91:6: error: no previous prototype for 'sss_detach_uld_driver' [-Werror=missing-prototypes] 91 | void sss_detach_uld_driver(struct sss_pci_adapter *adapter, | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_remove.c:121:6: error: no previous prototype for 'sss_detach_all_uld_driver' [-Werror=missing-prototypes] 121 | void sss_detach_all_uld_driver(struct sss_pci_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_remove.c:139:6: error: no previous prototype for 'sss_dettach_uld_dev' [-Werror=missing-prototypes] 139 | void sss_dettach_uld_dev(struct sss_pci_adapter *adapter) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_remove.c:180:6: error: no previous prototype for 'sss_deinit_function' [-Werror=missing-prototypes] 180 | void sss_deinit_function(struct pci_dev *pdev) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_remove.c:201:6: error: no previous prototype for 'sss_unmap_pci_bar' [-Werror=missing-prototypes] 201 | void sss_unmap_pci_bar(struct sss_pci_adapter *adapter) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_remove.c:212:5: error: no previous prototype for 'sss_deinit_adapter' [-Werror=missing-prototypes] 212 | int sss_deinit_adapter(struct sss_pci_adapter *adapter) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_remove.c:238:6: error: no previous prototype for 'sss_deinit_pci_dev' [-Werror=missing-prototypes] 238 | void sss_deinit_pci_dev(struct pci_dev *pdev) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_remove.c:250:6: error: no previous prototype for 'sss_pci_remove' [-Werror=missing-prototypes] 250 | void sss_pci_remove(struct pci_dev *pdev) | ^~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_shutdown.c:28:6: error: no previous prototype for 'sss_pci_shutdown' [-Werror=missing-prototypes] 28 | void sss_pci_shutdown(struct pci_dev *pdev) | ^~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_error.c:34:18: error: no previous prototype for 'sss_detect_pci_error' [-Werror=missing-prototypes] 34 | pci_ers_result_t sss_detect_pci_error(struct pci_dev *pdev, | ^~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_global.c:37:6: error: no previous prototype for 'sss_init_uld_lock' [-Werror=missing-prototypes] 37 | void sss_init_uld_lock(void) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_global.c:42:6: error: no previous prototype for 'sss_lock_uld' [-Werror=missing-prototypes] 42 | void sss_lock_uld(void) | ^~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_global.c:47:6: error: no previous prototype for 'sss_unlock_uld' [-Werror=missing-prototypes] 47 | void sss_unlock_uld(void) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_global.c:52:14: error: no previous prototype for 'sss_get_uld_names' [-Werror=missing-prototypes] 52 | const char **sss_get_uld_names(void) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_global.c:57:22: error: no previous prototype for 'sss_get_uld_info' [-Werror=missing-prototypes] 57 | struct sss_uld_info *sss_get_uld_info(void) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_global.c:62:6: error: no previous prototype for 'sss_attach_is_enable' [-Werror=missing-prototypes] 62 | bool sss_attach_is_enable(void) | ^~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c: In function 'sss_heartbeat_lost_handler': >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c:185:13: error: variable 'pcie_src' set but not used [-Werror=unused-but-set-variable] 185 | u16 pcie_src; | ^~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c:184:13: error: variable 'fault_level' set but not used [-Werror=unused-but-set-variable] 184 | u16 fault_level; | ^~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c: At top level: >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c:384:5: error: no previous prototype for 'sss_init_hwdev' [-Werror=missing-prototypes] 384 | int sss_init_hwdev(struct sss_pci_adapter *adapter) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c:487:6: error: no previous prototype for 'sss_deinit_hwdev' [-Werror=missing-prototypes] 487 | void sss_deinit_hwdev(void *hwdev) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c:518:6: error: no previous prototype for 'sss_hwdev_stop' [-Werror=missing-prototypes] 518 | void sss_hwdev_stop(void *hwdev) | ^~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c:531:6: error: no previous prototype for 'sss_hwdev_detach' [-Werror=missing-prototypes] 531 | void sss_hwdev_detach(void *hwdev) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_init.c:539:6: error: no previous prototype for 'sss_hwdev_shutdown' [-Werror=missing-prototypes] 539 | void sss_hwdev_shutdown(void *hwdev) | ^~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_mgmt_info.c:54:5: error: no previous prototype for 'sss_init_mgmt_info' [-Werror=missing-prototypes] 54 | int sss_init_mgmt_info(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_mgmt_info.c:90:6: error: no previous prototype for 'sss_deinit_mgmt_info' [-Werror=missing-prototypes] 90 | void sss_deinit_mgmt_info(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwdev_io_flush.c:91:5: error: no previous prototype for 'sss_hwdev_flush_io' [-Werror=missing-prototypes] 91 | int sss_hwdev_flush_io(struct sss_hwdev *hwdev, u16 channel) | ^~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_ctrlq_init.c:278:5: error: no previous prototype for 'sss_reinit_ctrlq_ctx' [-Werror=missing-prototypes] 278 | int sss_reinit_ctrlq_ctx(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_ctrlq_init.c:368:6: error: no previous prototype for 'sss_deinit_ctrlq' [-Werror=missing-prototypes] 368 | void sss_deinit_ctrlq(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_ctrlq_init.c:502:5: error: no previous prototype for 'sss_init_ctrlq_channel' [-Werror=missing-prototypes] 502 | int sss_init_ctrlq_channel(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_ctrlq_init.c:539:6: error: no previous prototype for 'sss_deinit_ctrlq_channel' [-Werror=missing-prototypes] 539 | void sss_deinit_ctrlq_channel(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_ctrlq_init.c:548:6: error: no previous prototype for 'sss_ctrlq_flush_sync_cmd' [-Werror=missing-prototypes] 548 | void sss_ctrlq_flush_sync_cmd(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_ctrlq_init.c:574:5: error: no previous prototype for 'sss_wait_ctrlq_stop' [-Werror=missing-prototypes] 574 | int sss_wait_ctrlq_stop(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_mbx_init.c:252:5: error: no previous prototype for 'sss_init_func_mbx_msg' [-Werror=missing-prototypes] 252 | int sss_init_func_mbx_msg(void *hwdev, u16 func_num) | ^~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_mbx_init.c:401:5: error: no previous prototype for 'sss_hwif_init_mbx' [-Werror=missing-prototypes] 401 | int sss_hwif_init_mbx(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_mbx_init.c:449:6: error: no previous prototype for 'sss_hwif_deinit_mbx' [-Werror=missing-prototypes] 449 | void sss_hwif_deinit_mbx(struct sss_hwdev *hwdev) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_mbx_init.c:872:6: error: no previous prototype for 'sss_recv_mbx_aeq_handler' [-Werror=missing-prototypes] 872 | void sss_recv_mbx_aeq_handler(void *handle, u8 *header, u8 size) | ^~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_adm.c:544:5: error: no previous prototype for 'sss_adm_msg_write' [-Werror=missing-prototypes] 544 | int sss_adm_msg_write(struct sss_adm_msg *adm_msg, u8 node_id, | ^~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_adm.c:550:5: error: no previous prototype for 'sss_adm_msg_read' [-Werror=missing-prototypes] 550 | int sss_adm_msg_read(struct sss_adm_msg *adm_msg, u8 node_id, | ^~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_adm.c:596:5: error: no previous prototype for 'sss_adm_msg_read_ack' [-Werror=missing-prototypes] 596 | int sss_adm_msg_read_ack(void *hwdev, u8 dest, const void *cmd, | ^~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_adm.c:617:5: error: no previous prototype for 'sss_adm_msg_write_nack' [-Werror=missing-prototypes] 617 | int sss_adm_msg_write_nack(void *hwdev, u8 dest, const void *cmd, u16 size) | ^~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_hwif_adm.c:681:5: error: no previous prototype for 'sss_sync_send_adm_msg' [-Werror=missing-prototypes] 681 | int sss_sync_send_adm_msg(void *hwdev, u8 mod, u16 cmd, void *buf_in, | ^~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors .. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ACPI_HOTPLUG_IGNORE_OSC Depends on [n]: ACPI [=y] && ACPI_HOTPLUG_PRESENT_CPU [=n] Selected by [y]: - X86 [=y] && ACPI [=y] && HOTPLUG_CPU [=y] vim +/sss_pci_probe +549 drivers/net/ethernet/3snic/sssnic/nic/../hw/sss_pci_probe.c 6864d14bb90f03a weiwei1 2024-04-09 548 6864d14bb90f03a weiwei1 2024-04-09 @549 int sss_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) :::::: The code at line 549 was first introduced by commit :::::: 6864d14bb90f03a1e5b7fbcc04fc2ba4d692bd3e support 3SNIC 910/920/930 NIC :::::: TO: weiwei1 <weiwei1(a)ramaxel.com> :::::: CC: weiwei1 <weiwei1(a)ramaxel.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
by Liu Chuang 08 Jul '25

08 Jul '25

From: Hou Tao <houtao1(a)huawei.com> stable inclusion from stable-v6.6.95 commit 7bf4461f1c97207fda757014690d55a447ce859f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4OG CVE: CVE-2025-38202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d4965578267e2e81f67c86e2608481e77e9c8569 ] bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpf_map_lookup_percpu_elem() will not be inlined. Using it in a sleepable bpf program will trigger the warning in bpf_map_lookup_percpu_elem(), because the bpf program only holds rcu_read_lock_trace lock. Therefore, add the missed check. Reported-by: syzbot+dce5aae19ae4d6399986(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/bpf/000000000000176a130617420310@google.com/ Signed-off-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/20250526062534.1105938-1-houtao@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- kernel/bpf/helpers.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 140097c8198e..643d2bf15c20 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -128,7 +128,8 @@ const struct bpf_func_proto bpf_map_peek_elem_proto = { BPF_CALL_3(bpf_map_lookup_percpu_elem, struct bpf_map *, map, void *, key, u32, cpu) { - WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_bh_held()); + WARN_ON_ONCE(!rcu_read_lock_held() && !rcu_read_lock_trace_held() && + !rcu_read_lock_bh_held()); return (unsigned long) map->ops->map_lookup_percpu_elem(map, key, cpu); } -- 2.34.1

2 1