- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3479/3479] drivers/ub/urma/ubcore/ubcore_connect_adapter.c:190:1: warning: no previous prototype for 'ubcore_find_remove_ex_tp_info'
by kernel test robot 05 Dec '25

05 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f9a278cf61499e631038cf7d7847bb990cf89d7e commit: cd3e93f2a6d3bba9ff616fb065a943877d3d7894 [3479/3479] urma: implement ubcore basic connection and bonding support config: arm64-randconfig-r061-20251205 (https://download.01.org/0day-ci/archive/20251205/202512051530.omM8ItZN-lkp@…) compiler: aarch64-linux-gcc (GCC) 9.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251205/202512051530.omM8ItZN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512051530.omM8ItZN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/urma/ubcore/ubcore_connect_adapter.c:190:1: warning: no previous prototype for 'ubcore_find_remove_ex_tp_info' [-Wmissing-prototypes] 190 | ubcore_find_remove_ex_tp_info(struct ubcore_device *dev, uint64_t tp_handle) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] vim +/ubcore_find_remove_ex_tp_info +190 drivers/ub/urma/ubcore/ubcore_connect_adapter.c 188 189 struct ubcore_ex_tp_info * > 190 ubcore_find_remove_ex_tp_info(struct ubcore_device *dev, uint64_t tp_handle) 191 { 192 struct ubcore_ex_tp_info *ex_tp_info = NULL; 193 uint32_t hash; 194 195 hash = ubcore_get_ex_tp_hash(&tp_handle); 196 spin_lock(&dev->ht[UBCORE_HT_EX_TP].lock); 197 if (dev->ht[UBCORE_HT_EX_TP].head == NULL) { 198 spin_unlock(&dev->ht[UBCORE_HT_EX_TP].lock); 199 return NULL; 200 } 201 202 ex_tp_info = ubcore_hash_table_lookup_nolock(&dev->ht[UBCORE_HT_EX_TP], 203 hash, &tp_handle); 204 if (ex_tp_info == NULL) { 205 spin_unlock(&dev->ht[UBCORE_HT_EX_TP].lock); 206 ubcore_log_warn("Failed to find ex_tp_info, tp_handle: %llu.\n", 207 tp_handle); 208 return NULL; 209 } 210 ubcore_hash_table_remove_nolock(&dev->ht[UBCORE_HT_EX_TP], 211 &ex_tp_info->hnode); 212 spin_unlock(&dev->ht[UBCORE_HT_EX_TP].lock); 213 214 return ex_tp_info; 215 } 216 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3479/3479] include/linux/mmzone.h:1788:2: error: Allocator MAX_ORDER exceeds SECTION_SIZE
by kernel test robot 05 Dec '25

05 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f9a278cf61499e631038cf7d7847bb990cf89d7e commit: c93eb12529e21dbb59796132f4fdf75fad4eddaf [3479/3479] LoongArch: Adapted SECTION_SIZE_BITS with page size config: loongarch-randconfig-001-20251205 (https://download.01.org/0day-ci/archive/20251205/202512051233.eoZixxMi-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d8b43edf552840e59a22a7f3cc332697bd434782) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251205/202512051233.eoZixxMi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512051233.eoZixxMi-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:7: In file included from include/linux/gfp.h:7: >> include/linux/mmzone.h:1788:2: error: Allocator MAX_ORDER exceeds SECTION_SIZE 1788 | #error Allocator MAX_ORDER exceeds SECTION_SIZE | ^ In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:1100: In file included from include/linux/huge_mm.h:8: In file included from include/linux/fs.h:33: In file included from include/linux/percpu-rwsem.h:7: In file included from include/linux/rcuwait.h:6: In file included from include/linux/sched/signal.h:6: include/linux/signal.h:97:11: warning: array index 3 is past the end of the array (that has type 'unsigned long[1]') [-Warray-bounds] 97 | return (set->sig[3] | set->sig[2] | | ^ ~ include/uapi/asm-generic/signal.h:62:2: note: array 'sig' declared here 62 | unsigned long sig[_NSIG_WORDS]; | ^ In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:1100: In file included from include/linux/huge_mm.h:8: In file included from include/linux/fs.h:33: In file included from include/linux/percpu-rwsem.h:7: In file included from include/linux/rcuwait.h:6: In file included from include/linux/sched/signal.h:6: include/linux/signal.h:97:25: warning: array index 2 is past the end of the array (that has type 'unsigned long[1]') [-Warray-bounds] 97 | return (set->sig[3] | set->sig[2] | | ^ ~ include/uapi/asm-generic/signal.h:62:2: note: array 'sig' declared here 62 | unsigned long sig[_NSIG_WORDS]; | ^ In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:1100: In file included from include/linux/huge_mm.h:8: In file included from include/linux/fs.h:33: In file included from include/linux/percpu-rwsem.h:7: In file included from include/linux/rcuwait.h:6: In file included from include/linux/sched/signal.h:6: include/linux/signal.h:98:4: warning: array index 1 is past the end of the array (that has type 'unsigned long[1]') [-Warray-bounds] 98 | set->sig[1] | set->sig[0]) == 0; | ^ ~ include/uapi/asm-generic/signal.h:62:2: note: array 'sig' declared here 62 | unsigned long sig[_NSIG_WORDS]; | ^ In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:1100: In file included from include/linux/huge_mm.h:8: In file included from include/linux/fs.h:33: In file included from include/linux/percpu-rwsem.h:7: In file included from include/linux/rcuwait.h:6: In file included from include/linux/sched/signal.h:6: include/linux/signal.h:100:11: warning: array index 1 is past the end of the array (that has type 'unsigned long[1]') [-Warray-bounds] 100 | return (set->sig[1] | set->sig[0]) == 0; | ^ ~ include/uapi/asm-generic/signal.h:62:2: note: array 'sig' declared here 62 | unsigned long sig[_NSIG_WORDS]; | ^ In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:1100: In file included from include/linux/huge_mm.h:8: In file included from include/linux/fs.h:33: In file included from include/linux/percpu-rwsem.h:7: In file included from include/linux/rcuwait.h:6: In file included from include/linux/sched/signal.h:6: include/linux/signal.h:113:11: warning: array index 3 is past the end of the array (that has type 'const unsigned long[1]') [-Warray-bounds] 113 | return (set1->sig[3] == set2->sig[3]) && | ^ ~ include/uapi/asm-generic/signal.h:62:2: note: array 'sig' declared here 62 | unsigned long sig[_NSIG_WORDS]; | ^ In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:1100: In file included from include/linux/huge_mm.h:8: In file included from include/linux/fs.h:33: In file included from include/linux/percpu-rwsem.h:7: In file included from include/linux/rcuwait.h:6: In file included from include/linux/sched/signal.h:6: include/linux/signal.h:113:27: warning: array index 3 is past the end of the array (that has type 'const unsigned long[1]') [-Warray-bounds] 113 | return (set1->sig[3] == set2->sig[3]) && | ^ ~ include/uapi/asm-generic/signal.h:62:2: note: array 'sig' declared here 62 | unsigned long sig[_NSIG_WORDS]; | ^ In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:1100: In file included from include/linux/huge_mm.h:8: In file included from include/linux/fs.h:33: In file included from include/linux/percpu-rwsem.h:7: In file included from include/linux/rcuwait.h:6: In file included from include/linux/sched/signal.h:6: include/linux/signal.h:114:5: warning: array index 2 is past the end of the array (that has type 'const unsigned long[1]') [-Warray-bounds] 114 | (set1->sig[2] == set2->sig[2]) && | ^ ~ include/uapi/asm-generic/signal.h:62:2: note: array 'sig' declared here 62 | unsigned long sig[_NSIG_WORDS]; | ^ In file included from arch/loongarch/kernel/asm-offsets.c:9: In file included from include/linux/mm.h:1100: In file included from include/linux/huge_mm.h:8: In file included from include/linux/fs.h:33: In file included from include/linux/percpu-rwsem.h:7: In file included from include/linux/rcuwait.h:6: In file included from include/linux/sched/signal.h:6: vim +1788 include/linux/mmzone.h d41dee369bff3b Andy Whitcroft 2005-06-23 1783 835c134ec4dd75 Mel Gorman 2007-10-16 1784 #define SECTION_BLOCKFLAGS_BITS \ d9c2340052278d Mel Gorman 2007-10-16 1785 ((1UL << (PFN_SECTION_SHIFT - pageblock_order)) * NR_PAGEBLOCK_BITS) 835c134ec4dd75 Mel Gorman 2007-10-16 1786 23baf831a32c04 Kirill A. Shutemov 2023-03-15 1787 #if (MAX_ORDER + PAGE_SHIFT) > SECTION_SIZE_BITS d41dee369bff3b Andy Whitcroft 2005-06-23 @1788 #error Allocator MAX_ORDER exceeds SECTION_SIZE d41dee369bff3b Andy Whitcroft 2005-06-23 1789 #endif d41dee369bff3b Andy Whitcroft 2005-06-23 1790 :::::: The code at line 1788 was first introduced by commit :::::: d41dee369bff3b9dcb6328d4d822926c28cc2594 [PATCH] sparsemem memory model :::::: TO: Andy Whitcroft <apw(a)shadowen.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] Fix some memory policy bugfix
by Ze Zuo 05 Dec '25

05 Dec '25

Fix bugfix due to merge some mainline memory policy patch. Ze Zuo (2): mempolicy: fix missing mmap_read_unlock() in error path mempolicy: restrict smart grid scheduling to vma_alloc_folio path include/linux/gfp.h | 13 +++++++++---- mm/mempolicy.c | 36 ++++++++++++++++++++++++------------ 2 files changed, 33 insertions(+), 16 deletions(-) -- 2.25.1

2 3

openEuler Kernel SIG双周例会
by openEuler conference 05 Dec '25

05 Dec '25

您好！ Kernel 邀请您参加 2025-12-05 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（可回复本邮件申请，或填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/964469206 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-12-05 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 1. 进展update 2. 议题征集中（可回复本邮件申请，或填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/964469206 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[openeuler:OLK-6.6 3479/3479] include/linux/mmzone.h:1788:2: error: #error Allocator MAX_ORDER exceeds SECTION_SIZE
by kernel test robot 05 Dec '25

05 Dec '25

Hi zhangtianyang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f9a278cf61499e631038cf7d7847bb990cf89d7e commit: c93eb12529e21dbb59796132f4fdf75fad4eddaf [3479/3479] LoongArch: Adapted SECTION_SIZE_BITS with page size config: loongarch-randconfig-002-20251205 (https://download.01.org/0day-ci/archive/20251205/202512051112.JRlvwQmR-lkp@…) compiler: loongarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251205/202512051112.JRlvwQmR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512051112.JRlvwQmR-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/linux/gfp.h:7, from include/linux/mm.h:7, from arch/loongarch/kernel/asm-offsets.c:9: >> include/linux/mmzone.h:1788:2: error: #error Allocator MAX_ORDER exceeds SECTION_SIZE 1788 | #error Allocator MAX_ORDER exceeds SECTION_SIZE | ^~~~~ arch/loongarch/kernel/asm-offsets.c:18:6: warning: no previous prototype for 'output_ptreg_defines' [-Wmissing-prototypes] 18 | void output_ptreg_defines(void) | ^~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:65:6: warning: no previous prototype for 'output_task_defines' [-Wmissing-prototypes] 65 | void output_task_defines(void) | ^~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:80:6: warning: no previous prototype for 'output_thread_info_defines' [-Wmissing-prototypes] 80 | void output_thread_info_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:96:6: warning: no previous prototype for 'output_thread_defines' [-Wmissing-prototypes] 96 | void output_thread_defines(void) | ^~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:132:6: warning: no previous prototype for 'output_thread_fpu_defines' [-Wmissing-prototypes] 132 | void output_thread_fpu_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:173:6: warning: no previous prototype for 'output_thread_lbt_defines' [-Wmissing-prototypes] 173 | void output_thread_lbt_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:183:6: warning: no previous prototype for 'output_mm_defines' [-Wmissing-prototypes] 183 | void output_mm_defines(void) | ^~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:215:6: warning: no previous prototype for 'output_sc_defines' [-Wmissing-prototypes] 215 | void output_sc_defines(void) | ^~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:223:6: warning: no previous prototype for 'output_signal_defines' [-Wmissing-prototypes] 223 | void output_signal_defines(void) | ^~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:261:6: warning: no previous prototype for 'output_smpboot_defines' [-Wmissing-prototypes] 261 | void output_smpboot_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:283:6: warning: no previous prototype for 'output_fgraph_ret_regs_defines' [-Wmissing-prototypes] 283 | void output_fgraph_ret_regs_defines(void) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/loongarch/kernel/asm-offsets.c:294:6: warning: no previous prototype for 'output_kvm_defines' [-Wmissing-prototypes] 294 | void output_kvm_defines(void) | ^~~~~~~~~~~~~~~~~~ make[3]: *** [scripts/Makefile.build:116: arch/loongarch/kernel/asm-offsets.s] Error 1 shuffle=3414368292 make[3]: Target 'prepare' not remade because of errors. make[2]: *** [Makefile:1202: prepare0] Error 2 shuffle=3414368292 make[2]: Target 'prepare' not remade because of errors. make[1]: *** [Makefile:234: __sub-make] Error 2 shuffle=3414368292 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:234: __sub-make] Error 2 shuffle=3414368292 make: Target 'prepare' not remade because of errors. vim +1788 include/linux/mmzone.h d41dee369bff3b Andy Whitcroft 2005-06-23 1783 835c134ec4dd75 Mel Gorman 2007-10-16 1784 #define SECTION_BLOCKFLAGS_BITS \ d9c2340052278d Mel Gorman 2007-10-16 1785 ((1UL << (PFN_SECTION_SHIFT - pageblock_order)) * NR_PAGEBLOCK_BITS) 835c134ec4dd75 Mel Gorman 2007-10-16 1786 23baf831a32c04 Kirill A. Shutemov 2023-03-15 1787 #if (MAX_ORDER + PAGE_SHIFT) > SECTION_SIZE_BITS d41dee369bff3b Andy Whitcroft 2005-06-23 @1788 #error Allocator MAX_ORDER exceeds SECTION_SIZE d41dee369bff3b Andy Whitcroft 2005-06-23 1789 #endif d41dee369bff3b Andy Whitcroft 2005-06-23 1790 :::::: The code at line 1788 was first introduced by commit :::::: d41dee369bff3b9dcb6328d4d822926c28cc2594 [PATCH] sparsemem memory model :::::: TO: Andy Whitcroft <apw(a)shadowen.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] mainline patch backport
by Xinyu Zheng 05 Dec '25

05 Dec '25

Catalin Marinas (1): arm64: mte: Do not flag the zero page as PG_mte_tagged Kaushlendra Kumar (1): ACPI: button: Call input_free_device() on failing input device registration Pin-yen Lin (1): PM: sleep: Do not wait on SYNC_STATE_ONLY device links Yipeng Zou (1): timers: Fix NULL function pointer race in timer_shutdown_sync() arch/arm64/kernel/cpufeature.c | 10 +++++++--- arch/arm64/kernel/mte.c | 3 ++- drivers/acpi/button.c | 4 +++- drivers/base/base.h | 1 + drivers/base/core.c | 2 +- drivers/base/power/main.c | 6 ++++-- kernel/time/timer.c | 7 ++++--- 7 files changed, 22 insertions(+), 11 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/2] mainline patch backport
by Xinyu Zheng 05 Dec '25

05 Dec '25

Catalin Marinas (1): arm64: mte: Do not flag the zero page as PG_mte_tagged Yipeng Zou (1): timers: Fix NULL function pointer race in timer_shutdown_sync() arch/arm64/kernel/cpufeature.c | 10 ++++++++-- arch/arm64/kernel/mte.c | 3 ++- kernel/time/timer.c | 7 ++++--- 3 files changed, 14 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] mainline patch backport
by Xinyu Zheng 05 Dec '25

05 Dec '25

Catalin Marinas (1): arm64: mte: Do not flag the zero page as PG_mte_tagged Yipeng Zou (1): timers: Fix NULL function pointer race in timer_shutdown_sync() arch/arm64/kernel/cpufeature.c | 10 ++++++++-- arch/arm64/kernel/mte.c | 3 ++- kernel/time/timer.c | 7 ++++--- 3 files changed, 14 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[openeuler:OLK-5.10 3345/3345] drivers/net/ethernet/yusur/k2/../platform/ys_intr.c:113:40: warning: non-overlapping comparisons always evaluate to false
by kernel test robot 05 Dec '25

05 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 94c9d29e871d7af205d35228eec92d863bbb7444 commit: c92533ad657c0a5d1a7a6355ef2c357cbb91d5c0 [3345/3345] drivers: initial support for KPU FLEXFLOW-2100P driver from Yusur Technology config: x86_64-allmodconfig (https://download.01.org/0day-ci/archive/20251205/202512050401.bWD2A9JO-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project b3428bb966f1de8aa48375ffee0eba04ede133b7) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251205/202512050401.bWD2A9JO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512050401.bWD2A9JO-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from <built-in>:2: In file included from include/linux/compiler_types.h:69: include/linux/compiler-clang.h:34:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 34 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:353:9: note: previous definition is here 353 | #define __SANITIZE_ADDRESS__ 1 | ^ >> drivers/net/ethernet/yusur/k2/../platform/ys_intr.c:113:40: warning: non-overlapping comparisons always evaluate to false [-Wtautological-overlap-compare] 113 | if (sub->irq_type < YS_IRQ_TYPE_QUEUE && | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~ 114 | sub->irq_type > YS_IRQ_TYPE_HW_PRIVATE) { | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. vim +113 drivers/net/ethernet/yusur/k2/../platform/ys_intr.c 94 95 static int ys_request_irq(struct ys_pdev_priv *pdev_priv, int index, 96 struct ys_irq_sub *sub) 97 { 98 struct ys_irq_table *irq_table = &pdev_priv->irq_table; 99 struct ys_irq *irq; 100 int ret; 101 102 if (index >= irq_table->max) 103 return -EINVAL; 104 105 if (IS_ERR_OR_NULL(sub)) 106 return -EINVAL; 107 108 if (IS_ERR_OR_NULL(irq_table->irqs)) { 109 ys_dev_err("Missing irq table irqs"); 110 return -EINVAL; 111 } 112 > 113 if (sub->irq_type < YS_IRQ_TYPE_QUEUE && 114 sub->irq_type > YS_IRQ_TYPE_HW_PRIVATE) { 115 ys_dev_err("Invalid sub irq type: %d", sub->irq_type); 116 return -EINVAL; 117 } 118 119 if (IS_ERR_OR_NULL(sub->handler)) { 120 ys_dev_err("Missing irq handler"); 121 return -EINVAL; 122 } 123 124 mutex_lock(&irq_table->lock); 125 126 irq = &irq_table->irqs[index]; 127 if (irq->state != YS_IRQ_STATE_UNREGISTERED) { 128 mutex_unlock(&irq_table->lock); 129 ys_dev_err("Irq %d(%d) has already been registered", 130 index, irq->state); 131 return -EINVAL; 132 } 133 134 irq->sub = *sub; 135 if (irq->sub.bh_type == YS_IRQ_BH_WORK) { 136 if (IS_ERR_OR_NULL(irq->sub.bh.work_handler)) { 137 memset(&irq->sub, 0, sizeof(struct ys_irq_sub)); 138 mutex_unlock(&irq_table->lock); 139 ys_dev_err("Irq %d(%d) missing work_handler", 140 index, irq->sub.bh_type); 141 return -EINVAL; 142 } 143 INIT_WORK(&irq->sub.bh.work, irq->sub.bh.work_handler); 144 } 145 146 if (irq->sub.devname) 147 ret = pci_request_irq(pdev_priv->pdev, 148 irq->index, 149 irq->sub.handler, 150 irq->sub.bh.thread_fn, 151 irq, irq->sub.devname); 152 else 153 ret = pci_request_irq(pdev_priv->pdev, 154 irq->index, 155 irq->sub.handler, 156 irq->sub.bh.thread_fn, 157 irq, "%s-%d-bdf:%d%d%d", 158 pdev_priv->nic_type->func_name, index, 159 pdev_priv->pdev->bus->number, 160 PCI_SLOT(pdev_priv->pdev->devfn), 161 PCI_FUNC(pdev_priv->pdev->devfn)); 162 163 if (ret < 0) { 164 memset(&irq->sub, 0, sizeof(struct ys_irq_sub)); 165 mutex_unlock(&irq_table->lock); 166 ys_dev_err("Failed to request irq index %d virq %d", index, 167 irq->irqn); 168 return ret; 169 } 170 171 irq->state = YS_IRQ_STATE_REGISTERED; 172 irq_table->used++; 173 174 mutex_unlock(&irq_table->lock); 175 176 ys_debug("Request irq %d vector %d", index, irq->irqn); 177 178 return 0; 179 } 180 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 00/12] crypto: hisilicon - add reference counting to queues for tfm kernel reuse
by Chenghai Huang 04 Dec '25

04 Dec '25

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Chenghai Huang (8): crypto: hisilicon/zip - adjust the way to obtain the req in the callback function crypto: hisilicon/sec - move backlog management to qp and store sqe in qp for callback crypto: hisilicon/qm - enhance the configuration of req_type in queue attributes crypto: hisilicon/qm - centralize the sending locks of each module into qm crypto: hisilicon - consolidate qp creation and start in hisi_qm_alloc_qps_node crypto: hisilicon/qm - add reference counting to queues for tfm kernel reuse crypto: hisilicon/qm - optimize device selection priority based on queue ref count and NUMA distance crypto: hisilicon/zip - support fallback for zip JiangShui Yang (1): Revert "crypto: hisilicon/hpre - support the hpre algorithm fallback" Qi Tao (1): crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable Weili Qian (1): crypto: hisilicon/hpre - support the hpre algorithm fallback lizhi (1): crypto: hisilicon/hpre: extend tag field to 64 bits for better performance drivers/crypto/hisilicon/Kconfig | 1 + drivers/crypto/hisilicon/hpre/hpre.h | 5 +- drivers/crypto/hisilicon/hpre/hpre_crypto.c | 261 +++----------------- drivers/crypto/hisilicon/hpre/hpre_main.c | 2 +- drivers/crypto/hisilicon/qm.c | 206 +++++++++++---- drivers/crypto/hisilicon/sec2/sec.h | 7 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 159 +++++++----- drivers/crypto/hisilicon/sec2/sec_main.c | 21 +- drivers/crypto/hisilicon/zip/zip.h | 2 +- drivers/crypto/hisilicon/zip/zip_crypto.c | 164 +++++++----- drivers/crypto/hisilicon/zip/zip_main.c | 4 +- include/linux/hisi_acc_qm.h | 14 +- 12 files changed, 417 insertions(+), 429 deletions(-) -- 2.43.0

2 13

[PATCH OLK-6.6 0/4] mainline patch backport
by Xinyu Zheng 04 Dec '25

04 Dec '25

Catalin Marinas (1): arm64: mte: Do not flag the zero page as PG_mte_tagged Kaushlendra Kumar (1): ACPI: button: Call input_free_device() on failing input device registration Pin-yen Lin (1): PM: sleep: Do not wait on SYNC_STATE_ONLY device links Yipeng Zou (1): timers: Fix NULL function pointer race in timer_shutdown_sync() arch/arm64/kernel/cpufeature.c | 10 +++++++--- arch/arm64/kernel/mte.c | 3 ++- drivers/acpi/button.c | 4 +++- drivers/base/base.h | 1 + drivers/base/core.c | 2 +- drivers/base/power/main.c | 6 ++++-- kernel/time/timer.c | 7 ++++--- 7 files changed, 22 insertions(+), 11 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] NFSD: fix race between nfsd registration and exports_proc
by Li Lingfeng 04 Dec '25

04 Dec '25

From: Maninder Singh <maninder1.s(a)samsung.com> mainline inclusion from mainline-v6.16-rc1 commit f7fb730cac9aafda8b9813b55d04e28a9664d17c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4N1 CVE: CVE-2025-38232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- As of now nfsd calls create_proc_exports_entry() at start of init_nfsd and cleanup by remove_proc_entry() at last of exit_nfsd. Which causes kernel OOPs if there is race between below 2 operations: (i) exportfs -r (ii) mount -t nfsd none /proc/fs/nfsd for 5.4 kernel ARM64: CPU 1: el1_irq+0xbc/0x180 arch_counter_get_cntvct+0x14/0x18 running_clock+0xc/0x18 preempt_count_add+0x88/0x110 prep_new_page+0xb0/0x220 get_page_from_freelist+0x2d8/0x1778 __alloc_pages_nodemask+0x15c/0xef0 __vmalloc_node_range+0x28c/0x478 __vmalloc_node_flags_caller+0x8c/0xb0 kvmalloc_node+0x88/0xe0 nfsd_init_net+0x6c/0x108 [nfsd] ops_init+0x44/0x170 register_pernet_operations+0x114/0x270 register_pernet_subsys+0x34/0x50 init_nfsd+0xa8/0x718 [nfsd] do_one_initcall+0x54/0x2e0 CPU 2 : Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 PC is at : exports_net_open+0x50/0x68 [nfsd] Call trace: exports_net_open+0x50/0x68 [nfsd] exports_proc_open+0x2c/0x38 [nfsd] proc_reg_open+0xb8/0x198 do_dentry_open+0x1c4/0x418 vfs_open+0x38/0x48 path_openat+0x28c/0xf18 do_filp_open+0x70/0xe8 do_sys_open+0x154/0x248 Sometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu(). and same is happening on latest 6.14 kernel as well: [ 0.000000] Linux version 6.14.0-rc5-next-20250304-dirty ... [ 285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48 ... [ 285.464902] pc : cache_seq_next_rcu+0x78/0xa4 ... [ 285.469695] Call trace: [ 285.470083] cache_seq_next_rcu+0x78/0xa4 (P) [ 285.470488] seq_read+0xe0/0x11c [ 285.470675] proc_reg_read+0x9c/0xf0 [ 285.470874] vfs_read+0xc4/0x2fc [ 285.471057] ksys_read+0x6c/0xf4 [ 285.471231] __arm64_sys_read+0x1c/0x28 [ 285.471428] invoke_syscall+0x44/0x100 [ 285.471633] el0_svc_common.constprop.0+0x40/0xe0 [ 285.471870] do_el0_svc_compat+0x1c/0x34 [ 285.472073] el0_svc_compat+0x2c/0x80 [ 285.472265] el0t_32_sync_handler+0x90/0x140 [ 285.472473] el0t_32_sync+0x19c/0x1a0 [ 285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3) [ 285.473422] ---[ end trace 0000000000000000 ]--- It reproduced simply with below script: while [ 1 ] do /exportfs -r done & while [ 1 ] do insmod /nfsd.ko mount -t nfsd none /proc/fs/nfsd umount /proc/fs/nfsd rmmod nfsd done & So exporting interfaces to user space shall be done at last and cleanup at first place. With change there is no Kernel OOPs. Co-developed-by: Shubham Rana <s9.rana(a)samsung.com> Signed-off-by: Shubham Rana <s9.rana(a)samsung.com> Signed-off-by: Maninder Singh <maninder1.s(a)samsung.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Cc: stable(a)vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfsctl.c [Commit bd9d6a3efa97 ("NFSD: add rpc_status netlink support") added genl_register_family() in init_nfsd().] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfsctl.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 46f08bb17cf6..b821c50b062f 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1589,12 +1589,9 @@ static int __init init_nfsd(void) if (retval) goto out_free_pnfs; nfsd_lockd_init(); /* lockd->nfsd callbacks */ - retval = create_proc_exports_entry(); - if (retval) - goto out_free_lockd; retval = register_pernet_subsys(&nfsd_net_ops); if (retval < 0) - goto out_free_exports; + goto out_free_lockd; retval = register_cld_notifier(); if (retval) goto out_free_subsys; @@ -1602,18 +1599,20 @@ static int __init init_nfsd(void) if (retval) goto out_free_cld; retval = register_filesystem(&nfsd_fs_type); + if (retval) + goto out_free_nfsd4; + retval = create_proc_exports_entry(); if (retval) goto out_free_all; return 0; out_free_all: + unregister_filesystem(&nfsd_fs_type); +out_free_nfsd4: nfsd4_destroy_laundry_wq(); out_free_cld: unregister_cld_notifier(); out_free_subsys: unregister_pernet_subsys(&nfsd_net_ops); -out_free_exports: - remove_proc_entry("fs/nfs/exports", NULL); - remove_proc_entry("fs/nfs", NULL); out_free_lockd: nfsd_lockd_shutdown(); nfsd_drc_slab_free(); @@ -1626,13 +1625,13 @@ static int __init init_nfsd(void) static void __exit exit_nfsd(void) { + remove_proc_entry("fs/nfs/exports", NULL); + remove_proc_entry("fs/nfs", NULL); unregister_filesystem(&nfsd_fs_type); nfsd4_destroy_laundry_wq(); unregister_cld_notifier(); unregister_pernet_subsys(&nfsd_net_ops); nfsd_drc_slab_free(); - remove_proc_entry("fs/nfs/exports", NULL); - remove_proc_entry("fs/nfs", NULL); nfsd_lockd_shutdown(); nfsd4_free_slabs(); nfsd4_exit_pnfs(); -- 2.46.1

2 1

[PATCH OLK-6.6] ksmbd: fix refcount leak causing resource not released
by Li Lingfeng 04 Dec '25

04 Dec '25

From: Ziyan Xu <ziyan(a)securitygossip.com> stable inclusion from stable-v6.6.103 commit a1d2bab4d53368a526c97aba92671dd71814f95a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWO1K CVE: CVE-2025-39720 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 89bb430f621124af39bb31763c4a8b504c9651e2 upstream. When ksmbd_conn_releasing(opinfo->conn) returns true,the refcount was not decremented properly, causing a refcount leak that prevents the count from reaching zero and the memory from being released. Cc: stable(a)vger.kernel.org Signed-off-by: Ziyan Xu <ziyan(a)securitygossip.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/server/oplock.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c index 72294764d4c2..9c3e0d4d4828 100644 --- a/fs/smb/server/oplock.c +++ b/fs/smb/server/oplock.c @@ -1105,8 +1105,10 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp, if (!atomic_inc_not_zero(&opinfo->refcount)) continue; - if (ksmbd_conn_releasing(opinfo->conn)) + if (ksmbd_conn_releasing(opinfo->conn)) { + opinfo_put(opinfo); continue; + } oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); opinfo_put(opinfo); @@ -1142,8 +1144,11 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp) if (!atomic_inc_not_zero(&opinfo->refcount)) continue; - if (ksmbd_conn_releasing(opinfo->conn)) + if (ksmbd_conn_releasing(opinfo->conn)) { + opinfo_put(opinfo); continue; + } + oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE, NULL); opinfo_put(opinfo); } @@ -1346,8 +1351,10 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, if (!atomic_inc_not_zero(&brk_op->refcount)) continue; - if (ksmbd_conn_releasing(brk_op->conn)) + if (ksmbd_conn_releasing(brk_op->conn)) { + opinfo_put(brk_op); continue; + } if (brk_op->is_lease && (brk_op->o_lease->state & (~(SMB2_LEASE_READ_CACHING_LE | -- 2.46.1

2 1

[PATCH OLK-6.6] NFSD: Define a proc_layoutcommit for the FlexFiles layout type
by Li Lingfeng 04 Dec '25

04 Dec '25

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v6.6.114 commit f7353208c91ab004e0179c5fb6c365b0f132f9f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID4A6E CVE: CVE-2025-40087 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4b47a8601b71ad98833b447d465592d847b4dc77 ] Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout. Reported-by: Robert Morris <rtm(a)csail.mit.edu> Closes: https://lore.kernel.org/linux-nfs/152f99b2-ba35-4dec-93a9-4690e625dccd@orac… Cc: Thomas Haynes <loghyr(a)hammerspace.com> Cc: stable(a)vger.kernel.org Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server") Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> [ removed struct svc_rqst parameter from nfsd4_ff_proc_layoutcommit ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/flexfilelayout.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/nfsd/flexfilelayout.c b/fs/nfsd/flexfilelayout.c index 3ca5304440ff..0bc52e6bec39 100644 --- a/fs/nfsd/flexfilelayout.c +++ b/fs/nfsd/flexfilelayout.c @@ -125,6 +125,13 @@ nfsd4_ff_proc_getdeviceinfo(struct super_block *sb, struct svc_rqst *rqstp, return 0; } +static __be32 +nfsd4_ff_proc_layoutcommit(struct inode *inode, + struct nfsd4_layoutcommit *lcp) +{ + return nfs_ok; +} + const struct nfsd4_layout_ops ff_layout_ops = { .notify_types = NOTIFY_DEVICEID4_DELETE | NOTIFY_DEVICEID4_CHANGE, @@ -133,4 +140,5 @@ const struct nfsd4_layout_ops ff_layout_ops = { .encode_getdeviceinfo = nfsd4_ff_encode_getdeviceinfo, .proc_layoutget = nfsd4_ff_proc_layoutget, .encode_layoutget = nfsd4_ff_encode_layoutget, + .proc_layoutcommit = nfsd4_ff_proc_layoutcommit, }; -- 2.46.1

2 1

[PATCH OLK-6.6] task_work: Fix NMI race condition
by Xia Fukun 04 Dec '25

04 Dec '25

From: Peter Zijlstra <peterz(a)infradead.org> mainline inclusion from mainline-v6.18-rc7 commit ef1ea98c8fffe227e5319215d84a53fa2a4bcebc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDAQ5Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- __schedule() // disable irqs <NMI> task_work_add(current, work, TWA_NMI_CURRENT); </NMI> // current = next; // enable irqs <IRQ> task_work_set_notify_irq() test_and_set_tsk_thread_flag(current, TIF_NOTIFY_RESUME); // wrong task! </IRQ> // original task skips task work on its next return to user (or exit!) Fixes: 466e4d801cd4 ("task_work: Add TWA_NMI_CURRENT as an additional notify mode.") Reported-by: Josh Poimboeuf <jpoimboe(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Link: https://patch.msgid.link/20250924080118.425949403@infradead.org Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/task_work.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kernel/task_work.c b/kernel/task_work.c index c969f1f26be5..48ab6275e6e7 100644 --- a/kernel/task_work.c +++ b/kernel/task_work.c @@ -9,7 +9,12 @@ static struct callback_head work_exited; /* all we need is ->next == NULL */ #ifdef CONFIG_IRQ_WORK static void task_work_set_notify_irq(struct irq_work *entry) { - test_and_set_tsk_thread_flag(current, TIF_NOTIFY_RESUME); + /* + * no-op IPI + * + * TWA_NMI_CURRENT will already have set the TIF flag, all + * this interrupt does it tickle the return-to-user path. + */ } static DEFINE_PER_CPU(struct irq_work, irq_work_NMI_resume) = IRQ_WORK_INIT_HARD(task_work_set_notify_irq); @@ -98,6 +103,7 @@ int task_work_add(struct task_struct *task, struct callback_head *work, break; #ifdef CONFIG_IRQ_WORK case TWA_NMI_CURRENT: + set_tsk_thread_flag(current, TIF_NOTIFY_RESUME); irq_work_queue(this_cpu_ptr(&irq_work_NMI_resume)); break; #endif -- 2.34.1

2 1

[PATCH v9 00/16] arm64: entry: Convert to Generic Entry
by Jinjie Ruan 04 Dec '25

04 Dec '25

Currently, x86, Riscv, Loongarch use the Generic Entry which makes maintainers' work easier and codes more elegant. arm64 has already successfully switched to the Generic IRQ Entry in commit b3cf07851b6c ("arm64: entry: Switch to generic IRQ entry"), it is time to completely convert arm64 to Generic Entry. The goal is to bring arm64 in line with other architectures that already use the generic entry infrastructure, reducing duplicated code and making it easier to share future changes in entry/exit paths, such as "Syscall User Dispatch". This patch set is rebased on v6.18-rc7. And the performance was measured on Kunpeng 920 using "perf bench basic syscall" with "arm64.nopauth selinux=0 audit=1". After switch to Generic Entry, the performance are below: | Metric | W/O Generic Framework | With Generic Framework | Change | | ---------- | --------------------- | ---------------------- | ------ | | Total time | 2.130 [sec] | 2.235 [sec] | ↑4.90% | | usecs/op | 0.213095 | 0.223512 | ↑4.89% | | ops/sec | 4,692,753 | 4,474,044 | ↓4.89% | Compared to earlier with arch specific handling, the performance decreased by approximately 4.9%. On the basis of optimizing syscall_get_arguments()[1], el0_svc_common() and syscall_exit_work(), the performance are below: | Metric | W/O Generic Entry | With Generic Entry opt| Change | | ---------- | ----------------- | ------------------ | ------ | | Total time | 2.130 [sec] | 2.134 [sec] | ↑0.18% | | usecs/op | 0.213095 | 0.213414 | ↑0.15% | | ops/sec | 4,692,753 | 4,685,737 | ↓0.15% | Therefore, after the optimization, ARM64 System Call performance remains almost unchanged. It was tested ok with following test cases on kunpeng920 and QEMU virt platform: - Perf tests. - Different `dynamic preempt` mode switch. - Pseudo NMI tests. - Stress-ng CPU stress test. - Hackbench stress test. - MTE test case in Documentation/arch/arm64/memory-tagging-extension.rst and all test cases in tools/testing/selftests/arm64/mte/*. - "sud" selftest testcase. - get_set_sud, get_syscall_info, set_syscall_info, peeksiginfo in tools/testing/selftests/ptrace. - breakpoint_test_arm64 in selftests/breakpoints. - syscall-abi and ptrace in tools/testing/selftests/arm64/abi - fp-ptrace, sve-ptrace, za-ptrace in selftests/arm64/fp. - vdso_test_getrandom in tools/testing/selftests/vDSO - Strace tests. The test QEMU configuration is as follows: qemu-system-aarch64 \ -M virt,gic-version=3,virtualization=on,mte=on \ cpu max,pauth-impdef=on \ kernel Image \ smp 8,sockets=1,cores=4,threads=2 \ m 512m \ nographic \ no-reboot \ device virtio-rng-pci \ append "root=/dev/vda rw console=ttyAMA0 kgdboc=ttyAMA0,115200 \ earlycon preempt=voluntary irqchip.gicv3_pseudo_nmi=1" \ drive if=none,file=images/rootfs.ext4,format=raw,id=hd0 \ device virtio-blk-device,drive=hd0 \ [1]: https://lore.kernel.org/all/20251201120633.1193122-3-ruanjinjie@huawei.com/ Changes in v9: - Move "Return early for ptrace_report_syscall_entry() error" patch ahead to make it not introduce a regression. - Not check _TIF_SECCOMP/SYSCALL_EMU for syscall_exit_work() in a separate patch. - Do not report_syscall_exit() for PTRACE_SYSEMU_SINGLESTEP in a separate patch. - Add two performance patch to improve the arm64 performance. - Add Reviewed-by. - Link to v8: https://lore.kernel.org/all/20251126071446.3234218-1-ruanjinjie@huawei.com/ Changes in v8: - Rename "report_syscall_enter()" to "report_syscall_entry()". - Add ptrace_save_reg() to avoid duplication. - Remove unused _TIF_WORK_MASK in a standalone patch. - Align syscall_trace_enter() return value with the generic version. - Use "scno" instead of regs->syscallno in el0_svc_common(). - Move rseq_syscall() ahead in a standalone patch to clarify it clearly. - Rename "syscall_trace_exit()" to "syscall_exit_work()". - Keep the goto in el0_svc_common(). - No argument was passed to __secure_computing() and check -1 not -1L. - Remove "Add has_syscall_work() helper" patch. - Move "Add syscall_exit_to_user_mode_prepare() helper" patch later. - Add miss header for asm/entry-common.h. - Update the implementation of arch_syscall_is_vdso_sigreturn(). - Add "ARCH_SYSCALL_WORK_EXIT" to be defined as "SECCOMP | SYSCALL_EMU" to keep the behaviour unchanged. - Add more testcases test. - Add Reviewed-by. - Update the commit message. - Link to v7: https://lore.kernel.org/all/20251117133048.53182-1-ruanjinjie@huawei.com/ Chanegs in v7: - Support "Syscall User Dispatch" by implementing arch_syscall_is_vdso_sigreturn() as kemal suggested. - Add aarch64 support for "sud" selftest testcase, which tested ok with the patch series. - Fix the kernel test robot warning for arch_ptrace_report_syscall_entry() and arch_ptrace_report_syscall_exit() in asm/entry-common.h. - Add perf syscall performance test. - Link to v6: https://lore.kernel.org/all/20250916082611.2972008-1-ruanjinjie@huawei.com/ Changes in v6: - Rebased on v6.17-rc5-next as arm64 generic irq entry has merged. - Update the commit message. - Link to v5: https://lore.kernel.org/all/20241206101744.4161990-1-ruanjinjie@huawei.com/ Changes in v5: - Not change arm32 and keep inerrupts_enabled() macro for gicv3 driver. - Move irqentry_state definition into arch/arm64/kernel/entry-common.c. - Avoid removing the __enter_from_*() and __exit_to_*() wrappers. - Update "irqentry_state_t ret/irq_state" to "state" to keep it consistently. - Use generic irq entry header for PREEMPT_DYNAMIC after split the generic entry. - Also refactor the ARM64 syscall code. - Introduce arch_ptrace_report_syscall_entry/exit(), instead of arch_pre/post_report_syscall_entry/exit() to simplify code. - Make the syscall patches clear separation. - Update the commit message. - Link to v4: https://lore.kernel.org/all/20241025100700.3714552-1-ruanjinjie@huawei.com/ Changes in v4: - Rework/cleanup split into a few patches as Mark suggested. - Replace interrupts_enabled() macro with regs_irqs_disabled(), instead of left it here. - Remove rcu and lockdep state in pt_regs by using temporary irqentry_state_t as Mark suggested. - Remove some unnecessary intermediate functions to make it clear. - Rework preempt irq and PREEMPT_DYNAMIC code to make the switch more clear. - arch_prepare_*_entry/exit() -> arch_pre_*_entry/exit(). - Expand the arch functions comment. - Make arch functions closer to its caller. - Declare saved_reg in for block. - Remove arch_exit_to_kernel_mode_prepare(), arch_enter_from_kernel_mode(). - Adjust "Add few arch functions to use generic entry" patch to be the penultimate. - Update the commit message. - Add suggested-by. - Link to v3: https://lore.kernel.org/all/20240629085601.470241-1-ruanjinjie@huawei.com/ Changes in v3: - Test the MTE test cases. - Handle forget_syscall() in arch_post_report_syscall_entry() - Make the arch funcs not use __weak as Thomas suggested, so move the arch funcs to entry-common.h, and make arch_forget_syscall() folded in arch_post_report_syscall_entry() as suggested. - Move report_single_step() to thread_info.h for arm64 - Change __always_inline() to inline, add inline for the other arch funcs. - Remove unused signal.h for entry-common.h. - Add Suggested-by. - Update the commit message. Changes in v2: - Add tested-by. - Fix a bug that not call arch_post_report_syscall_entry() in syscall_trace_enter() if ptrace_report_syscall_entry() return not zero. - Refactor report_syscall(). - Add comment for arch_prepare_report_syscall_exit(). - Adjust entry-common.h header file inclusion to alphabetical order. - Update the commit message. Jinjie Ruan (15): arm64: Remove unused _TIF_WORK_MASK arm64/ptrace: Split report_syscall() arm64/ptrace: Return early for ptrace_report_syscall_entry() error arm64/ptrace: Refactor syscall_trace_enter/exit() arm64: ptrace: Move rseq_syscall() before audit_syscall_exit() arm64: syscall: Rework el0_svc_common() arm64/ptrace: Not check _TIF_SECCOMP/SYSCALL_EMU for syscall_exit_work() arm64/ptrace: Do not report_syscall_exit() for PTRACE_SYSEMU_SINGLESTEP arm64/ptrace: Expand secure_computing() in place arm64/ptrace: Use syscall_get_arguments() helper entry: Split syscall_exit_to_user_mode_work() for arch reuse entry: Add arch_ptrace_report_syscall_entry/exit() arm64: entry: Convert to generic entry arm64: Inline el0_svc_common() entry: Inline syscall_exit_work() kemal (1): selftests: sud_test: Support aarch64 arch/arm64/Kconfig | 2 +- arch/arm64/include/asm/entry-common.h | 76 ++++++++++++++ arch/arm64/include/asm/syscall.h | 19 +++- arch/arm64/include/asm/thread_info.h | 22 +---- arch/arm64/kernel/debug-monitors.c | 7 ++ arch/arm64/kernel/ptrace.c | 94 ------------------ arch/arm64/kernel/signal.c | 2 +- arch/arm64/kernel/syscall.c | 29 ++---- include/linux/entry-common.h | 98 ++++++++++++++++--- kernel/entry/syscall-common.c | 60 +++++------- .../syscall_user_dispatch/sud_test.c | 4 + 11 files changed, 220 insertions(+), 193 deletions(-) -- 2.34.1

1 16

[PATCH OLK-5.10] arm64: kdump: Skip kmemleak scan reserved memory for kdump
by Qi Xi 04 Dec '25

04 Dec '25

From: Chen Wandun <chenwandun(a)huawei.com> mainline inclusion from mainline-v5.15-rc1 commit 85f58eb1889826b9745737718723a80b639e0fbd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDAGZ8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Trying to boot with kdump + kmemleak, command will result in a crash: "echo scan > /sys/kernel/debug/kmemleak" crashkernel reserved: 0x0000000007c00000 - 0x0000000027c00000 (512 MB) Kernel command line: BOOT_IMAGE=(hd1,gpt2)/vmlinuz-5.14.0-rc5-next-20210809+ root=/dev/mapper/ao-root ro rd.lvm.lv=ao/root rd.lvm.lv=ao/swap crashkernel=512M Unable to handle kernel paging request at virtual address ffff000007c00000 Mem abort info: ESR = 0x96000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007 CM = 0, WnR = 0 swapper pgtable: 64k pages, 48-bit VAs, pgdp=00002024f0d80000 [ffff000007c00000] pgd=1800205ffffd0003, p4d=1800205ffffd0003, pud=1800205ffffd0003, pmd=1800205ffffc0003, pte=0068000007c00f06 Internal error: Oops: 96000007 [#1] SMP pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : scan_block+0x98/0x230 lr : scan_block+0x94/0x230 sp : ffff80008d6cfb70 x29: ffff80008d6cfb70 x28: 0000000000000000 x27: 0000000000000000 x26: 00000000000000c0 x25: 0000000000000001 x24: 0000000000000000 x23: ffffa88a6b18b398 x22: ffff000007c00ff9 x21: ffffa88a6ac7fc40 x20: ffffa88a6af6a830 x19: ffff000007c00000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff x14: ffffffff00000000 x13: ffffffffffffffff x12: 0000000000000020 x11: 0000000000000000 x10: 0000000001080000 x9 : ffffa88a6951c77c x8 : ffffa88a6a893988 x7 : ffff203ff6cfb3c0 x6 : ffffa88a6a52b3c0 x5 : ffff203ff6cfb3c0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffff20226cb56a40 x0 : 0000000000000000 Call trace: scan_block+0x98/0x230 scan_gray_list+0x120/0x270 kmemleak_scan+0x3a0/0x648 kmemleak_write+0x3ac/0x4c8 full_proxy_write+0x6c/0xa0 vfs_write+0xc8/0x2b8 ksys_write+0x70/0xf8 __arm64_sys_write+0x24/0x30 invoke_syscall+0x4c/0x110 el0_svc_common+0x9c/0x190 do_el0_svc+0x30/0x98 el0_svc+0x28/0xd8 el0t_64_sync_handler+0x90/0xb8 el0t_64_sync+0x180/0x184 The reserved memory for kdump will be looked up by kmemleak, this area will be set invalid when kdump service is bring up. That will result in crash when kmemleak scan this area. Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private") Signed-off-by: Chen Wandun <chenwandun(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Mike Rapoport <rppt(a)linux.ibm.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20210910064844.3827813-1-chenwandun@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Conflicts: kernel/crash_core.c arch/arm64/mm/init.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- kernel/crash_core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/crash_core.c b/kernel/crash_core.c index d1402585bf84..368d8d1dd03c 100644 --- a/kernel/crash_core.c +++ b/kernel/crash_core.c @@ -9,6 +9,7 @@ #include <linux/vmalloc.h> #include <linux/memblock.h> #include <linux/swiotlb.h> +#include <linux/kmemleak.h> #ifdef CONFIG_KEXEC_CORE #include <asm/kexec.h> @@ -556,6 +557,14 @@ void __init reserve_crashkernel(void) (unsigned long)(crash_base >> 20), (unsigned long)(total_mem >> 20)); +#ifdef CONFIG_ARM64 + /* + * The crashkernel memory will be removed from the kernel linear + * map. Inform kmemleak so that it won't try to access it. + */ + kmemleak_ignore_phys(crash_base); +#endif + crashk_res.start = crash_base; crashk_res.end = crash_base + crash_size - 1; } -- 2.33.0

2 1

[PATCH OLK-6.6 0/5] xsched: XCU Partition
by Zicheng Qu 04 Dec '25

04 Dec '25

Zicheng Qu (5): xsched: switch xcu cgroup subsystem from domain mode to thread mode xsched: fix shares misaccounting when multiple tasks run in one cgroup xsched: suppress excessive error logs during cgroup file retry xsched: fix task stall when quota is disabled xsched: add throttling statistics for xsched groups include/linux/xsched.h | 3 ++- kernel/xsched/cfs.c | 5 ++++- kernel/xsched/cfs_quota.c | 34 +++++++++++++++++++++++++--------- kernel/xsched/cgroup.c | 8 ++------ kernel/xsched/core.c | 6 +++++- 5 files changed, 38 insertions(+), 18 deletions(-) -- 2.34.1

2 6

[openeuler:OLK-6.6 3450/3450] kernel/xsched/vstream.c:660:1: error: conflicting types for 'sys_xsched_setattr'
by kernel test robot 03 Dec '25

03 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8c22cbd025b67d03da84cc988561b6a758e882ee commit: 7d2bb3c7646cf1ebe76de965c3b31d7bc2b89845 [3450/3450] xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20251203/202512032006.udjnn6SV-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251203/202512032006.udjnn6SV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512032006.udjnn6SV-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/xsched/vstream.c:21: include/linux/syscalls.h:954:54: warning: declaration of 'struct xsched_attr' will not be visible outside of this function [-Wvisibility] 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^ include/linux/syscalls.h:955:54: warning: declaration of 'struct xsched_attr' will not be visible outside of this function [-Wvisibility] 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^ >> kernel/xsched/vstream.c:660:1: error: conflicting types for 'sys_xsched_setattr' 660 | SYSCALL_DEFINE2(xsched_setattr, pid_t, pid, struct xsched_attr __user *, arg) | ^ include/linux/syscalls.h:222:36: note: expanded from macro 'SYSCALL_DEFINE2' 222 | #define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__) | ^ include/linux/syscalls.h:232:2: note: expanded from macro 'SYSCALL_DEFINEx' 232 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^ include/linux/syscalls.h:246:18: note: expanded from macro '__SYSCALL_DEFINEx' 246 | asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ | ^ <scratch space>:72:1: note: expanded from here 72 | sys_xsched_setattr | ^ include/linux/syscalls.h:954:17: note: previous declaration is here 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^ >> kernel/xsched/vstream.c:665:1: error: conflicting types for 'sys_xsched_getattr' 665 | SYSCALL_DEFINE2(xsched_getattr, pid_t, pid, struct xsched_attr __user *, arg) | ^ include/linux/syscalls.h:222:36: note: expanded from macro 'SYSCALL_DEFINE2' 222 | #define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__) | ^ include/linux/syscalls.h:232:2: note: expanded from macro 'SYSCALL_DEFINEx' 232 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^ include/linux/syscalls.h:246:18: note: expanded from macro '__SYSCALL_DEFINEx' 246 | asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ | ^ <scratch space>:127:1: note: expanded from here 127 | sys_xsched_getattr | ^ include/linux/syscalls.h:955:17: note: previous declaration is here 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^ 2 warnings and 2 errors generated. vim +/sys_xsched_setattr +660 kernel/xsched/vstream.c 659 > 660 SYSCALL_DEFINE2(xsched_setattr, pid_t, pid, struct xsched_attr __user *, arg) 661 { 662 return 0; 663 } 664 > 665 SYSCALL_DEFINE2(xsched_getattr, pid_t, pid, struct xsched_attr __user *, arg) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3415/3415] drivers/iommu/hisilicon/flush.c:170:13: warning: stack frame size (2240) exceeds limit (2048) in 'ummu_tlbi_range'
by kernel test robot 03 Dec '25

03 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6a67952a484c93a1fcde2126e6a9b553b8022b03 commit: f12801f364f23453a32fe7b4e66ca080156bc58a [3415/3415] iommu/ummu: Add UMMU cache flush interfaces config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251203/202512031727.TzoJZqMA-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251203/202512031727.TzoJZqMA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512031727.TzoJZqMA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/iommu/hisilicon/flush.c:170:13: warning: stack frame size (2240) exceeds limit (2048) in 'ummu_tlbi_range' [-Wframe-larger-than] 170 | static void ummu_tlbi_range(struct ummu_tlb_range *range, bool leaf, | ^ 1 warning generated. vim +/ummu_tlbi_range +170 drivers/iommu/hisilicon/flush.c 169 > 170 static void ummu_tlbi_range(struct ummu_tlb_range *range, bool leaf, 171 struct ummu_domain *domain) 172 { 173 struct ummu_mcmdq_ent cmd = {0}; 174 int err; 175 176 err = ummu_domain_tlbi_cmd(domain, UMMU_TLBI_SCOPE_RNG, UMMU_TLBI_SCENE_DMA, &cmd); 177 if (err) 178 return; 179 180 cmd.tlbi.leaf = leaf; 181 __ummu_tlbi_range(&cmd, range, domain); 182 } 183 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ksmbd: fix use-after-free in smb_break_all_levII_oplock()
by Li Lingfeng 03 Dec '25

03 Dec '25

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.15-rc3 commit 18b4fac5ef17f77fed9417d22210ceafd6525fc7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BMS CVE: CVE-2025-37776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a room in smb_break_all_levII_oplock that can cause racy issues when unlocking in the middle of the loop. This patch use read lock to protect whole loop. Cc: stable(a)vger.kernel.org Reported-by: Norbert Szetei <norbert(a)doyensec.com> Tested-by: Norbert Szetei <norbert(a)doyensec.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/oplock.c fs/ksmbd/oplock.c fs/smb/server/oplock.h fs/ksmbd/oplock.h [Commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb") move fs/ksmbd/ to fs/smb/server/; commit 36322523dddb ("ksmbd: fix UAF issue from opinfo->conn") splits the judgment of opinfo and opinfo->refcount, add use of brk_op->conn in smb_break_all_levII_oplock(); commit d1c189c6cb8b ("ksmbd: use rwsem instead of rwlock for lease break") replace write_lock/write_unlock by down_write/up_write; commit c8efcc786146 ("ksmbd: add support for durable handles v1/v2") add check of brk_op->conn in smb_break_all_levII_oplock(); commit bb39ed470654 ("ksmbd: fix use-after-free in ksmbd_free_work_struct") add a parameter for oplock_break().] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/oplock.c | 28 +++++++++------------------- fs/ksmbd/oplock.h | 1 - 2 files changed, 9 insertions(+), 20 deletions(-) diff --git a/fs/ksmbd/oplock.c b/fs/ksmbd/oplock.c index 3324bb226c79..a3066d78e1de 100644 --- a/fs/ksmbd/oplock.c +++ b/fs/ksmbd/oplock.c @@ -126,14 +126,6 @@ static void free_opinfo(struct oplock_info *opinfo) kfree(opinfo); } -static inline void opinfo_free_rcu(struct rcu_head *rcu_head) -{ - struct oplock_info *opinfo; - - opinfo = container_of(rcu_head, struct oplock_info, rcu_head); - free_opinfo(opinfo); -} - struct oplock_info *opinfo_get(struct ksmbd_file *fp) { struct oplock_info *opinfo; @@ -154,12 +146,12 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) if (list_empty(&ci->m_op_list)) return NULL; - rcu_read_lock(); - opinfo = list_first_or_null_rcu(&ci->m_op_list, struct oplock_info, + read_lock(&ci->m_lock); + opinfo = list_first_entry(&ci->m_op_list, struct oplock_info, op_entry); if (opinfo && !atomic_inc_not_zero(&opinfo->refcount)) opinfo = NULL; - rcu_read_unlock(); + read_unlock(&ci->m_lock); return opinfo; } @@ -169,7 +161,7 @@ void opinfo_put(struct oplock_info *opinfo) if (!atomic_dec_and_test(&opinfo->refcount)) return; - call_rcu(&opinfo->rcu_head, opinfo_free_rcu); + free_opinfo(opinfo); } static void opinfo_add(struct oplock_info *opinfo) @@ -177,7 +169,7 @@ static void opinfo_add(struct oplock_info *opinfo) struct ksmbd_inode *ci = opinfo->o_fp->f_ci; write_lock(&ci->m_lock); - list_add_rcu(&opinfo->op_entry, &ci->m_op_list); + list_add(&opinfo->op_entry, &ci->m_op_list); write_unlock(&ci->m_lock); } @@ -191,7 +183,7 @@ static void opinfo_del(struct oplock_info *opinfo) write_unlock(&lease_list_lock); } write_lock(&ci->m_lock); - list_del_rcu(&opinfo->op_entry); + list_del(&opinfo->op_entry); write_unlock(&ci->m_lock); } @@ -1259,11 +1251,10 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, ci = fp->f_ci; op = opinfo_get(fp); - rcu_read_lock(); - list_for_each_entry_rcu(brk_op, &ci->m_op_list, op_entry) { + read_lock(&ci->m_lock); + list_for_each_entry(brk_op, &ci->m_op_list, op_entry) { if (!atomic_inc_not_zero(&brk_op->refcount)) continue; - rcu_read_unlock(); if (brk_op->is_lease && (brk_op->o_lease->state & (~(SMB2_LEASE_READ_CACHING_LE | SMB2_LEASE_HANDLE_CACHING_LE)))) { @@ -1293,9 +1284,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE); next: opinfo_put(brk_op); - rcu_read_lock(); } - rcu_read_unlock(); + read_unlock(&ci->m_lock); if (op) opinfo_put(op); diff --git a/fs/ksmbd/oplock.h b/fs/ksmbd/oplock.h index e1ba363b412a..98872b7399e1 100644 --- a/fs/ksmbd/oplock.h +++ b/fs/ksmbd/oplock.h @@ -76,7 +76,6 @@ struct oplock_info { struct list_head lease_entry; wait_queue_head_t oplock_q; /* Other server threads */ wait_queue_head_t oplock_brk; /* oplock breaking wait */ - struct rcu_head rcu_head; }; struct lease_break_info { -- 2.46.1

2 1

[PATCH OLK-5.10] ksmbd: fix Preauh_HashValue race condition
by Li Lingfeng 03 Dec '25

03 Dec '25

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.17-rc1 commit 44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTZ34 CVE: CVE-2025-38561 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with session at connection termination phase. Cc: stable(a)vger.kernel.org Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-27661 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 6c4ea5e3802c..13f2a81d3621 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1826,8 +1826,6 @@ int smb2_sess_setup(struct ksmbd_work *work) ksmbd_conn_set_good(conn); sess->state = SMB2_SESSION_VALID; } - kfree(sess->Preauth_HashValue); - sess->Preauth_HashValue = NULL; } else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) { if (negblob->MessageType == NtLmNegotiate) { rc = ntlm_negotiate(work, negblob, negblob_len, rsp); @@ -1861,8 +1859,6 @@ int smb2_sess_setup(struct ksmbd_work *work) kfree(preauth_sess); } } - kfree(sess->Preauth_HashValue); - sess->Preauth_HashValue = NULL; } else { pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n", le32_to_cpu(negblob->MessageType)); -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS 0/4] add mcs support for migrate pages
by Wupeng Ma 03 Dec '25

03 Dec '25

Add mcs support for migrate page & support disabling soft offline for HugeTLB pages. Since UCE kernel recovery is needed by this. This should be enable with the following step: - echo 1 > /proc/sys/kernel/uce_kernel_recovery Disable soft offline support for hugetlb with the following step: - echo 3 > /proc/sys/vm/enable_soft_offline Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Wupeng Ma (2): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page .../ABI/testing/sysfs-memory-page-offline | 3 + include/linux/highmem.h | 55 +++++++++++++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 +++ mm/memory-failure.c | 25 +++++- mm/migrate.c | 79 ++++++++++++++++--- 6 files changed, 162 insertions(+), 10 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] net/mlx5: Fix ECVF vports unload on shutdown flow
by Wupeng Ma 03 Dec '25

03 Dec '25

From: Amir Tzin <amirtz(a)nvidia.com> stable inclusion from stable-v6.6.94 commit 5953ae44dfe5dbad374318875be834c3b7b71ee6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT95 CVE: CVE-2025-38109 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 687560d8a9a2d654829ad0da1ec24242f1de711d ] Fix shutdown flow UAF when a virtual function is created on the embedded chip (ECVF) of a BlueField device. In such case the vport acl ingress table is not properly destroyed. ECVF functionality is independent of ecpf_vport_exists capability and thus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not test it when enabling/disabling ECVF vports. kernel log: [] refcount_t: underflow; use-after-free. [] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0x124/0x220 ---------------- [] Call trace: [] refcount_warn_saturate+0x124/0x220 [] tree_put_node+0x164/0x1e0 [mlx5_core] [] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core] [] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core] [] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core] [] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core] [] esw_vport_cleanup+0x64/0x90 [mlx5_core] [] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core] [] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core] [] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core] [] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core] [] mlx5_sriov_detach+0x40/0x50 [mlx5_core] [] mlx5_unload+0x40/0xc4 [mlx5_core] [] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core] [] mlx5_unload_one+0x3c/0x60 [mlx5_core] [] shutdown+0x7c/0xa4 [mlx5_core] [] pci_device_shutdown+0x3c/0xa0 [] device_shutdown+0x170/0x340 [] __do_sys_reboot+0x1f4/0x2a0 [] __arm64_sys_reboot+0x2c/0x40 [] invoke_syscall+0x78/0x100 [] el0_svc_common.constprop.0+0x54/0x184 [] do_el0_svc+0x30/0xac [] el0_svc+0x48/0x160 [] el0t_64_sync_handler+0xa4/0x12c [] el0t_64_sync+0x1a4/0x1a8 [] --[ end trace 9c4601d68c70030e ]--- Fixes: a7719b29a821 ("net/mlx5: Add management of EC VF vports") Reviewed-by: Daniel Jurgens <danielj(a)nvidia.com> Reviewed-by: Moshe Shemesh <moshe(a)nvidia.com> Signed-off-by: Amir Tzin <amirtz(a)nvidia.com> Signed-off-by: Mark Bloch <mbloch(a)nvidia.com> Link: https://patch.msgid.link/20250610151514.1094735-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c index f6022c135ec02..914b380fd3eeb 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c @@ -1295,12 +1295,15 @@ mlx5_eswitch_enable_pf_vf_vports(struct mlx5_eswitch *esw, ret = mlx5_eswitch_load_pf_vf_vport(esw, MLX5_VPORT_ECPF, enabled_events); if (ret) goto ecpf_err; - if (mlx5_core_ec_sriov_enabled(esw->dev)) { - ret = mlx5_eswitch_load_ec_vf_vports(esw, esw->esw_funcs.num_ec_vfs, - enabled_events); - if (ret) - goto ec_vf_err; - } + } + + /* Enable ECVF vports */ + if (mlx5_core_ec_sriov_enabled(esw->dev)) { + ret = mlx5_eswitch_load_ec_vf_vports(esw, + esw->esw_funcs.num_ec_vfs, + enabled_events); + if (ret) + goto ec_vf_err; } /* Enable VF vports */ @@ -1331,9 +1334,11 @@ void mlx5_eswitch_disable_pf_vf_vports(struct mlx5_eswitch *esw) { mlx5_eswitch_unload_vf_vports(esw, esw->esw_funcs.num_vfs); + if (mlx5_core_ec_sriov_enabled(esw->dev)) + mlx5_eswitch_unload_ec_vf_vports(esw, + esw->esw_funcs.num_ec_vfs); + if (mlx5_ecpf_vport_exists(esw->dev)) { - if (mlx5_core_ec_sriov_enabled(esw->dev)) - mlx5_eswitch_unload_ec_vf_vports(esw, esw->esw_funcs.num_vfs); mlx5_eswitch_unload_pf_vf_vport(esw, MLX5_VPORT_ECPF); } -- 2.43.0

2 1

[PATCH OLK-5.10] memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
by Wupeng Ma 03 Dec '25

03 Dec '25

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v6.1.129 commit e9d07e91de140679eeaf275f47ad154467cb9e05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLHK CVE: CVE-2024-58034 Reference: https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05 -------------------------------- [ Upstream commit b9784e5cde1f9fb83661a70e580e381ae1264d12 ] As of_find_node_by_name() release the reference of the argument device node, tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, resulting in possible UAFs. According to the bindings and the in-tree DTS files, the "emc-tables" node is always device's child node with the property "nvidia,use-ram-code", and the "lpddr2" node is a child of the "emc-tables" node. Thus utilize the for_each_child_of_node() macro and of_get_child_by_name() instead of of_find_node_by_name() to simplify the code. This bug was found by an experimental verification tool that I am developing. Fixes: 96e5da7c8424 ("memory: tegra: Introduce Tegra20 EMC driver") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp [krzysztof: applied v1, adjust the commit msg to incorporate v2 parts] Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/memory/tegra/tegra20-emc.c [1. Context differences; 2. The current hulk-5.10 version does not introduce the function tegra_emc_find_node_by_ram_code and lpddr2 related queries, so CVE bugfix for this part does not involved.] Signed-off-by: Lulu Yao <yaolulu5(a)huawei.com> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/memory/tegra/tegra20-emc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c index 027f46287dbf..a6f73c7521dc 100644 --- a/drivers/memory/tegra/tegra20-emc.c +++ b/drivers/memory/tegra/tegra20-emc.c @@ -388,8 +388,9 @@ tegra_emc_find_node_by_ram_code(struct device *dev) ram_code = tegra_read_ram_code(); - for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np; - np = of_find_node_by_name(np, "emc-tables")) { + for_each_child_of_node(dev->of_node, np) { + if (!of_node_name_eq(np, "emc-tables")) + continue; err = of_property_read_u32(np, "nvidia,ram-code", &value); if (err || value != ram_code) { of_node_put(np); -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] CVE-2025-22022
by Wang Hai 03 Dec '25

03 Dec '25

CVE-2025-22022 Michal Pecio (1): usb: xhci: Apply the link chain quirk on NEC isoc endpoints Niklas Neronin (1): usb: xhci: move link chain bit quirk checks into one helper function. drivers/usb/host/xhci-mem.c | 10 ++-------- drivers/usb/host/xhci-ring.c | 8 ++------ drivers/usb/host/xhci.h | 16 ++++++++++++++-- 3 files changed, 18 insertions(+), 16 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-22022
by Wang Hai 03 Dec '25

03 Dec '25

Michal Pecio (1): usb: xhci: Apply the link chain quirk on NEC isoc endpoints Niklas Neronin (1): usb: xhci: move link chain bit quirk checks into one helper function. drivers/usb/host/xhci-mem.c | 10 ++-------- drivers/usb/host/xhci-ring.c | 8 ++------ drivers/usb/host/xhci.h | 16 ++++++++++++++-- 3 files changed, 18 insertions(+), 16 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6] rv: Use strings in da monitors tracepoints
by Lin Ruifeng 03 Dec '25

03 Dec '25

From: Gabriele Monaco <gmonaco(a)redhat.com> mainline inclusion from mainline-v6.17-rc1 commit 7f904ff6e58d398c4336f3c19c42b338324451f7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9E CVE: CVE-2025-38636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200 trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0 This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g. the next automaton's data in this case). The error is harmless as, while printing the string, we stop at the null terminator, but it should still be fixed. Use the __string facilities while defining the tracepoints to avoid reading out of bound memory. Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Tomas Glozar <tglozar(a)redhat.com> Cc: Juri Lelli <jlelli(a)redhat.com> Cc: Clark Williams <williams(a)redhat.com> Cc: John Kacur <jkacur(a)redhat.com> Link: https://lore.kernel.org/20250728135022.255578-4-gmonaco@redhat.com Fixes: 792575348ff7 ("rv/include: Add deterministic automata monitor definition via C macros") Reviewed-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Gabriele Monaco <gmonaco(a)redhat.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: include/trace/events/rv.h kernel/trace/rv/rv_trace.h [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- include/trace/events/rv.h | 76 +++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 38 deletions(-) diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h index 56592da9301c..da213b91da33 100644 --- a/include/trace/events/rv.h +++ b/include/trace/events/rv.h @@ -16,23 +16,23 @@ DECLARE_EVENT_CLASS(event_da_monitor, TP_ARGS(state, event, next_state, final_state), TP_STRUCT__entry( - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) - __array( char, next_state, MAX_DA_NAME_LEN ) - __field( bool, final_state ) + __string( state, state ) + __string( event, event ) + __string( next_state, next_state ) + __field( bool, final_state ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN); - __entry->final_state = final_state; + __assign_str(state, state); + __assign_str(event, event); + __assign_str(next_state, next_state); + __entry->final_state = final_state; ), TP_printk("%s x %s -> %s %s", - __entry->state, - __entry->event, - __entry->next_state, + __get_str(state), + __get_str(event), + __get_str(next_state), __entry->final_state ? "(final)" : "") ); @@ -43,18 +43,18 @@ DECLARE_EVENT_CLASS(error_da_monitor, TP_ARGS(state, event), TP_STRUCT__entry( - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) + __string( state, state ) + __string( event, event ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); + __assign_str(state, state); + __assign_str(event, event); ), TP_printk("event %s not expected in the state %s", - __entry->event, - __entry->state) + __get_str(event), + __get_str(state)) ); #ifdef CONFIG_RV_MON_WIP @@ -76,26 +76,26 @@ DECLARE_EVENT_CLASS(event_da_monitor_id, TP_ARGS(id, state, event, next_state, final_state), TP_STRUCT__entry( - __field( int, id ) - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) - __array( char, next_state, MAX_DA_NAME_LEN ) - __field( bool, final_state ) + __field( int, id ) + __string( state, state ) + __string( event, event ) + __string( next_state, next_state ) + __field( bool, final_state ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN); - __entry->id = id; - __entry->final_state = final_state; + __assign_str(state, state); + __assign_str(event, event); + __assign_str(next_state, next_state); + __entry->id = id; + __entry->final_state = final_state; ), TP_printk("%d: %s x %s -> %s %s", __entry->id, - __entry->state, - __entry->event, - __entry->next_state, + __get_str(state), + __get_str(event), + __get_str(next_state), __entry->final_state ? "(final)" : "") ); @@ -106,21 +106,21 @@ DECLARE_EVENT_CLASS(error_da_monitor_id, TP_ARGS(id, state, event), TP_STRUCT__entry( - __field( int, id ) - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) + __field( int, id ) + __string( state, state ) + __string( event, event ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - __entry->id = id; + __assign_str(state, state); + __assign_str(event, event); + __entry->id = id; ), TP_printk("%d: event %s not expected in the state %s", __entry->id, - __entry->event, - __entry->state) + __get_str(event), + __get_str(state)) ); #ifdef CONFIG_RV_MON_WWNR -- 2.43.0

2 1

[PATCH OLK-5.10] media: venus: hfi: add check to handle incorrect queue size
by Lin Ruifeng 03 Dec '25

03 Dec '25

From: Vikash Garodia <quic_vgarodia(a)quicinc.com> stable inclusion from stable-v5.10.237 commit a45957bcde529169188929816775a575de77d84f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJU CVE: CVE-2025-23158 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 69baf245b23e20efda0079238b27fc63ecf13de1 upstream. qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue. Cc: stable(a)vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Signed-off-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/media/platform/qcom/venus/hfi_venus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c index 8b1375c97c81..d3f1efabbfd6 100644 --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -188,6 +188,9 @@ static int venus_write_queue(struct venus_hfi_device *hdev, /* ensure rd/wr indices's are read from memory */ rmb(); + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx); else @@ -256,6 +259,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev, wr_idx = qhdr->write_idx; qsize = qhdr->q_size; + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + /* make sure data is valid before using it */ rmb(); -- 2.43.0

2 1

[openeuler:OLK-6.6 3450/3450] include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_setattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'}
by kernel test robot 03 Dec '25

03 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 475ad739de0d59c667bb9fa8ab728d1d146c8e28 commit: 7d2bb3c7646cf1ebe76de965c3b31d7bc2b89845 [3450/3450] xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled config: loongarch-randconfig-002-20251203 (https://download.01.org/0day-ci/archive/20251203/202512031328.9eAOiuGN-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251203/202512031328.9eAOiuGN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512031328.9eAOiuGN-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/xsched/vstream.c:21: include/linux/syscalls.h:954:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ include/linux/syscalls.h:955:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ >> include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_setattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 246 | asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ | ^~~ include/linux/syscalls.h:232:9: note: in expansion of macro '__SYSCALL_DEFINEx' 232 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:222:36: note: in expansion of macro 'SYSCALL_DEFINEx' 222 | #define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/xsched/vstream.c:660:1: note: in expansion of macro 'SYSCALL_DEFINE2' 660 | SYSCALL_DEFINE2(xsched_setattr, pid_t, pid, struct xsched_attr __user *, arg) | ^~~~~~~~~~~~~~~ include/linux/syscalls.h:954:17: note: previous declaration of 'sys_xsched_setattr' with type 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~~~~~~~~ >> include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_getattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 246 | asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ | ^~~ include/linux/syscalls.h:232:9: note: in expansion of macro '__SYSCALL_DEFINEx' 232 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:222:36: note: in expansion of macro 'SYSCALL_DEFINEx' 222 | #define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/xsched/vstream.c:665:1: note: in expansion of macro 'SYSCALL_DEFINE2' 665 | SYSCALL_DEFINE2(xsched_getattr, pid_t, pid, struct xsched_attr __user *, arg) | ^~~~~~~~~~~~~~~ include/linux/syscalls.h:955:17: note: previous declaration of 'sys_xsched_getattr' with type 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~~~~~~~~ vim +246 include/linux/syscalls.h 1bd21c6c21e848 Dominik Brodowski 2018-04-05 235 e145242ea0df6b Dominik Brodowski 2018-04-09 236 /* e145242ea0df6b Dominik Brodowski 2018-04-09 237 * The asmlinkage stub is aliased to a function named __se_sys_*() which e145242ea0df6b Dominik Brodowski 2018-04-09 238 * sign-extends 32-bit ints to longs whenever needed. The actual work is e145242ea0df6b Dominik Brodowski 2018-04-09 239 * done within __do_sys_*(). e145242ea0df6b Dominik Brodowski 2018-04-09 240 */ 1bd21c6c21e848 Dominik Brodowski 2018-04-05 241 #ifndef __SYSCALL_DEFINEx bed1ffca022cc8 Frederic Weisbecker 2009-03-13 242 #define __SYSCALL_DEFINEx(x, name, ...) \ bee20031772af3 Arnd Bergmann 2018-06-19 243 __diag_push(); \ bee20031772af3 Arnd Bergmann 2018-06-19 244 __diag_ignore(GCC, 8, "-Wattribute-alias", \ bee20031772af3 Arnd Bergmann 2018-06-19 245 "Type aliasing is used to sanitize syscall arguments");\ 83460ec8dcac14 Andi Kleen 2013-11-12 @246 asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ e145242ea0df6b Dominik Brodowski 2018-04-09 247 __attribute__((alias(__stringify(__se_sys##name)))); \ c9a211951c7c79 Howard McLauchlan 2018-03-21 248 ALLOW_ERROR_INJECTION(sys##name, ERRNO); \ e145242ea0df6b Dominik Brodowski 2018-04-09 249 static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\ e145242ea0df6b Dominik Brodowski 2018-04-09 250 asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ e145242ea0df6b Dominik Brodowski 2018-04-09 251 asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ 1a94bc34768e46 Heiko Carstens 2009-01-14 252 { \ e145242ea0df6b Dominik Brodowski 2018-04-09 253 long ret = __do_sys##name(__MAP(x,__SC_CAST,__VA_ARGS__));\ 07fe6e00f6cca6 Al Viro 2013-01-21 254 __MAP(x,__SC_TEST,__VA_ARGS__); \ 2cf0966683430b Al Viro 2013-01-21 255 __PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__)); \ 2cf0966683430b Al Viro 2013-01-21 256 return ret; \ 1a94bc34768e46 Heiko Carstens 2009-01-14 257 } \ bee20031772af3 Arnd Bergmann 2018-06-19 258 __diag_pop(); \ e145242ea0df6b Dominik Brodowski 2018-04-09 259 static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) 1bd21c6c21e848 Dominik Brodowski 2018-04-05 260 #endif /* __SYSCALL_DEFINEx */ 1a94bc34768e46 Heiko Carstens 2009-01-14 261 :::::: The code at line 246 was first introduced by commit :::::: 83460ec8dcac14142e7860a01fa59c267ac4657c syscalls.h: use gcc alias instead of assembler aliases for syscalls :::::: TO: Andi Kleen <ak(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 5bd996476c86f9b6d2039f9ab662f38d64fa6c70
by kernel test robot 03 Dec '25

03 Dec '25

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 5bd996476c86f9b6d2039f9ab662f38d64fa6c70 !19381 net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild/202512031045.402km0Dt-lkp@intel.com block/blk-wbt.c:589:6: warning: no previous prototype for function 'wbt_issue' [-Wmissing-prototypes] block/blk-wbt.c:609:6: warning: no previous prototype for function 'wbt_requeue' [-Wmissing-prototypes] drivers/gpu/drm/amd/amdgpu/amdgpu_ids.o: warning: objtool: amdgpu_vmid_grab()+0xd3e: unreachable instruction fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction kernel/sched/debug.c:990:17: error: no member named 'nr_wakeups_preferred_cpus' in 'struct dyn_affinity_stats' kernel/sched/debug.c:991:17: error: no member named 'nr_wakeups_force_preferred_cpus' in 'struct dyn_affinity_stats' mm/early_ioremap.o: warning: objtool: missing symbol for section .text mm/hugetlb.c:1370:6: warning: no previous prototype for function 'free_huge_page_to_dhugetlb_pool' [-Wmissing-prototypes] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] Unverified Error/Warning (likely false positive, kindly check if interested): (.text+0x26a4): undefined reference to `_init' (.text+0x31): undefined reference to `_DYNAMIC' (.text+0x41): undefined reference to `_fini' /usr/include/bits/floatn.h:83:52: error: unsupported machine mode '__TC__' /usr/include/bits/floatn.h:97:9: error: __float128 is not supported on this target block/blk-throttle.c:2306:1-7: preceding lock on line 2212 block/cmdline-parser.o: warning: objtool: missing symbol for section .text crypto/ecc.c:1112:9: warning: 'priv' may be used uninitialized [-Wmaybe-uninitialized] crypto/lrw.c:456:13: warning: mismatch in argument 1 type of built-in function 'free'; expected 'void *' [-Wbuiltin-declaration-mismatch] crypto/xts.c:396:13: warning: mismatch in argument 1 type of built-in function 'free'; expected 'void *' [-Wbuiltin-declaration-mismatch] drivers/nvdimm/label.o: warning: objtool: nd_blk_namespace_label_update()+0x1326: unreachable instruction drivers/pinctrl/core.c:1338: error: Cannot parse struct or union! drivers/tty/tty_buffer.c:170:2: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] drivers/tty/tty_buffer.c:172:2: error: implicit declaration of function 'printk_safe_exit'; did you mean 'printk_nmi_exit'? [-Werror=implicit-function-declaration] drivers/usb/typec/tcpm.c:4421:45: sparse: sparse: unsigned value that used to be signed checked against zero? include/asm-generic/io.h:742:19: warning: 'reg' may be used uninitialized in this function [-Wmaybe-uninitialized] include/linux/list.h:63:20: warning: storing the address of local variable 'wait' in '((struct list_head *)x)[1].prev' [-Wdangling-pointer=] include/linux/list.h:63:20: warning: storing the address of local variable 'waiter' in '*(struct list_head *)((char *)sem + 8).prev' [-Wdangling-pointer=] include/linux/list.h:65:19: warning: storing the address of local variable 'queue' in '*(struct list_head *)packet.prev' [-Wdangling-pointer=] include/linux/signal.h:180:29: warning: this statement may fall through [-Wimplicit-fallthrough=] include/linux/skbuff.h:1869:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct ieee80211_tx_data[1]' [-Warray-bounds] include/linux/string.h:333:16: warning: '__builtin_memset' offset [48, 55] is out of the bounds [0, 48] [-Warray-bounds] include/linux/thread_info.h:59:17: warning: 'header' may be used uninitialized [-Wmaybe-uninitialized] include/linux/tty_flip.h:27:32: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] include/linux/unaligned/access_ok.h:40:24: warning: array subscript -1 is outside array bounds of 'struct retrieve_data_struct_cmd[1]' [-Warray-bounds=] mm/memcontrol.c:6287: warning: bad line: | 0, otherwise. mm/page_owner.o: warning: objtool: missing symbol for section .text.unlikely. mm/rmap.c:906:17: warning: variable 'cstart' set but not used [-Wunused-but-set-variable] mm/swap_state.o: warning: objtool: missing symbol for section .text.unlikely. Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- crypto-lrw.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-asm-generic-io.h:warning:this-statement-may-fall-through | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-skbuff.h:warning:array-subscript-struct-sk_buff-is-partly-outside-array-bounds-of-struct-ieee80211_tx_data | |-- include-linux-string.h:warning:__builtin_memset-offset-is-out-of-the-bounds | |-- include-linux-unaligned-access_ok.h:warning:array-subscript-is-outside-array-bounds-of-struct-retrieve_data_struct_cmd | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rodata_test.c:warning:no-previous-prototype-for-rodata_test |-- arm64-allnoconfig | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-wait-in-((struct-list_head-)x)-.prev | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-waiter-in-(struct-list_head-)((char-)sem-).prev | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | |-- mm-rmap.c:warning:variable-cstart-set-but-not-used | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-defconfig | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- include-asm-generic-io.h:warning:this-statement-may-fall-through | |-- include-linux-list.h:warning:storing-the-address-of-local-variable-waiter-in-(struct-list_head-)((char-)sem-).prev | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-skbuff.h:warning:array-subscript-struct-sk_buff-is-partly-outside-array-bounds-of-struct-ieee80211_tx_data | `-- mm-memcontrol.c:warning:bad-line:otherwise. |-- arm64-randconfig-001-20250705 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter | `-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-001-20250930 | `-- include-asm-generic-io.h:warning:reg-may-be-used-uninitialized-in-this-function |-- arm64-randconfig-001-20251027 | |-- crypto-lrw.c:warning:mismatch-in-argument-type-of-built-in-function-free-expected-void | `-- crypto-xts.c:warning:mismatch-in-argument-type-of-built-in-function-free-expected-void |-- arm64-randconfig-001-20251029 | `-- include-linux-thread_info.h:warning:header-may-be-used-uninitialized |-- arm64-randconfig-001-20251125 | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- include-linux-skbuff.h:warning:array-subscript-struct-sk_buff-is-partly-outside-array-bounds-of-struct-ieee80211_tx_data | `-- include-linux-string.h:warning:__builtin_memset-offset-is-out-of-the-bounds |-- arm64-randconfig-001-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-002-20250929 | `-- include-linux-list.h:warning:storing-the-address-of-local-variable-queue-in-(struct-list_head-)packet.prev |-- arm64-randconfig-002-20251014 | `-- include-linux-tty_flip.h:warning:writing-byte-into-a-region-of-size |-- arm64-randconfig-002-20251202 | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- kernel-time-posix-cpu-timers.c:warning:now-may-be-used-uninitialized-in-this-function | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-003-20250830 | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-003-20250930 | |-- include-linux-uaccess.h:warning:be-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:bulk-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:dc-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:fl-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:from-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:fs-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:gd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:guest_cid-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:lnr-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:mreq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:oir-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:r32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:start-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:tx32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ucnt-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:uss32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:v-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:v32-may-be-used-uninitialized | `-- include-linux-uaccess.h:warning:vr-may-be-used-uninitialized |-- arm64-randconfig-003-20251027 | |-- lib-lockref.c:error:unable-to-generate-reloads-for: | `-- lib-lockref.c:internal-compiler-error:in-curr_insn_transform-at-lra-constraints.c |-- arm64-randconfig-003-20251115 | `-- include-linux-unaligned-access_ok.h:warning:array-subscript-is-outside-array-bounds-of-struct-retrieve_data_struct_cmd |-- arm64-randconfig-003-20251202 | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-skbuff.h:warning:array-subscript-struct-sk_buff-is-partly-outside-array-bounds-of-struct-ieee80211_tx_data | |-- include-linux-unaligned-access_ok.h:warning:array-subscript-is-outside-array-bounds-of-struct-retrieve_data_struct_cmd | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled |-- arm64-randconfig-004-20250729 | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:agt_ctrl-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:c_value_r-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:data-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:r_data-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:r_value-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:read_value-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:spi_val-may-be-used-uninitialized-in-this-function | |-- drivers-scsi-qla2xxx-qla_nx2.c:warning:temp-may-be-used-uninitialized-in-this-function | `-- drivers-scsi-qla2xxx-qla_nx2.c:warning:value-may-be-used-uninitialized-in-this-function |-- arm64-randconfig-004-20251111 | |-- crypto-lrw.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | `-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) |-- arm64-randconfig-004-20251202 | |-- crypto-ecc.c:warning:priv-may-be-used-uninitialized | |-- crypto-lrw.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- crypto-xts.c:warning:conflicting-types-for-built-in-function-free-expected-void(void-) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- include-asm-generic-io.h:warning:this-statement-may-fall-through | |-- include-linux-mempolicy.h:warning:__do_mbind-defined-but-not-used | |-- include-linux-printk.h:warning:this-statement-may-fall-through | |-- include-linux-signal.h:warning:this-statement-may-fall-through | |-- include-linux-string.h:warning:__builtin_memset-offset-is-out-of-the-bounds | |-- mm-memory.c:error:implicit-declaration-of-function-hugetlb_insert_hugepage_pte_by_pa | |-- mm-rmap.c:warning:no-previous-prototype-for-is_vma_temporary_stack | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- arm64-randconfig-r061-20251031 | `-- drivers-block-rbd.c:WARNING-opportunity-for-min() |-- arm64-randconfig-r134-20251105 | `-- drivers-usb-typec-tcpm.c:sparse:sparse:unsigned-value-that-used-to-be-signed-checked-against-zero |-- x86_64-allmodconfig | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-allnoconfig | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-allnoconfig-bpf | |-- (.text):undefined-reference-to-_DYNAMIC | |-- (.text):undefined-reference-to-_fini | |-- (.text):undefined-reference-to-_init | |-- usr-include-bits-floatn.h:error:__float128-is-not-supported-on-this-target | `-- usr-include-bits-floatn.h:error:unsupported-machine-mode-__TC__ |-- x86_64-allyesconfig | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-buildonly-randconfig-001-20250401 | `-- drivers-nvdimm-label.o:warning:objtool:nd_blk_namespace_label_update:unreachable-instruction |-- x86_64-buildonly-randconfig-001-20250718 | |-- block-cmdline-parser.o:warning:objtool:missing-symbol-for-section-.text | `-- mm-swap_state.o:warning:objtool:missing-symbol-for-section-.text.unlikely. |-- x86_64-buildonly-randconfig-003-20250207 | `-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- x86_64-buildonly-randconfig-003-20250704 | `-- mm-page_owner.o:warning:objtool:missing-symbol-for-section-.text.unlikely. |-- x86_64-buildonly-randconfig-003-20251028 | |-- block-bfq-cgroup.o:warning:objtool:missing-symbol-for-section-.text | |-- block-bfq-wf2q.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-lib.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-mq-pci.o:warning:objtool:missing-symbol-for-section-.text | |-- block-cmdline-parser.o:warning:objtool:missing-symbol-for-section-.text | |-- block-ioctl.o:warning:objtool:missing-symbol-for-section-.text | |-- block-partitions-check.o:warning:objtool:missing-symbol-for-section-.text | |-- block-scsi_ioctl.o:warning:objtool:missing-symbol-for-section-.text | |-- mm-debug.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | |-- mm-kmemleak.o:warning:objtool:missing-symbol-for-section-.ref.text | `-- mm-memcontrol.o:warning:objtool:missing-symbol-for-section-.text.unlikely. |-- x86_64-buildonly-randconfig-003-20251202 | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-buildonly-randconfig-005-20241216 | `-- mm-vmscan.c:error:implicit-declaration-of-function-kernel_swap_enabled-Werror-Wimplicit-function-declaration |-- x86_64-buildonly-randconfig-005-20250714 | |-- block-bfq-cgroup.o:warning:objtool:missing-symbol-for-section-.text | |-- block-blk-mq-rdma.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-isdn-mISDN-dsp_cmx.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | |-- drivers-isdn-mISDN-dsp_hwec.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | `-- drivers-net-can-usb-peak_usb-pcan_usb_core.o:warning:objtool:missing-symbol-for-section-.text.unlikely. |-- x86_64-buildonly-randconfig-005-20250806 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | `-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue |-- x86_64-buildonly-randconfig-005-20250820 | `-- mm-early_ioremap.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-buildonly-randconfig-006-20250924 | |-- drivers-media-pci-cobalt-cobalt-i2c.o:warning:objtool:missing-symbol-for-section-.text.unlikely. | `-- drivers-media-pci-cobalt-cobalt-irq.o:warning:objtool:missing-symbol-for-section-.text |-- x86_64-randconfig-001-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-002-20251202 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-006-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-011-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-014-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-015-20251202 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-016-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-071-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-072-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-073-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-074-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-075-20251202 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-076-20251202 | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-101-20241223 | `-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction |-- x86_64-randconfig-101-20251203 | |-- block-blk-core.c:preceding-lock-on-line | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- crypto-aead.c:opportunity-for-str_yes_no(alg-cra_flags-CRYPTO_ALG_ASYNC) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-103-20250219 | |-- kernel-sched-debug.c:error:no-member-named-nr_wakeups_force_preferred_cpus-in-struct-dyn_affinity_stats | `-- kernel-sched-debug.c:error:no-member-named-nr_wakeups_preferred_cpus-in-struct-dyn_affinity_stats |-- x86_64-randconfig-103-20250305 | `-- drivers-gpu-drm-amd-amdgpu-amdgpu_ids.o:warning:objtool:amdgpu_vmid_grab:unreachable-instruction |-- x86_64-randconfig-103-20251115 | `-- block-blk-throttle.c:preceding-lock-on-line |-- x86_64-randconfig-103-20251203 | |-- crypto-aead.c:opportunity-for-str_yes_no(alg-cra_flags-CRYPTO_ALG_ASYNC) | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-121-20251203 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool | |-- mm-memcontrol.c:warning:bad-line:otherwise. | |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-122-20251203 | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue | |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | |-- fs-ext4-mballoc.o:warning:objtool:ext4_mb_complex_scan_group:unreachable-instruction | |-- mm-memcontrol.c:warning:bad-line:otherwise. | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used |-- x86_64-randconfig-161-20251202 | |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union | `-- mm-rmap.c:warning:variable-cstart-set-but-not-used `-- x86_64-rhel-9.4-rust |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_issue |-- block-blk-wbt.c:warning:no-previous-prototype-for-function-wbt_requeue |-- drivers-pinctrl-core.c:error:Cannot-parse-struct-or-union |-- mm-hugetlb.c:warning:no-previous-prototype-for-function-free_huge_page_to_dhugetlb_pool |-- mm-memcontrol.c:warning:bad-line:otherwise. |-- mm-memory.c:warning:cast-from-int-(-)(unsigned-long-unsigned-long-struct-cgp_args-)-to-ktask_thread_func-(aka-int-(-)(void-void-void-)-)-converts-to-incompatible-function-type `-- mm-rmap.c:warning:variable-cstart-set-but-not-used elapsed time: 1451m configs tested: 36 configs skipped: 8 tested configs: arm64 allmodconfig gcc-15.1.0 arm64 allnoconfig gcc-15.1.0 arm64 defconfig gcc-15.1.0 arm64 randconfig-001-20251202 gcc-8.5.0 arm64 randconfig-002-20251202 gcc-10.5.0 arm64 randconfig-003-20251202 gcc-14.3.0 arm64 randconfig-004-20251202 gcc-12.5.0 x86_64 allmodconfig clang-22 x86_64 allnoconfig clang-22 x86_64 allyesconfig clang-22 x86_64 buildonly-randconfig-001-20251202 gcc-14 x86_64 buildonly-randconfig-002-20251202 gcc-14 x86_64 buildonly-randconfig-003-20251202 clang-22 x86_64 buildonly-randconfig-004-20251202 gcc-13 x86_64 buildonly-randconfig-005-20251202 gcc-14 x86_64 buildonly-randconfig-006-20251202 gcc-13 x86_64 defconfig gcc-14 x86_64 randconfig-001-20251202 clang-22 x86_64 randconfig-002-20251202 clang-22 x86_64 randconfig-003-20251202 gcc-14 x86_64 randconfig-004-20251202 gcc-14 x86_64 randconfig-005-20251202 gcc-14 x86_64 randconfig-006-20251202 clang-22 x86_64 randconfig-011-20251202 clang-22 x86_64 randconfig-012-20251202 gcc-13 x86_64 randconfig-013-20251202 gcc-14 x86_64 randconfig-014-20251202 clang-22 x86_64 randconfig-015-20251202 clang-22 x86_64 randconfig-016-20251202 clang-22 x86_64 randconfig-071-20251202 clang-22 x86_64 randconfig-072-20251202 clang-22 x86_64 randconfig-073-20251202 clang-22 x86_64 randconfig-074-20251202 clang-22 x86_64 randconfig-075-20251202 clang-22 x86_64 randconfig-076-20251202 clang-22 x86_64 rhel-9.4-rust clang-22 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/scheduler: signal scheduled fence when kill job
by Yao Kai 03 Dec '25

03 Dec '25

From: "Lin.Cao" <lincao12(a)amd.com> stable inclusion from stable-v6.6.96 commit c5734f9bab6f0d40577ad0633af4090a5fda2407 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXL7 CVE: CVE-2025-38436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 471db2c2d4f80ee94225a1ef246e4f5011733e50 ] When an entity from application B is killed, drm_sched_entity_kill() removes all jobs belonging to that entity through drm_sched_entity_kill_jobs_work(). If application A's job depends on a scheduled fence from application B's job, and that fence is not properly signaled during the killing process, application A's dependency cannot be cleared. This leads to application A hanging indefinitely while waiting for a dependency that will never be resolved. Fix this issue by ensuring that scheduled fences are properly signaled when an entity is killed, allowing dependent applications to continue execution. Signed-off-by: Lin.Cao <lincao12(a)amd.com> Reviewed-by: Philipp Stanner <phasta(a)kernel.org> Signed-off-by: Christian König <christian.koenig(a)amd.com> Link: https://lore.kernel.org/r/20250515020713.1110476-1-lincao12@amd.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/gpu/drm/scheduler/sched_entity.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c index 53130a50584c..eed3b8bed9e4 100644 --- a/drivers/gpu/drm/scheduler/sched_entity.c +++ b/drivers/gpu/drm/scheduler/sched_entity.c @@ -167,6 +167,7 @@ static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk) { struct drm_sched_job *job = container_of(wrk, typeof(*job), work); + drm_sched_fence_scheduled(job->s_fence, NULL); drm_sched_fence_finished(job->s_fence, -ESRCH); WARN_ON(job->s_fence->parent); job->sched->ops->free_job(job); -- 2.43.0

2 1

[PATCH OLK-5.10] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
by Yin Tirui 03 Dec '25

03 Dec '25

From: Mike Christie <michael.christie(a)oracle.com> mainline inclusion from mainline-v6.15-rc1 commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP35K CVE: CVE-2025-22083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do: vhost_vq_set_backend(vq, vs_tpg); ... kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If vhost_scsi_set_endpoint is called again and no tpgs are found match=false so we skip the vhost_vq_set_backend call leaving the pointer to the vs_tpg we then free via: kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If a scsi request is then sent we do: vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend which sees the vs_tpg we just did a kfree on. 2. Tpg dir removal hang: This patch fixes an issue where we cannot remove a LIO/target layer tpg (and structs above it like the target) dir due to the refcount dropping to -1. The problem is that if vhost_scsi_set_endpoint detects a tpg is already in the vs->vs_tpg array or if the tpg has been removed so target_depend_item fails, the undepend goto handler will do target_undepend_item on all tpgs in the vs_tpg array dropping their refcount to 0. At this time vs_tpg contains both the tpgs we have added in the current vhost_scsi_set_endpoint call as well as tpgs we added in previous calls which are also in vs->vs_tpg. Later, when vhost_scsi_clear_endpoint runs it will do target_undepend_item on all the tpgs in the vs->vs_tpg which will drop their refcount to -1. Userspace will then not be able to remove the tpg and will hang when it tries to do rmdir on the tpg dir. 3. Tpg leak: This fixes a bug where we can leak tpgs and cause them to be un-removable because the target name is overwritten when vhost_scsi_set_endpoint is called multiple times but with different target names. The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup a vhost-scsi device to target/tpg mapping, then calls VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we haven't seen before (target1 has tpg1 but target2 has tpg2). When this happens we don't teardown the old target tpg mapping and just overwrite the target name and the vs->vs_tpg array. Later when we do vhost_scsi_clear_endpoint, we are passed in either target1 or target2's name and we will only match that target's tpgs when we loop over the vs->vs_tpg. We will then return from the function without doing target_undepend_item on the tpgs. Because of all these bugs, it looks like being able to call vhost_scsi_set_endpoint multiple times was never supported. The major user, QEMU, already has checks to prevent this use case. So to fix the issues, this patch prevents vhost_scsi_set_endpoint from being called if it's already successfully added tpgs. To add, remove or change the tpg config or target name, you must do a vhost_scsi_clear_endpoint first. Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session") Fixes: 4f7f46d32c98 ("tcm_vhost: Use vq->private_data to indicate if the endpoint is setup") Reported-by: Haoran Zhang <wh1sper(a)zju.edu.cn> Closes: https://lore.kernel.org/virtualization/e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e… Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Message-Id: <20250129210922.121533-1-michael.christie(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Stefano Garzarella <sgarzare(a)redhat.com> Conflicts: drivers/vhost/scsi.c [Fixing context conflicts] Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/vhost/scsi.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index a23a65e7d828..f896c8a83f1a 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1589,14 +1589,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } } + if (vs->vs_tpg) { + pr_err("vhost-scsi endpoint already set for %s.\n", + vs->vs_vhost_wwpn); + ret = -EEXIST; + goto out; + } + len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET; vs_tpg = kzalloc(len, GFP_KERNEL); if (!vs_tpg) { ret = -ENOMEM; goto out; } - if (vs->vs_tpg) - memcpy(vs_tpg, vs->vs_tpg, len); list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) { mutex_lock(&tpg->tv_tpg_mutex); @@ -1611,11 +1616,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, tv_tport = tpg->tport; if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) { - if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { - mutex_unlock(&tpg->tv_tpg_mutex); - ret = -EEXIST; - goto undepend; - } /* * In order to ensure individual vhost-scsi configfs * groups cannot be removed while in use by vhost ioctl, @@ -1660,15 +1660,15 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } ret = 0; } else { - ret = -EEXIST; + ret = -ENODEV; + goto free_tpg; } /* - * Act as synchronize_rcu to make sure access to - * old vs->vs_tpg is finished. + * Act as synchronize_rcu to make sure requests after this point + * see a fully setup device. */ vhost_scsi_flush(vs); - kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; goto out; @@ -1685,6 +1685,7 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, target_undepend_item(&tpg->se_tpg.tpg_group.cg_item); } } +free_tpg: kfree(vs_tpg); out: mutex_unlock(&vs->dev.mutex); @@ -1773,6 +1774,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, vhost_scsi_flush(vs); kfree(vs->vs_tpg); vs->vs_tpg = NULL; + memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn)); WARN_ON(vs->vs_events_nr); mutex_unlock(&vs->dev.mutex); mutex_unlock(&vhost_scsi_mutex); -- 2.22.0

2 1

[RFC PATCH openEuler-1.0-LTS 0/4] add mcs support for migrate pages
by Wupeng Ma 03 Dec '25

03 Dec '25

Add mcs support for migrate page & support disabling soft offline for HugeTLB pages. Since UCE kernel recovery is needed by this. This should be enable with the following step: - echo 1 > /proc/sys/kernel/uce_kernel_recovery Disable soft offline support for hugetlb with the following step: - echo 3 > /proc/sys/vm/enable_soft_offline Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Wupeng Ma (2): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page .../ABI/testing/sysfs-memory-page-offline | 3 + include/linux/highmem.h | 55 +++++++++++++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 +++ mm/memory-failure.c | 25 +++++- mm/migrate.c | 79 ++++++++++++++++--- 6 files changed, 162 insertions(+), 10 deletions(-) -- 2.43.0

1 4

[RFC PATCH openEuler-1.0-LTS 0/4] add mcs support for migrate pages
by Wupeng Ma 03 Dec '25

03 Dec '25

Add mcs support for migrate page & support disabling soft offline for HugeTLB pages. Since UCE kernel recovery is needed by this. This should be enable with the following step: - echo 1 > /proc/sys/kernel/uce_kernel_recovery Disable soft offline support for hugetlb with the following step: - echo 3 > /proc/sys/vm/enable_soft_offline Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Wupeng Ma (2): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page .../ABI/testing/sysfs-memory-page-offline | 3 + include/linux/highmem.h | 55 +++++++++++++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 +++ mm/memory-failure.c | 25 +++++- mm/migrate.c | 79 ++++++++++++++++--- 6 files changed, 162 insertions(+), 10 deletions(-) -- 2.43.0

1 4

[RFC PATCH openEuler-1.0-LTS 0/4] add mcs support for migrate pages
by Wupeng Ma 03 Dec '25

03 Dec '25

Add mcs support for migrate page & support disabling soft offline for HugeTLB pages. Since UCE kernel recovery is needed by this. This should be enable with the following step: - echo 1 > /proc/sys/kernel/uce_kernel_recovery Disable soft offline support for hugetlb with the following step: - echo 3 > /proc/sys/vm/enable_soft_offline Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Wupeng Ma (2): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page .../ABI/testing/sysfs-memory-page-offline | 3 + include/linux/highmem.h | 55 +++++++++++++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 +++ mm/memory-failure.c | 25 +++++- mm/migrate.c | 77 ++++++++++++++++--- 6 files changed, 160 insertions(+), 10 deletions(-) -- 2.43.0

1 4

[openeuler:OLK-6.6 3450/3450] include/linux/syscalls.h:954:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 03 Dec '25

03 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 1121c5557ede2747d2d2afc41d1141f25a5dcd0a commit: 832cfa264d7c521e75b1b9ecb763c1f67993ad0e [3450/3450] xsched: add xsched_{set,get}attr syscall config: loongarch-randconfig-002-20251203 (https://download.01.org/0day-ci/archive/20251203/202512030635.76WFoVdZ-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251203/202512030635.76WFoVdZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512030635.76WFoVdZ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/filemap.c:25: >> include/linux/syscalls.h:954:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ include/linux/syscalls.h:955:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ In file included from mm/filemap.c:55: mm/internal.h: In function 'shrinker_debugfs_name_alloc': mm/internal.h:1508:9: warning: function 'shrinker_debugfs_name_alloc' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 1508 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^~~~~~~~ -- In file included from mm/mempolicy.c:107: >> include/linux/syscalls.h:954:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ include/linux/syscalls.h:955:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ In file included from mm/mempolicy.c:119: mm/internal.h: In function 'shrinker_debugfs_name_alloc': mm/internal.h:1508:9: warning: function 'shrinker_debugfs_name_alloc' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 1508 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^~~~~~~~ mm/mempolicy.c: In function 'migrate_area_to_node': mm/mempolicy.c:1143:32: warning: variable 'vma' set but not used [-Wunused-but-set-variable] 1143 | struct vm_area_struct *vma; | ^~~ -- In file included from mm/msync.c:15: >> include/linux/syscalls.h:954:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ include/linux/syscalls.h:955:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ -- In file included from mm/madvise.c:11: >> include/linux/syscalls.h:954:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ include/linux/syscalls.h:955:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ In file included from mm/madvise.c:37: mm/internal.h: In function 'shrinker_debugfs_name_alloc': mm/internal.h:1508:9: warning: function 'shrinker_debugfs_name_alloc' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] 1508 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^~~~~~~~ mm/madvise.c: At top level: mm/madvise.c:285:6: warning: no previous prototype for 'force_swapin_vma' [-Wmissing-prototypes] 285 | void force_swapin_vma(struct vm_area_struct *vma) | ^~~~~~~~~~~~~~~~ vim +954 include/linux/syscalls.h 953 > 954 asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); 955 asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); 956 /* 957 * Architecture-specific system calls 958 */ 959 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3358/3358] include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast
by kernel test robot 03 Dec '25

03 Dec '25

Hi SeongJae, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 03e082d09650967490d956864473e92a29ee350f commit: 83b931be40b2829e20f38356509d8706ea6b6238 [3358/3358] mm/damon/core-test: test damon_set_regions config: x86_64-randconfig-001-20251203 (https://download.01.org/0day-ci/archive/20251203/202512030654.YOYxPYw8-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251203/202512030654.YOYxPYw8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512030654.YOYxPYw8-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/kernel.h:14, from arch/x86/include/asm/percpu.h:27, from arch/x86/include/asm/current.h:6, from include/linux/mutex.h:14, from include/linux/damon.h:11, from mm/damon/core.c:10: mm/damon/core-test.h: In function 'damon_test_set_regions': >> include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types] 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ include/kunit/test.h:748:16: note: in expansion of macro '__typecheck' 748 | ((void)__typecheck(__left, __right)); \ | ^~~~~~~~~~~ include/kunit/test.h:772:9: note: in expansion of macro 'KUNIT_BASE_BINARY_ASSERTION' 772 | KUNIT_BASE_BINARY_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:861:9: note: in expansion of macro 'KUNIT_BASE_EQ_MSG_ASSERTION' 861 | KUNIT_BASE_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:871:9: note: in expansion of macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' 871 | KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:1234:9: note: in expansion of macro 'KUNIT_BINARY_EQ_ASSERTION' 1234 | KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) | ^~~~~~~~~~~~~~~~~~~~~~~~~ mm/damon/core-test.h:284:9: note: in expansion of macro 'KUNIT_EXPECT_EQ' 284 | KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); | ^~~~~~~~~~~~~~~ vim +20 include/linux/minmax.h cffb222bc2e032 Rikard Falkeborn 2021-06-07 6 b296a6d53339a7 Andy Shevchenko 2020-10-15 7 /* b296a6d53339a7 Andy Shevchenko 2020-10-15 8 * min()/max()/clamp() macros must accomplish three things: b296a6d53339a7 Andy Shevchenko 2020-10-15 9 * b296a6d53339a7 Andy Shevchenko 2020-10-15 10 * - avoid multiple evaluations of the arguments (so side-effects like b296a6d53339a7 Andy Shevchenko 2020-10-15 11 * "x++" happen only once) when non-constant. b296a6d53339a7 Andy Shevchenko 2020-10-15 12 * - perform strict type-checking (to generate warnings instead of b296a6d53339a7 Andy Shevchenko 2020-10-15 13 * nasty runtime surprises). See the "unnecessary" pointer comparison b296a6d53339a7 Andy Shevchenko 2020-10-15 14 * in __typecheck(). b296a6d53339a7 Andy Shevchenko 2020-10-15 15 * - retain result as a constant expressions when called with only b296a6d53339a7 Andy Shevchenko 2020-10-15 16 * constant expressions (to avoid tripping VLA warnings in stack b296a6d53339a7 Andy Shevchenko 2020-10-15 17 * allocation usage). b296a6d53339a7 Andy Shevchenko 2020-10-15 18 */ b296a6d53339a7 Andy Shevchenko 2020-10-15 19 #define __typecheck(x, y) \ b296a6d53339a7 Andy Shevchenko 2020-10-15 @20 (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) b296a6d53339a7 Andy Shevchenko 2020-10-15 21 :::::: The code at line 20 was first introduced by commit :::::: b296a6d53339a79082c1d2c1761e948e8b3def69 kernel.h: split out min()/max() et al. helpers :::::: TO: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] Revert "PCI/MSI: Set device flag indicating only 32-bit MSI support"
by Tengda Wu 02 Dec '25

02 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDA4OZ -------------------------------- This reverts commit 9b0bfa99350a6049471b37927d7b941f61dd5edb. The commit causes the CX6 NIC to be unrecognized, so revert it to temporarily avoid this issue. Fixes: 9b0bfa99350a ("PCI/MSI: Set device flag indicating only 32-bit MSI support") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/pci/msi.c | 8 ++++---- drivers/pci/probe.c | 6 ------ 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c index 0d6711e07bca..edbb05145479 100644 --- a/drivers/pci/msi.c +++ b/drivers/pci/msi.c @@ -624,11 +624,11 @@ static int msi_verify_entries(struct pci_dev *dev) struct msi_desc *entry; for_each_pci_msi_entry(entry, dev) { - if (entry->msg.address_hi && dev->no_64bit_msi) { - pci_err(dev, "arch assigned 64-bit MSI address %#x%08x but device only supports 32 bits\n", - entry->msg.address_hi, entry->msg.address_lo); + if (!dev->no_64bit_msi || !entry->msg.address_hi) + continue; + pci_err(dev, "Device has broken 64-bit MSI but arch" + " tried to assign one above 4G\n"); return -EIO; - } } return 0; } diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index d41f5fd2c205..77772e6f4e35 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -1724,8 +1724,6 @@ static u8 pci_hdr_type(struct pci_dev *dev) static void pci_msi_setup_pci_dev(struct pci_dev *dev) { - u16 ctrl; - /* * Disable the MSI hardware to avoid screaming interrupts * during boot. This is the power on reset default so @@ -1735,10 +1733,6 @@ static void pci_msi_setup_pci_dev(struct pci_dev *dev) if (dev->msi_cap) pci_msi_set_enable(dev, 0); - pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &ctrl); - if (!(ctrl & PCI_MSI_FLAGS_64BIT)) - dev->no_64bit_msi = 1; - dev->msix_cap = pci_find_capability(dev, PCI_CAP_ID_MSIX); if (dev->msix_cap) pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0); -- 2.34.1

2 1

[PATCH OLK-5.10] memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Luo Qiu <luoqiu(a)kylinsec.com.cn> stable inclusion from stable-v5.10.236 commit 9dfaf4d723c62bda8d9d1340e2e78acf0c190439 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1PGY CVE: CVE-2025-22020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4676741a3464b300b486e70585c3c9b692be1632 upstream. This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_one_work+0x357/0x660 worker_thread+0x390/0x4c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x190/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 161446: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x1a7/0x470 memstick_alloc_host+0x1f/0xe0 [memstick] rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] platform_probe+0x60/0xe0 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 bus_probe_device+0xbd/0xd0 device_add+0x4a5/0x760 platform_device_add+0x189/0x370 mfd_add_device+0x587/0x5e0 mfd_add_devices+0xb1/0x130 rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] usb_probe_interface+0x15c/0x460 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 rebind_marked_interfaces.isra.0+0xcc/0x110 usb_reset_device+0x352/0x410 usbdev_do_ioctl+0xe5c/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 161506: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0x34/0x50 kfree+0x1fd/0x3b0 device_release+0x56/0xf0 kobject_cleanup+0x73/0x1c0 rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] platform_remove+0x2f/0x50 device_release_driver_internal+0x24b/0x2e0 bus_remove_device+0x124/0x1d0 device_del+0x239/0x530 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x40 mfd_remove_devices_fn+0x167/0x170 device_for_each_child_reverse+0xc9/0x130 mfd_remove_devices+0x6e/0xa0 rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] usb_unbind_interface+0xf3/0x3f0 device_release_driver_internal+0x24b/0x2e0 proc_disconnect_claim+0x13d/0x220 usbdev_do_ioctl+0xb5e/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 The buggy address belongs to the object at ffff888136335000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 896 bytes inside of freed 2048-byte region [ffff888136335000, ffff888136335800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136330 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 0017ffffc0000003 ffffea0004d8cc01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888136335280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888136335300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888136335380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888136335400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888136335480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management") Signed-off-by: Luo Qiu <luoqiu(a)kylinsec.com.cn> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/4B7BC3E6E291E6F2+20250317101438.25650-1-luoqiu@ky… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/memstick/host/rtsx_usb_ms.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c index 29271ad4728a..dec279845a75 100644 --- a/drivers/memstick/host/rtsx_usb_ms.c +++ b/drivers/memstick/host/rtsx_usb_ms.c @@ -813,6 +813,7 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) host->eject = true; cancel_work_sync(&host->handle_req); + cancel_delayed_work_sync(&host->poll_card); mutex_lock(&host->host_mutex); if (host->req) { -- 2.43.0

2 1

[PATCH OLK-5.10] Revert "PCI/MSI: Set device flag indicating only 32-bit MSI support"
by Tengda Wu 02 Dec '25

02 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDA4OZ -------------------------------- This reverts commit 9b0bfa99350a6049471b37927d7b941f61dd5edb. The commit causes the CX6 NIC to be unrecognized, so revert it to temporarily avoid this issue. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/pci/msi.c | 8 ++++---- drivers/pci/probe.c | 6 ------ 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c index 0d6711e07bca..edbb05145479 100644 --- a/drivers/pci/msi.c +++ b/drivers/pci/msi.c @@ -624,11 +624,11 @@ static int msi_verify_entries(struct pci_dev *dev) struct msi_desc *entry; for_each_pci_msi_entry(entry, dev) { - if (entry->msg.address_hi && dev->no_64bit_msi) { - pci_err(dev, "arch assigned 64-bit MSI address %#x%08x but device only supports 32 bits\n", - entry->msg.address_hi, entry->msg.address_lo); + if (!dev->no_64bit_msi || !entry->msg.address_hi) + continue; + pci_err(dev, "Device has broken 64-bit MSI but arch" + " tried to assign one above 4G\n"); return -EIO; - } } return 0; } diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index d41f5fd2c205..77772e6f4e35 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -1724,8 +1724,6 @@ static u8 pci_hdr_type(struct pci_dev *dev) static void pci_msi_setup_pci_dev(struct pci_dev *dev) { - u16 ctrl; - /* * Disable the MSI hardware to avoid screaming interrupts * during boot. This is the power on reset default so @@ -1735,10 +1733,6 @@ static void pci_msi_setup_pci_dev(struct pci_dev *dev) if (dev->msi_cap) pci_msi_set_enable(dev, 0); - pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &ctrl); - if (!(ctrl & PCI_MSI_FLAGS_64BIT)) - dev->no_64bit_msi = 1; - dev->msix_cap = pci_find_capability(dev, PCI_CAP_ID_MSIX); if (dev->msix_cap) pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0); -- 2.34.1

2 1

[PATCH OLK-6.6] net/sched: Abort __tc_modify_qdisc if parent class does not exist
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Victor Nogueira <victor(a)mojatatu.com> mainline inclusion from mainline-v6.16-rc6 commit ffdde7bf5a439aaa1955ebd581f5c64ab1533963 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXOM CVE: CVE-2025-38457 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands: sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null. The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called. [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.c… Fixes: 5e50da01d0ce ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs") Reported-by: syzbot+d8b58d7b0ad89a678a16(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c93.a70a0220.5d25f.0857.GAE@google.com/ Reported-by: syzbot+5eccb463fa89309d8bdc(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c94.a70a0220.5d25f.0858.GAE@google.com/ Reported-by: syzbot+1261670bbdefc5485a06(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0013.GAE@google.com/ Reported-by: syzbot+15b96fc3aac35468fe77(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0014.GAE@google.com/ Reported-by: syzbot+4dadc5aecf80324d5a51(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68679e81.a70a0220.29cf51.0016.GAE@google.com/ Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Cong Wang <xiyou.wangcong(a)gmail.com> Signed-off-by: Victor Nogueira <victor(a)mojatatu.com> Link: https://patch.msgid.link/20250707210801.372995-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_api.c [commit 7c79cff95535 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_api.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 7528354abc3c..13055d6069b3 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -334,17 +334,22 @@ struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle) return q; } -static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid) +static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid, + struct netlink_ext_ack *extack) { unsigned long cl; const struct Qdisc_class_ops *cops = p->ops->cl_ops; - if (cops == NULL) - return NULL; + if (cops == NULL) { + NL_SET_ERR_MSG(extack, "Parent qdisc is not classful"); + return ERR_PTR(-EOPNOTSUPP); + } cl = cops->find(p, classid); - if (cl == 0) - return NULL; + if (cl == 0) { + NL_SET_ERR_MSG(extack, "Specified class not found"); + return ERR_PTR(-ENOENT); + } return cops->leaf(p, cl); } @@ -1496,7 +1501,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified classid"); return -ENOENT; } - q = qdisc_leaf(p, clid); + q = qdisc_leaf(p, clid, extack); } else if (dev_ingress_queue(dev)) { q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping); } @@ -1507,6 +1512,8 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device"); return -ENOENT; } + if (IS_ERR(q)) + return PTR_ERR(q); if (tcm->tcm_handle && q->handle != tcm->tcm_handle) { NL_SET_ERR_MSG(extack, "Invalid handle"); @@ -1600,7 +1607,9 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Failed to find specified qdisc"); return -ENOENT; } - q = qdisc_leaf(p, clid); + q = qdisc_leaf(p, clid, extack); + if (IS_ERR(q)) + return PTR_ERR(q); } else if (dev_ingress_queue_create(dev)) { q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping); } -- 2.25.1

2 1

[PATCH OLK-5.10] Bluetooth: hci_core: Fix use-after-free in vhci_flush()
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v6.16-rc4 commit 1d6123102e9fbedc8d25bf4731da6d513173e49e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICL7Y3 CVE: CVE-2025-38250 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its device was being used by iotcl() on another thread. Once the last fd refcnt is released, vhci_release() calls hci_unregister_dev(), hci_free_dev(), and kfree() for struct vhci_data, which is set to hci_dev->dev->driver_data. The problem is that there is no synchronisation after unlinking hdev from hci_dev_list in hci_unregister_dev(). There might be another thread still accessing the hdev which was fetched before the unlink operation. We can use SRCU for such synchronisation. Let's run hci_dev_reset() under SRCU and wait for its completion in hci_unregister_dev(). Another option would be to restore hci_dev->destruct(), which was removed in commit 587ae086f6e4 ("Bluetooth: Remove unused hci-destruct cb"). However, this would not be a good solution, as we should not run hci_unregister_dev() while there are in-flight ioctl() requests, which could lead to another data-race KCSAN splat. Note that other drivers seem to have the same problem, for exmaple, virtbt_remove(). [0]: BUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] BUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937 Read of size 8 at addr ffff88807cb8d858 by task syz.1.219/6718 CPU: 1 UID: 0 PID: 6718 Comm: syz.1.219 Not tainted 6.16.0-rc1-syzkaller-00196-g08207f42d3ff #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937 skb_queue_purge include/linux/skbuff.h:3368 [inline] vhci_flush+0x44/0x50 drivers/bluetooth/hci_vhci.c:69 hci_dev_do_reset net/bluetooth/hci_core.c:552 [inline] hci_dev_reset+0x420/0x5c0 net/bluetooth/hci_core.c:592 sock_do_ioctl+0xd9/0x300 net/socket.c:1190 sock_ioctl+0x576/0x790 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcf5b98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fcf5c7b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcf5bbb6160 RCX: 00007fcf5b98e929 RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000009 RBP: 00007fcf5ba10b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fcf5bbb6160 R15: 00007ffd6353d528 </TASK> Allocated by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] vhci_open+0x57/0x360 drivers/bluetooth/hci_vhci.c:635 misc_open+0x2bc/0x330 drivers/char/misc.c:161 chrdev_open+0x4c9/0x5e0 fs/char_dev.c:414 do_dentry_open+0xdf0/0x1970 fs/open.c:964 vfs_open+0x3b/0x340 fs/open.c:1094 do_open fs/namei.c:3887 [inline] path_openat+0x2ee5/0x3830 fs/namei.c:4046 do_filp_open+0x1fa/0x410 fs/namei.c:4073 do_sys_openat2+0x121/0x1c0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x18e/0x440 mm/slub.c:4842 vhci_release+0xbc/0xd0 drivers/bluetooth/hci_vhci.c:671 __fput+0x44c/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x6ad/0x22e0 kernel/exit.c:955 do_group_exit+0x21c/0x2d0 kernel/exit.c:1104 __do_sys_exit_group kernel/exit.c:1115 [inline] __se_sys_exit_group kernel/exit.c:1113 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1113 x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807cb8d800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 88 bytes inside of freed 1024-byte region [ffff88807cb8d800, ffff88807cb8dc00) Fixes: bf18c7118cf8 ("Bluetooth: vhci: Free driver_data on file release") Reported-by: syzbot+2faa4825e556199361f9(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f62d64848fc4c7c30cd6 Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Acked-by: Paul Menzel <pmenzel(a)molgen.mpg.de> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_core.c [commit 04425292a62c and 989fa5171f00 are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/bluetooth/hci_core.h | 2 ++ net/bluetooth/hci_core.c | 34 ++++++++++++++++++++++++++++---- 2 files changed, 32 insertions(+), 4 deletions(-) diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 40981e4d8176..e3f98bd831e0 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -28,6 +28,7 @@ #include <linux/idr.h> #include <linux/leds.h> #include <linux/rculist.h> +#include <linux/srcu.h> #include <net/bluetooth/hci.h> #include <net/bluetooth/hci_sock.h> @@ -290,6 +291,7 @@ struct amp_assoc { struct hci_dev { struct list_head list; + struct srcu_struct srcu; struct mutex lock; const char *name; diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index e5654f88bb17..0a517bdf2de6 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1040,7 +1040,7 @@ static int hci_linkpol_req(struct hci_request *req, unsigned long opt) /* Get HCI device by index. * Device is held on return. */ -struct hci_dev *hci_dev_get(int index) +static struct hci_dev *__hci_dev_get(int index, int *srcu_index) { struct hci_dev *hdev = NULL, *d; @@ -1053,6 +1053,8 @@ struct hci_dev *hci_dev_get(int index) list_for_each_entry(d, &hci_dev_list, list) { if (d->id == index) { hdev = hci_dev_hold(d); + if (srcu_index) + *srcu_index = srcu_read_lock(&d->srcu); break; } } @@ -1060,6 +1062,22 @@ struct hci_dev *hci_dev_get(int index) return hdev; } +struct hci_dev *hci_dev_get(int index) +{ + return __hci_dev_get(index, NULL); +} + +static struct hci_dev *hci_dev_get_srcu(int index, int *srcu_index) +{ + return __hci_dev_get(index, srcu_index); +} + +static void hci_dev_put_srcu(struct hci_dev *hdev, int srcu_index) +{ + srcu_read_unlock(&hdev->srcu, srcu_index); + hci_dev_put(hdev); +} + /* ---- Inquiry support ---- */ bool hci_discovery_active(struct hci_dev *hdev) @@ -1906,9 +1924,9 @@ static int hci_dev_do_reset(struct hci_dev *hdev) int hci_dev_reset(__u16 dev) { struct hci_dev *hdev; - int err; + int err, srcu_index; - hdev = hci_dev_get(dev); + hdev = hci_dev_get_srcu(dev, &srcu_index); if (!hdev) return -ENODEV; @@ -1930,7 +1948,7 @@ int hci_dev_reset(__u16 dev) err = hci_dev_do_reset(hdev); done: - hci_dev_put(hdev); + hci_dev_put_srcu(hdev, srcu_index); return err; } @@ -3596,6 +3614,11 @@ struct hci_dev *hci_alloc_dev(void) if (!hdev) return NULL; + if (init_srcu_struct(&hdev->srcu)) { + kfree(hdev); + return NULL; + } + hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); hdev->esco_type = (ESCO_HV1); hdev->link_mode = (HCI_LM_ACCEPT); @@ -3840,6 +3863,9 @@ void hci_unregister_dev(struct hci_dev *hdev) list_del(&hdev->list); write_unlock(&hci_dev_list_lock); + synchronize_srcu(&hdev->srcu); + cleanup_srcu_struct(&hdev->srcu); + cancel_work_sync(&hdev->rx_work); cancel_work_sync(&hdev->cmd_work); cancel_work_sync(&hdev->tx_work); -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.16-rc1 commit b85e3367a5716ed3662a4fe266525190d2af76df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4OD CVE: CVE-2025-38201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. Similar to: b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX") Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_set_pipapo.c [commit 07ace0bbe03b and 9f439bd6ef4f are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 1a76c9bf8fb9..c2d568259928 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -665,6 +665,11 @@ static int pipapo_resize(struct nft_pipapo_field *f, int old_rules, int rules) } mt: + if (rules > (INT_MAX / sizeof(*new_mt))) { + kvfree(new_lt); + return -ENOMEM; + } + new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL); if (!new_mt) { kvfree(new_lt); @@ -1358,6 +1363,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) src->bsize * sizeof(*dst->lt) * src->groups * NFT_PIPAPO_BUCKETS(src->bb)); + if (src->rules > (INT_MAX / sizeof(*src->mt))) + goto out_mt; + dst->mt = kvmalloc(src->rules * sizeof(*src->mt), GFP_KERNEL); if (!dst->mt) goto out_mt; -- 2.25.1

2 1

[PATCH OLK-5.10] RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> mainline inclusion from mainline-v6.15-rc1 commit d0706bfd3ee40923c001c6827b786a309e2a8713 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGALO CVE: CVE-2025-38022 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 strlen+0x93/0xa0 lib/string.c:420 __fortify_strlen include/linux/fortify-string.h:268 [inline] get_kobj_path_length lib/kobject.c:118 [inline] kobject_get_path+0x3f/0x2a0 lib/kobject.c:158 kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545 ib_register_device drivers/infiniband/core/device.c:1472 [inline] ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393 rxe_register_device+0x275/0x320 drivers/infiniband/sw/rxe/rxe_verbs.c:1552 rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550 rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225 nldev_newlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796 rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195 rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620 __sys_sendmsg+0x16d/0x220 net/socket.c:2652 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This problem is similar to the problem that the commit 1d6a9e7449e2 ("RDMA/core: Fix use-after-free when rename device name") fixes. The root cause is: the function ib_device_rename() renames the name with lock. But in the function kobject_uevent(), this name is accessed without lock protection at the same time. The solution is to add the lock protection when this name is accessed in the function kobject_uevent(). Fixes: 779e0bf47632 ("RDMA/core: Do not indicate device ready when device enablement fails") Link: https://patch.msgid.link/r/20250506151008.75701-1-yanjun.zhu@linux.dev Reported-by: syzbot+e2ce9e275ecc70a30b72(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e2ce9e275ecc70a30b72 Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/core/device.c [commit 1d6a9e7449e2 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/infiniband/core/device.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c index da0d3eda4cc2..68b5973ea525 100644 --- a/drivers/infiniband/core/device.c +++ b/drivers/infiniband/core/device.c @@ -1385,8 +1385,10 @@ int ib_register_device(struct ib_device *device, const char *name, return ret; } dev_set_uevent_suppress(&device->dev, false); + down_read(&devices_rwsem); /* Mark for userspace that device is ready */ kobject_uevent(&device->dev.kobj, KOBJ_ADD); + up_read(&devices_rwsem); ib_device_put(device); return 0; -- 2.25.1

2 1

[PATCH OLK-5.10] net: openvswitch: fix nested key length validation in the set() action
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Ilya Maximets <i.maximets(a)ovn.org> stable inclusion from stable-v5.10.237 commit 7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BN0 CVE: CVE-2025-37789 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 65d91192aa66f05710cfddf6a14b5a25ee554dba ] It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first. Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") Reported-by: syzbot+b07a9da40df1576b8048(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b07a9da40df1576b8048 Tested-by: syzbot+b07a9da40df1576b8048(a)syzkaller.appspotmail.com Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Reviewed-by: Eelco Chaudron <echaudro(a)redhat.com> Acked-by: Aaron Conole <aconole(a)redhat.com> Link: https://patch.msgid.link/20250412104052.2073688-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/flow_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index cff18a5bbf38..3f8f43dbf44f 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2834,7 +2834,8 @@ static int validate_set(const struct nlattr *a, size_t key_len; /* There can be only one key in a action */ - if (nla_total_size(nla_len(ovs_key)) != nla_len(a)) + if (!nla_ok(ovs_key, nla_len(a)) || + nla_total_size(nla_len(ovs_key)) != nla_len(a)) return -EINVAL; key_len = nla_len(ovs_key); -- 2.25.1

2 1

[PATCH] media: venus: hfi: add check to handle incorrect queue size
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Vikash Garodia <quic_vgarodia(a)quicinc.com> commit 69baf245b23e20efda0079238b27fc63ecf13de1 upstream. qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue. Cc: stable(a)vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Signed-off-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/media/platform/qcom/venus/hfi_venus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c index cfd9471560cc..ab93757fff4b 100644 --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -187,6 +187,9 @@ static int venus_write_queue(struct venus_hfi_device *hdev, /* ensure rd/wr indices's are read from memory */ rmb(); + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx); else @@ -255,6 +258,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev, wr_idx = qhdr->write_idx; qsize = qhdr->q_size; + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + /* make sure data is valid before using it */ rmb(); -- 2.43.0

1 0

[PATCH OLK-5.10] net: ppp: Add bound checking for skb data on ppp_sync_txmung
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Arnaud Lecomte <contact(a)arnaud-lcm.com> stable inclusion from stable-v5.10.237 commit de5a4f0cba58625e88b7bebd88f780c8c0150997 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BHL CVE: CVE-2025-37749 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aabc6596ffb377c4c9c8f335124b92ea282c9821 ] Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets. When ppp_sync_txmung receives an incoming package with an empty payload: (remote) gef➤ p *(struct pppoe_hdr *) (skb->head + skb->network_header) $18 = { type = 0x1, ver = 0x1, code = 0x0, sid = 0x2, length = 0x0, tag = 0xffff8880371cdb96 } from the skb struct (trimmed) tail = 0x16, end = 0x140, head = 0xffff88803346f400 "4", data = 0xffff88803346f416 ":\377", truesize = 0x380, len = 0x0, data_len = 0x0, mac_len = 0xe, hdr_len = 0x0, it is not safe to access data[2]. Reported-by: syzbot+29fc8991b0ecb186cf40(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=29fc8991b0ecb186cf40 Tested-by: syzbot+29fc8991b0ecb186cf40(a)syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Arnaud Lecomte <contact(a)arnaud-lcm.com> Link: https://patch.msgid.link/20250408-bound-checking-ppp_txmung-v2-1-94bb6e1b92… [pabeni(a)redhat.com: fixed subj typo] Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ppp/ppp_synctty.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c index 717431636275..11725cab4912 100644 --- a/drivers/net/ppp/ppp_synctty.c +++ b/drivers/net/ppp/ppp_synctty.c @@ -517,6 +517,11 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb) unsigned char *data; int islcp; + /* Ensure we can safely access protocol field and LCP code */ + if (!pskb_may_pull(skb, 3)) { + kfree_skb(skb); + return NULL; + } data = skb->data; proto = get_unaligned_be16(data); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Mike Christie <michael.christie(a)oracle.com> stable inclusion from stable-v6.6.87 commit 2b34bdc42df047794542f3e220fe989124e4499a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QRK CVE: CVE-2025-22083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 ] If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do: vhost_vq_set_backend(vq, vs_tpg); ... kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If vhost_scsi_set_endpoint is called again and no tpgs are found match=false so we skip the vhost_vq_set_backend call leaving the pointer to the vs_tpg we then free via: kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If a scsi request is then sent we do: vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend which sees the vs_tpg we just did a kfree on. 2. Tpg dir removal hang: This patch fixes an issue where we cannot remove a LIO/target layer tpg (and structs above it like the target) dir due to the refcount dropping to -1. The problem is that if vhost_scsi_set_endpoint detects a tpg is already in the vs->vs_tpg array or if the tpg has been removed so target_depend_item fails, the undepend goto handler will do target_undepend_item on all tpgs in the vs_tpg array dropping their refcount to 0. At this time vs_tpg contains both the tpgs we have added in the current vhost_scsi_set_endpoint call as well as tpgs we added in previous calls which are also in vs->vs_tpg. Later, when vhost_scsi_clear_endpoint runs it will do target_undepend_item on all the tpgs in the vs->vs_tpg which will drop their refcount to -1. Userspace will then not be able to remove the tpg and will hang when it tries to do rmdir on the tpg dir. 3. Tpg leak: This fixes a bug where we can leak tpgs and cause them to be un-removable because the target name is overwritten when vhost_scsi_set_endpoint is called multiple times but with different target names. The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup a vhost-scsi device to target/tpg mapping, then calls VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we haven't seen before (target1 has tpg1 but target2 has tpg2). When this happens we don't teardown the old target tpg mapping and just overwrite the target name and the vs->vs_tpg array. Later when we do vhost_scsi_clear_endpoint, we are passed in either target1 or target2's name and we will only match that target's tpgs when we loop over the vs->vs_tpg. We will then return from the function without doing target_undepend_item on the tpgs. Because of all these bugs, it looks like being able to call vhost_scsi_set_endpoint multiple times was never supported. The major user, QEMU, already has checks to prevent this use case. So to fix the issues, this patch prevents vhost_scsi_set_endpoint from being called if it's already successfully added tpgs. To add, remove or change the tpg config or target name, you must do a vhost_scsi_clear_endpoint first. Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session") Fixes: 4f7f46d32c98 ("tcm_vhost: Use vq->private_data to indicate if the endpoint is setup") Reported-by: Haoran Zhang <wh1sper(a)zju.edu.cn> Closes: https://lore.kernel.org/virtualization/e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e… Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Message-Id: <20250129210922.121533-1-michael.christie(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/scsi.c [commit 25b98b64e284 is not backport.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/vhost/scsi.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 0535f4abd37d..c485cb9d4f52 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1181,14 +1181,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } } + if (vs->vs_tpg) { + pr_err("vhost-scsi endpoint already set for %s.\n", + vs->vs_vhost_wwpn); + ret = -EEXIST; + goto out; + } + len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET; vs_tpg = kzalloc(len, GFP_KERNEL); if (!vs_tpg) { ret = -ENOMEM; goto out; } - if (vs->vs_tpg) - memcpy(vs_tpg, vs->vs_tpg, len); list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) { mutex_lock(&tpg->tv_tpg_mutex); @@ -1203,12 +1208,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, tv_tport = tpg->tport; if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) { - if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { - kfree(vs_tpg); - mutex_unlock(&tpg->tv_tpg_mutex); - ret = -EEXIST; - goto out; - } /* * In order to ensure individual vhost-scsi configfs * groups cannot be removed while in use by vhost ioctl, @@ -1244,17 +1243,20 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } ret = 0; } else { - ret = -EEXIST; + ret = -ENODEV; + goto free_tpg; } /* - * Act as synchronize_rcu to make sure access to - * old vs->vs_tpg is finished. + * Act as synchronize_rcu to make sure requests after this point + * see a fully setup device. */ vhost_scsi_flush(vs); - kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; + goto out; +free_tpg: + kfree(vs_tpg); out: mutex_unlock(&vs->dev.mutex); mutex_unlock(&vhost_scsi_mutex); @@ -1336,6 +1338,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, vhost_scsi_flush(vs); kfree(vs->vs_tpg); vs->vs_tpg = NULL; + memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn)); WARN_ON(vs->vs_events_nr); mutex_unlock(&vs->dev.mutex); mutex_unlock(&vhost_scsi_mutex); -- 2.43.0

2 1

[PATCH OLK-5.10] memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Luo Qiu <luoqiu(a)kylinsec.com.cn> stable inclusion from stable=v5.10.236 commit 9dfaf4d723c62bda8d9d1340e2e78acf0c190439 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1PGY CVE: CVE-2025-22020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4676741a3464b300b486e70585c3c9b692be1632 upstream. This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_one_work+0x357/0x660 worker_thread+0x390/0x4c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x190/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 161446: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x1a7/0x470 memstick_alloc_host+0x1f/0xe0 [memstick] rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] platform_probe+0x60/0xe0 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 bus_probe_device+0xbd/0xd0 device_add+0x4a5/0x760 platform_device_add+0x189/0x370 mfd_add_device+0x587/0x5e0 mfd_add_devices+0xb1/0x130 rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] usb_probe_interface+0x15c/0x460 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 rebind_marked_interfaces.isra.0+0xcc/0x110 usb_reset_device+0x352/0x410 usbdev_do_ioctl+0xe5c/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 161506: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0x34/0x50 kfree+0x1fd/0x3b0 device_release+0x56/0xf0 kobject_cleanup+0x73/0x1c0 rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] platform_remove+0x2f/0x50 device_release_driver_internal+0x24b/0x2e0 bus_remove_device+0x124/0x1d0 device_del+0x239/0x530 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x40 mfd_remove_devices_fn+0x167/0x170 device_for_each_child_reverse+0xc9/0x130 mfd_remove_devices+0x6e/0xa0 rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] usb_unbind_interface+0xf3/0x3f0 device_release_driver_internal+0x24b/0x2e0 proc_disconnect_claim+0x13d/0x220 usbdev_do_ioctl+0xb5e/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 The buggy address belongs to the object at ffff888136335000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 896 bytes inside of freed 2048-byte region [ffff888136335000, ffff888136335800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136330 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 0017ffffc0000003 ffffea0004d8cc01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888136335280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888136335300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888136335380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888136335400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888136335480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management") Signed-off-by: Luo Qiu <luoqiu(a)kylinsec.com.cn> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/4B7BC3E6E291E6F2+20250317101438.25650-1-luoqiu@ky… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/memstick/host/rtsx_usb_ms.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c index 29271ad4728a..dec279845a75 100644 --- a/drivers/memstick/host/rtsx_usb_ms.c +++ b/drivers/memstick/host/rtsx_usb_ms.c @@ -813,6 +813,7 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) host->eject = true; cancel_work_sync(&host->handle_req); + cancel_delayed_work_sync(&host->poll_card); mutex_lock(&host->host_mutex); if (host->req) { -- 2.43.0

2 1