- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3316/3316] kernel/xsched/vstream.c:94:19: warning: no previous prototype for 'xcu_find'
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 33cf1d28f3c50dfd5f2649216af46dce323c3f97 commit: 8dde1f2e6bf6049bf69c9f510349c698e0aba49d [3316/3316] xsched: Introduce vstream management config: x86_64-buildonly-randconfig-002-20251125 (https://download.01.org/0day-ci/archive/20251125/202511251558.2eHkQQky-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511251558.2eHkQQky-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511251558.2eHkQQky-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/xsched/vstream.c:94:19: warning: no previous prototype for 'xcu_find' [-Wmissing-prototypes] 94 | struct xsched_cu *xcu_find(uint32_t type, | ^~~~~~~~ vim +/xcu_find +94 kernel/xsched/vstream.c 93 > 94 struct xsched_cu *xcu_find(uint32_t type, 95 uint32_t dev_id, uint32_t channel_id) 96 { 97 struct xcu_group *group = NULL; 98 99 /* Find xcu by type. */ 100 group = xcu_group_find(xcu_group_root, type); 101 if (group == NULL) { 102 XSCHED_ERR("Fail to find type group.\n"); 103 return NULL; 104 } 105 106 /* Find device id group. */ 107 group = xcu_group_find(group, dev_id); 108 if (group == NULL) { 109 XSCHED_ERR("Fail to find device group.\n"); 110 return NULL; 111 } 112 /* Find channel id group. */ 113 group = xcu_group_find(group, channel_id); 114 if (group == NULL) { 115 XSCHED_ERR("Fail to find channel group.\n"); 116 return NULL; 117 } 118 119 XSCHED_DEBUG("XCU found: type=%u, dev_id=%u, chan_id=%u.\n", 120 type, dev_id, channel_id); 121 122 return group->xcu; 123 } 124 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3316/3316] drivers/xcu/xcu_group.c:41:5: warning: no previous prototype for '__xcu_group_attach'
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 6eee8b9188fae0b31126a98baa2a545eafb40d6b commit: b7261a251299bfdababe53a848084af2ecfcc1ae [3316/3316] xcu: Add base NPU driver support config: x86_64-buildonly-randconfig-002-20251125 (https://download.01.org/0day-ci/archive/20251125/202511251246.qIzuARuC-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511251246.qIzuARuC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511251246.qIzuARuC-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/xcu/xcu_group.c:41:5: warning: no previous prototype for '__xcu_group_attach' [-Wmissing-prototypes] 41 | int __xcu_group_attach(struct xcu_group *new_group, | ^~~~~~~~~~~~~~~~~~ vim +/__xcu_group_attach +41 drivers/xcu/xcu_group.c 40 > 41 int __xcu_group_attach(struct xcu_group *new_group, 42 struct xcu_group *previous_group) 43 { 44 int id = new_group->id; 45 46 if (id == -1) 47 id = idr_alloc(&previous_group->next_layer, new_group, 0, 48 INT_MAX, GFP_KERNEL); 49 else 50 id = idr_alloc(&previous_group->next_layer, new_group, id, 51 id + 1, GFP_KERNEL); 52 53 if (id < 0) { 54 XSCHED_ERR("Fail to attach xcu_group: id conflict @ %s\n", 55 __func__); 56 return -EEXIST; 57 } 58 new_group->id = id; 59 new_group->previous_layer = previous_group; 60 61 return 0; 62 } 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/6] CVE-2022-49722
by Xiaomeng Zhang 25 Nov '25

25 Nov '25

Jacob Keller (2): ice: convert ice_reset_vf to standard error codes ice: convert ice_reset_vf to take flags Michal Jaron (1): ice: Fix call trace with null VSI during VF reset Norbert Zulinski (1): ice: Fix spurious interrupt during removal of trusted VF Petr Oros (1): ice: Fix NULL pointer deref during VF reset Przemyslaw Patynowski (1): ice: Fix memory corruption in VF driver drivers/net/ethernet/intel/ice/ice_base.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 28 +++++++++ drivers/net/ethernet/intel/ice/ice_lib.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 58 ++++++++++++++----- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 17 +++++- 6 files changed, 92 insertions(+), 18 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 0/5] CVE-2022-49722
by Xiaomeng Zhang 25 Nov '25

25 Nov '25

Jacob Keller (2): ice: convert ice_reset_vf to standard error codes ice: convert ice_reset_vf to take flags Michal Jaron (1): ice: Fix call trace with null VSI during VF reset Norbert Zulinski (1): ice: Fix spurious interrupt during removal of trusted VF Przemyslaw Patynowski (1): ice: Fix memory corruption in VF driver drivers/net/ethernet/intel/ice/ice_base.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 28 ++++++++++ drivers/net/ethernet/intel/ice/ice_lib.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 52 ++++++++++++++----- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 17 ++++-- 6 files changed, 86 insertions(+), 18 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
by Li Lingfeng 25 Nov '25

25 Nov '25

stable inclusion from stable-v6.6.95 commit 5060e1a5fef184bd11d298e3f0ee920d96a23236 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4NH CVE: CVE-2025-38231 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b31da62889e6d610114d81dc7a6edbcaa503fcf8 upstream. In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference. Normally the delayed start of laundromat_work allows sufficient time for nfsd_ssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4_state_start_net -> nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done -> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the delayed work may start before nfsd_ssc initialization finishes. Fix this by moving nfsd_ssc initialization before starting laundromat_work. Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfssvc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c index 710a54c7dffc..623f522b1565 100644 --- a/fs/nfsd/nfssvc.c +++ b/fs/nfsd/nfssvc.c @@ -432,13 +432,13 @@ static int nfsd_startup_net(struct net *net, const struct cred *cred) if (ret) goto out_filecache; +#ifdef CONFIG_NFSD_V4_2_INTER_SSC + nfsd4_ssc_init_umount_work(nn); +#endif ret = nfs4_state_start_net(net); if (ret) goto out_reply_cache; -#ifdef CONFIG_NFSD_V4_2_INTER_SSC - nfsd4_ssc_init_umount_work(nn); -#endif nn->nfsd_net_up = true; return 0; -- 2.46.1

2 1

[PATCH OLK-6.6] dm-bufio: don't schedule in atomic context
by Li Lingfeng 25 Nov '25

25 Nov '25

From: LongPing Wei <weilongping(a)oppo.com> stable inclusion from stable-v6.6.90 commit c8c83052283bcf2fdd467a33d1d2bd5ba36e935a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC990W CVE: CVE-2025-37928 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a3d8f0a7f5e8b193db509c7191fefeed3533fc44 upstream. A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2421 [ 129.444723][ T934] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 934, name: kworker/1:4 [ 129.444740][ T934] preempt_count: 201, expected: 0 [ 129.444756][ T934] RCU nest depth: 0, expected: 0 [ 129.444781][ T934] Preemption disabled at: [ 129.444789][ T934] [<ffffffd816231900>] shrink_work+0x21c/0x248 [ 129.445167][ T934] kernel BUG at kernel/sched/walt/walt_debug.c:16! [ 129.445183][ T934] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 129.445204][ T934] Skip md ftrace buffer dump for: 0x1609e0 [ 129.447348][ T934] CPU: 1 PID: 934 Comm: kworker/1:4 Tainted: G W OE 6.6.56-android15-8-o-g6f82312b30b9-debug #1 1400000003000000474e5500b3187743670464e8 [ 129.447362][ T934] Hardware name: Qualcomm Technologies, Inc. Parrot QRD, Alpha-M (DT) [ 129.447373][ T934] Workqueue: dm_bufio_cache shrink_work [ 129.447394][ T934] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 129.447406][ T934] pc : android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug] [ 129.447435][ T934] lr : __traceiter_android_rvh_schedule_bug+0x44/0x6c [ 129.447451][ T934] sp : ffffffc0843dbc90 [ 129.447459][ T934] x29: ffffffc0843dbc90 x28: ffffffffffffffff x27: 0000000000000c8b [ 129.447479][ T934] x26: 0000000000000040 x25: ffffff804b3d6260 x24: ffffffd816232b68 [ 129.447497][ T934] x23: ffffff805171c5b4 x22: 0000000000000000 x21: ffffffd816231900 [ 129.447517][ T934] x20: ffffff80306ba898 x19: 0000000000000000 x18: ffffffc084159030 [ 129.447535][ T934] x17: 00000000d2b5dd1f x16: 00000000d2b5dd1f x15: ffffffd816720358 [ 129.447554][ T934] x14: 0000000000000004 x13: ffffff89ef978000 x12: 0000000000000003 [ 129.447572][ T934] x11: ffffffd817a823c4 x10: 0000000000000202 x9 : 7e779c5735de9400 [ 129.447591][ T934] x8 : ffffffd81560d004 x7 : 205b5d3938373434 x6 : ffffffd8167397c8 [ 129.447610][ T934] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffffffc0843db9e0 [ 129.447629][ T934] x2 : 0000000000002f15 x1 : 0000000000000000 x0 : 0000000000000000 [ 129.447647][ T934] Call trace: [ 129.447655][ T934] android_rvh_schedule_bug+0x0/0x8 [sched_walt_debug 1400000003000000474e550080cce8a8a78606b6] [ 129.447681][ T934] __might_resched+0x190/0x1a8 [ 129.447694][ T934] shrink_work+0x180/0x248 [ 129.447706][ T934] process_one_work+0x260/0x624 [ 129.447718][ T934] worker_thread+0x28c/0x454 [ 129.447729][ T934] kthread+0x118/0x158 [ 129.447742][ T934] ret_from_fork+0x10/0x20 [ 129.447761][ T934] Code: ???????? ???????? ???????? d2b5dd1f (d4210000) [ 129.447772][ T934] ---[ end trace 0000000000000000 ]--- dm_bufio_lock will call spin_lock_bh when try_verify_in_tasklet is enabled, and __scan will be called in atomic context. Fixes: 7cd326747f46 ("dm bufio: remove dm_bufio_cond_resched()") Signed-off-by: LongPing Wei <weilongping(a)oppo.com> Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-bufio.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c index b837a445bb7f..8ce77aec05d2 100644 --- a/drivers/md/dm-bufio.c +++ b/drivers/md/dm-bufio.c @@ -68,6 +68,8 @@ #define LIST_DIRTY 1 #define LIST_SIZE 2 +#define SCAN_RESCHED_CYCLE 16 + /*--------------------------------------------------------------*/ /* @@ -2387,7 +2389,12 @@ static void __scan(struct dm_bufio_client *c) atomic_long_dec(&c->need_shrink); freed++; - cond_resched(); + + if (unlikely(freed % SCAN_RESCHED_CYCLE == 0)) { + dm_bufio_unlock(c); + cond_resched(); + dm_bufio_lock(c); + } } } } -- 2.46.1

2 1

[PATCH OLK-6.6] dmaengine: ti: k3-udma: Add missing locking
by Li Lingfeng 25 Nov '25

25 Nov '25

From: Ronald Wahl <ronald.wahl(a)legrand.com> stable inclusion from stable-v6.6.92 commit d87f1cddc592387359fde157cc4296556f6403c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGALS CVE: CVE-2025-38005 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fca280992af8c2fbd511bc43f65abb4a17363f2f upstream. Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: [ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238 [ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28 [ 4.144867] Hardware name: pp-v12 (DT) [ 4.148648] Workqueue: events udma_check_tx_completion [ 4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 4.160834] pc : udma_start.isra.0+0x34/0x238 [ 4.165227] lr : udma_start.isra.0+0x30/0x238 [ 4.169618] sp : ffffffc083cabcf0 [ 4.172963] x29: ffffffc083cabcf0 x28: 0000000000000000 x27: ffffff800001b005 [ 4.180167] x26: ffffffc0812f0000 x25: 0000000000000000 x24: 0000000000000000 [ 4.187370] x23: 0000000000000001 x22: 00000000e21eabe9 x21: ffffff8000fa0670 [ 4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030 [ 4.201773] x17: 0000000000000000 x16: 00000000f0000000 x15: 0000000000000048 [ 4.208976] x14: 0000000000000048 x13: 0000000000000000 x12: 0000000000000001 [ 4.216179] x11: ffffffc08151a240 x10: 0000000000003ea1 x9 : ffffffc08046ab68 [ 4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 : 0000000000029fc8 [ 4.230583] x5 : ffffffc0817ee6d8 x4 : 0000000000000bc0 x3 : 0000000000000000 [ 4.237784] x2 : 0000000000000000 x1 : 00000000001fffff x0 : 0000000000000000 [ 4.244986] Call trace: [ 4.247463] udma_start.isra.0+0x34/0x238 [ 4.251509] udma_check_tx_completion+0xd0/0xdc [ 4.256076] process_one_work+0x244/0x3fc [ 4.260129] process_scheduled_works+0x6c/0x74 [ 4.264610] worker_thread+0x150/0x1dc [ 4.268398] kthread+0xd8/0xe8 [ 4.271492] ret_from_fork+0x10/0x20 [ 4.275107] irq event stamp: 220 [ 4.278363] hardirqs last enabled at (219): [<ffffffc080a27c7c>] _raw_spin_unlock_irq+0x38/0x50 [ 4.287183] hardirqs last disabled at (220): [<ffffffc080a1c154>] el1_dbg+0x24/0x50 [ 4.294879] softirqs last enabled at (182): [<ffffffc080037e68>] handle_softirqs+0x1c0/0x3cc [ 4.303437] softirqs last disabled at (177): [<ffffffc080010170>] __do_softirq+0x1c/0x28 [ 4.311559] ---[ end trace 0000000000000000 ]--- This commit adds the missing locking. Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA") Cc: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> Cc: Vignesh Raghavendra <vigneshr(a)ti.com> Cc: Vinod Koul <vkoul(a)kernel.org> Cc: dmaengine(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Ronald Wahl <ronald.wahl(a)legrand.com> Acked-by: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> Link: https://lore.kernel.org/r/20250414173113.80677-1-rwahl@gmx.de Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/dma/ti/k3-udma.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c index ee4e75f2ad98..5a2a23cf101b 100644 --- a/drivers/dma/ti/k3-udma.c +++ b/drivers/dma/ti/k3-udma.c @@ -1091,8 +1091,11 @@ static void udma_check_tx_completion(struct work_struct *work) u32 residue_diff; ktime_t time_diff; unsigned long delay; + unsigned long flags; while (1) { + spin_lock_irqsave(&uc->vc.lock, flags); + if (uc->desc) { /* Get previous residue and time stamp */ residue_diff = uc->tx_drain.residue; @@ -1127,6 +1130,8 @@ static void udma_check_tx_completion(struct work_struct *work) break; } + spin_unlock_irqrestore(&uc->vc.lock, flags); + usleep_range(ktime_to_us(delay), ktime_to_us(delay) + 10); continue; @@ -1143,6 +1148,8 @@ static void udma_check_tx_completion(struct work_struct *work) break; } + + spin_unlock_irqrestore(&uc->vc.lock, flags); } static irqreturn_t udma_ring_irq_handler(int irq, void *data) -- 2.46.1

2 1

[PATCH OLK-5.10] dmaengine: ti: k3-udma: Add missing locking
by Li Lingfeng 25 Nov '25

25 Nov '25

From: Ronald Wahl <ronald.wahl(a)legrand.com> stable inclusion from stable-v5.10.238 commit 27e71fa08711e09d81e06a54007b362a5426fd22 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGALS CVE: CVE-2025-38005 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fca280992af8c2fbd511bc43f65abb4a17363f2f upstream. Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: [ 4.128073] WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169 udma_start.isra.0+0x34/0x238 [ 4.137352] CPU: 0 UID: 0 PID: 746 Comm: kworker/0:3 Not tainted 6.12.9-arm64 #28 [ 4.144867] Hardware name: pp-v12 (DT) [ 4.148648] Workqueue: events udma_check_tx_completion [ 4.153841] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 4.160834] pc : udma_start.isra.0+0x34/0x238 [ 4.165227] lr : udma_start.isra.0+0x30/0x238 [ 4.169618] sp : ffffffc083cabcf0 [ 4.172963] x29: ffffffc083cabcf0 x28: 0000000000000000 x27: ffffff800001b005 [ 4.180167] x26: ffffffc0812f0000 x25: 0000000000000000 x24: 0000000000000000 [ 4.187370] x23: 0000000000000001 x22: 00000000e21eabe9 x21: ffffff8000fa0670 [ 4.194571] x20: ffffff8001b6bf00 x19: ffffff8000fa0430 x18: ffffffc083b95030 [ 4.201773] x17: 0000000000000000 x16: 00000000f0000000 x15: 0000000000000048 [ 4.208976] x14: 0000000000000048 x13: 0000000000000000 x12: 0000000000000001 [ 4.216179] x11: ffffffc08151a240 x10: 0000000000003ea1 x9 : ffffffc08046ab68 [ 4.223381] x8 : ffffffc083cabac0 x7 : ffffffc081df3718 x6 : 0000000000029fc8 [ 4.230583] x5 : ffffffc0817ee6d8 x4 : 0000000000000bc0 x3 : 0000000000000000 [ 4.237784] x2 : 0000000000000000 x1 : 00000000001fffff x0 : 0000000000000000 [ 4.244986] Call trace: [ 4.247463] udma_start.isra.0+0x34/0x238 [ 4.251509] udma_check_tx_completion+0xd0/0xdc [ 4.256076] process_one_work+0x244/0x3fc [ 4.260129] process_scheduled_works+0x6c/0x74 [ 4.264610] worker_thread+0x150/0x1dc [ 4.268398] kthread+0xd8/0xe8 [ 4.271492] ret_from_fork+0x10/0x20 [ 4.275107] irq event stamp: 220 [ 4.278363] hardirqs last enabled at (219): [<ffffffc080a27c7c>] _raw_spin_unlock_irq+0x38/0x50 [ 4.287183] hardirqs last disabled at (220): [<ffffffc080a1c154>] el1_dbg+0x24/0x50 [ 4.294879] softirqs last enabled at (182): [<ffffffc080037e68>] handle_softirqs+0x1c0/0x3cc [ 4.303437] softirqs last disabled at (177): [<ffffffc080010170>] __do_softirq+0x1c/0x28 [ 4.311559] ---[ end trace 0000000000000000 ]--- This commit adds the missing locking. Fixes: 25dcb5dd7b7c ("dmaengine: ti: New driver for K3 UDMA") Cc: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> Cc: Vignesh Raghavendra <vigneshr(a)ti.com> Cc: Vinod Koul <vkoul(a)kernel.org> Cc: dmaengine(a)vger.kernel.org Cc: stable(a)vger.kernel.org Signed-off-by: Ronald Wahl <ronald.wahl(a)legrand.com> Acked-by: Peter Ujfalusi <peter.ujfalusi(a)gmail.com> Link: https://lore.kernel.org/r/20250414173113.80677-1-rwahl@gmx.de Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/dma/ti/k3-udma.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/dma/ti/k3-udma.c b/drivers/dma/ti/k3-udma.c index 15eecb757619..466694a74034 100644 --- a/drivers/dma/ti/k3-udma.c +++ b/drivers/dma/ti/k3-udma.c @@ -962,8 +962,11 @@ static void udma_check_tx_completion(struct work_struct *work) u32 residue_diff; ktime_t time_diff; unsigned long delay; + unsigned long flags; while (1) { + spin_lock_irqsave(&uc->vc.lock, flags); + if (uc->desc) { /* Get previous residue and time stamp */ residue_diff = uc->tx_drain.residue; @@ -998,6 +1001,8 @@ static void udma_check_tx_completion(struct work_struct *work) break; } + spin_unlock_irqrestore(&uc->vc.lock, flags); + usleep_range(ktime_to_us(delay), ktime_to_us(delay) + 10); continue; @@ -1014,6 +1019,8 @@ static void udma_check_tx_completion(struct work_struct *work) break; } + + spin_unlock_irqrestore(&uc->vc.lock, flags); } static irqreturn_t udma_ring_irq_handler(int irq, void *data) -- 2.46.1

2 1

[PATCH OLK-6.6] init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency
by Chen Jinghuang 25 Nov '25

25 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CIH ---------------------------------------- ARCH_SUPPORTS_SCHED_SOFT_QUOTA was previously in a CGROUPS-dependent block, causing build warning when ARCH_SUPPORTS_SCHED_SOFT_QUOTA=y and CGROUPS=n. Move it to a generic, CGROUPS-independent section in init/Kconfig to fix the errors, while preserving its original role as an arch capability flag. Fixes: a91091aed1fa ("sched: More flexible use of CPU quota when CPU is idle") Signed-off-by: Chen Jinghuang<chenjinghuang2(a)huawei.com> --- init/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/init/Kconfig b/init/Kconfig index 485583e8ecbe..874daa00304c 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -950,6 +950,9 @@ config NUMA_BALANCING_DEFAULT_ENABLED If set, automatic NUMA balancing will be enabled if running on a NUMA machine. +config ARCH_SUPPORTS_SCHED_SOFT_QUOTA + bool + menuconfig CGROUPS bool "Control Group support" select KERNFS @@ -1178,9 +1181,6 @@ config SCHED_SOFT_DOMAIN # # For architectures that want to enable the support for SCHED_SOFT_QUOTA # -config ARCH_SUPPORTS_SCHED_SOFT_QUOTA - bool - config SCHED_SOFT_QUOTA bool "More flexible use of CPU quota" depends on ARCH_SUPPORTS_SCHED_SOFT_QUOTA -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2025-40168
by Wang Liang 25 Nov '25

25 Nov '25

Kuniyuki Iwashima (1): smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). Sharath Chandra Vurukala (1): net: Add locking to protect skb->dev access in ip_output include/net/dst.h | 12 ++++++++++++ net/ipv4/ip_output.c | 15 ++++++++++----- net/smc/smc_clc.c | 26 +++++++++++++------------- 3 files changed, 35 insertions(+), 18 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] nfsd: provide locking for v4_end_grace
by Li Lingfeng 25 Nov '25

25 Nov '25

From: NeilBrown <neil(a)brown.name> maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8DQ8 Reference: https://lore.kernel.org/all/175144911127.565058.5990359597048022103@noble.n… ------------------ Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Cc: stable(a)vger.kernel.org Signed-off-by: NeilBrown <neil(a)brown.name> Conflicts: fs/nfsd/nfs4state.c fs/nfsd/nfsctl.c fs/nfsd/state.h [Commit bad4c585ccaa ("NFSD: send OP_CB_RECALL_ANY to clients when number of delegations reaches its limit") added the declaration of deleg_reaper; commit d17452aa33a6 ("nfsd: dynamically allocate the nfsd-client shrinker") replace unregister_shrinker with shrinker_free; commit 39d432fc7630 ("NFSD: trace nfsctl operations") replace nfsd4_end_grace with trace_nfsd_end_grace; commit 1ac3629bf012 ("nfsd: prepare for supporting admin-revocation of state") added the declaration of nfsd4_revoke_states;] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/netns.h | 2 ++ fs/nfsd/nfs4state.c | 29 +++++++++++++++++++++++++++-- fs/nfsd/nfsctl.c | 3 +-- fs/nfsd/state.h | 2 +- 4 files changed, 31 insertions(+), 5 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index 72770fe0fdfe..e80691241aef 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -65,6 +65,8 @@ struct nfsd_net { struct lock_manager nfsd4_manager; bool grace_ended; + bool grace_end_forced; + bool client_tracking_active; time64_t boot_time; struct dentry *nfsd_client_dir; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 435e7dc60903..a813c1123b37 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -84,7 +84,7 @@ static u64 current_sessionid = 1; /* forward declarations */ static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner); static void nfs4_free_ol_stateid(struct nfs4_stid *stid); -void nfsd4_end_grace(struct nfsd_net *nn); +static void nfsd4_end_grace(struct nfsd_net *nn); static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); static void nfsd4_file_hash_remove(struct nfs4_file *fi); @@ -5902,7 +5902,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return nfs_ok; } -void +static void nfsd4_end_grace(struct nfsd_net *nn) { /* do nothing if grace period already ended */ @@ -5935,6 +5935,20 @@ nfsd4_end_grace(struct nfsd_net *nn) */ } +bool +nfsd4_force_end_grace(struct nfsd_net *nn) +{ + if (!nn->client_tracking_ops) + return false; + spin_lock(&nn->client_lock); + if (nn->client_tracking_active) { + nn->grace_end_forced = true; + mod_delayed_work(laundry_wq, &nn->laundromat_work, 0); + } + spin_unlock(&nn->client_lock); + return true; +} + /* * If we've waited a lease period but there are still clients trying to * reclaim, wait a little longer to give them a chance to finish. @@ -5944,6 +5958,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn) time64_t double_grace_period_end = nn->boot_time + 2 * nn->nfsd4_lease; + if (nn->grace_end_forced) + return false; if (nn->track_reclaim_completes && atomic_read(&nn->nr_reclaim_complete) == nn->reclaim_str_hashtbl_size) @@ -8175,6 +8191,8 @@ static int nfs4_state_create_net(struct net *net) nn->unconf_name_tree = RB_ROOT; nn->boot_time = ktime_get_real_seconds(); nn->grace_ended = false; + nn->grace_end_forced = false; + nn->client_tracking_active = false; nn->nfsd4_manager.block_opens = true; INIT_LIST_HEAD(&nn->nfsd4_manager.list); INIT_LIST_HEAD(&nn->client_lru); @@ -8255,6 +8273,10 @@ nfs4_state_start_net(struct net *net) return ret; locks_start_grace(net, &nn->nfsd4_manager); nfsd4_client_tracking_init(net); + /* safe for laundromat to run now */ + spin_lock(&nn->client_lock); + nn->client_tracking_active = true; + spin_unlock(&nn->client_lock); if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) goto skip_grace; printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n", @@ -8301,6 +8323,9 @@ nfs4_state_shutdown_net(struct net *net) shrinker_free(nn->nfsd_client_shrinker); cancel_work_sync(&nn->nfsd_shrinker_work); + spin_lock(&nn->client_lock); + nn->client_tracking_active = false; + spin_unlock(&nn->client_lock); cancel_delayed_work_sync(&nn->laundromat_work); locks_end_grace(&nn->nfsd4_manager); diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 887035b74467..ba8d653de273 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1110,10 +1110,9 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) case 'Y': case 'y': case '1': - if (!nn->nfsd_serv) + if (!nfsd4_force_end_grace(nn)) return -EBUSY; trace_nfsd_end_grace(netns(file)); - nfsd4_end_grace(nn); break; default: return -EINVAL; diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index cbddcf484dba..5da7785609b0 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -717,7 +717,7 @@ static inline void get_nfs4_file(struct nfs4_file *fi) struct nfsd_file *find_any_file(struct nfs4_file *f); /* grace period management */ -void nfsd4_end_grace(struct nfsd_net *nn); +bool nfsd4_force_end_grace(struct nfsd_net *nn); /* nfs4recover operations */ extern int nfsd4_client_tracking_init(struct net *net); -- 2.46.1

2 1

[PATCH OLK-5.10] drm/vmwgfx: Fix Use-after-free in validation
by Lin Ruifeng 25 Nov '25

25 Nov '25

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v5.10.246 commit fb7165e5f3b3b10721ff70553583ad12e90e447a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6794 CVE: CVE-2025-40111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index e69bc373ae2e..535d1ab1a52f 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -342,8 +342,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, } } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { -- 2.43.0

2 1

[PATCH OLK-6.6] drm/vmwgfx: Fix Use-after-free in validation
by Lin Ruifeng 25 Nov '25

25 Nov '25

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v6.6.113 commit 867bda5d95d36f10da398fd4409e21c7002b2332 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6794 CVE: CVE-2025-40111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ] Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this node escaped because its resource was destroyed prematurely. Fixes: 64ad2abfe9a6 ("drm/vmwgfx: Adapt validation code for reference-free lookups") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Zack Rusin <zack.rusin(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index aaacbdcbd742..a4a11e725d18 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -326,8 +326,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { -- 2.43.0

2 1

[openeuler:OLK-6.6 3316/3316] crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets'
by kernel test robot 25 Nov '25

25 Nov '25

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: b78af6579e15dcdff86504da90af77f3e890270e [3316/3316] PGPLIB: Basic packet parser config: x86_64-buildonly-randconfig-002-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250630.aTlUN4lt-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250630.aTlUN4lt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250630.aTlUN4lt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'datalen' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_data' description in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_datalen' description in 'pgp_parse_packets' vim +189 crypto/asymmetric_keys/pgp_library.c 178 179 /** 180 * pgp_parse_packets - Parse a set of PGP packets 181 * @_data: Data to be parsed (updated) 182 * @_datalen: Amount of data (updated) 183 * @ctx: Parsing context 184 * 185 * Parse a set of PGP packets [RFC 4880: 4]. 186 */ 187 int pgp_parse_packets(const u8 *data, size_t datalen, 188 struct pgp_parse_context *ctx) > 189 { 190 enum pgp_packet_tag type; 191 ssize_t pktlen; 192 u8 headerlen; 193 int ret; 194 195 while (datalen > 2) { 196 pktlen = pgp_parse_packet_header(&data, &datalen, &type, 197 &headerlen); 198 if (pktlen < 0) 199 return pktlen; 200 201 if ((ctx->types_of_interest >> type) & 1) { 202 ret = ctx->process_packet(ctx, type, headerlen, 203 data, pktlen); 204 if (ret < 0) 205 return ret; 206 } 207 data += pktlen; 208 datalen -= pktlen; 209 } 210 211 if (datalen != 0) { 212 pr_debug("Excess octets in packet stream\n"); 213 return -EBADMSG; 214 } 215 216 return 0; 217 } 218 EXPORT_SYMBOL_GPL(pgp_parse_packets); 219 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3316/3316] kernel/xsched/cgroup.c:327:34: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: 43bbefc53356009d3603faa2c6e6a2858f724e4d [3316/3316] xsched: Add XCU control group implementation and its backend in xsched CFS config: x86_64-buildonly-randconfig-003-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250338.G8XPRtIi-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250338.G8XPRtIi-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250338.G8XPRtIi-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/xsched/cgroup.c:21: include/linux/xsched.h:265:36: error: field 'css' has incomplete type 265 | struct cgroup_subsys_state css; | ^~~ In file included from include/linux/container_of.h:5, from include/linux/kernel.h:22, from arch/x86/include/asm/percpu.h:27, from arch/x86/include/asm/current.h:10, from include/linux/sched.h:12, from include/linux/cgroup.h:12, from kernel/xsched/cgroup.c:18: kernel/xsched/cgroup.c: In function 'xcu_cg_from_css': include/linux/compiler_types.h:411:27: error: expression in static assertion is not an integer 411 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:78:56: note: in definition of macro '__static_assert' 78 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg) | ^~~~ include/linux/container_of.h:20:9: note: in expansion of macro 'static_assert' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~~~ include/linux/container_of.h:20:23: note: in expansion of macro '__same_type' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~ kernel/xsched/cgroup.c:184:22: note: in expansion of macro 'container_of' 184 | return css ? container_of(css, struct xsched_group, css) : NULL; | ^~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_css_online': kernel/xsched/cgroup.c:254:53: error: invalid use of undefined type 'struct cgroup_subsys_state' 254 | struct cgroup_subsys_state *parent_css = css->parent; | ^~ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:327:34: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 327 | static int xcu_can_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_can_attach': kernel/xsched/cgroup.c:335:9: error: implicit declaration of function 'cgroup_taskset_for_each'; did you mean 'cgroup_task_frozen'? [-Wimplicit-function-declaration] 335 | cgroup_taskset_for_each(task, dst_css, tset) { | ^~~~~~~~~~~~~~~~~~~~~~~ | cgroup_task_frozen kernel/xsched/cgroup.c:335:53: error: expected ';' before '{' token 335 | cgroup_taskset_for_each(task, dst_css, tset) { | ^~ | ; >> kernel/xsched/cgroup.c:333:13: warning: unused variable 'ret' [-Wunused-variable] 333 | int ret = 0; | ^~~ >> kernel/xsched/cgroup.c:332:34: warning: unused variable 'entry' [-Wunused-variable] 332 | struct xcg_attach_entry *entry; | ^~~~~ >> kernel/xsched/cgroup.c:331:40: warning: unused variable 'dst_xcg' [-Wunused-variable] 331 | struct xsched_group *old_xcg, *dst_xcg; | ^~~~~~~ >> kernel/xsched/cgroup.c:331:30: warning: unused variable 'old_xcg' [-Wunused-variable] 331 | struct xsched_group *old_xcg, *dst_xcg; | ^~~~~~~ >> kernel/xsched/cgroup.c:330:47: warning: unused variable 'old_css' [-Wunused-variable] 330 | struct cgroup_subsys_state *dst_css, *old_css; | ^~~~~~~ >> kernel/xsched/cgroup.c:355:1: warning: no return statement in function returning non-void [-Wreturn-type] 355 | } | ^ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:357:38: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 357 | static void xcu_cancel_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:368:6: warning: no previous prototype for 'xcu_move_task' [-Wmissing-prototypes] 368 | void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:401:31: warning: 'struct cgroup_taskset' declared inside parameter list will not be visible outside of this definition or declaration 401 | static void xcu_attach(struct cgroup_taskset *tset) | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xsched_group_inherit': kernel/xsched/cgroup.c:432:15: error: implicit declaration of function 'task_get_css' [-Wimplicit-function-declaration] 432 | css = task_get_css(task, xcu_cgrp_id); | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:432:34: error: 'xcu_cgrp_id' undeclared (first use in this function) 432 | css = task_get_css(task, xcu_cgrp_id); | ^~~~~~~~~~~ kernel/xsched/cgroup.c:432:34: note: each undeclared identifier is reported only once for each function it appears in kernel/xsched/cgroup.c: In function 'xcu_sched_class_show': kernel/xsched/cgroup.c:440:43: error: implicit declaration of function 'seq_css' [-Wimplicit-function-declaration] 440 | struct cgroup_subsys_state *css = seq_css(sf); | ^~~~~~~ kernel/xsched/cgroup.c:440:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] kernel/xsched/cgroup.c: In function 'xcu_sched_class_write': kernel/xsched/cgroup.c:490:43: error: implicit declaration of function 'of_css' [-Wimplicit-function-declaration] 490 | struct cgroup_subsys_state *css = of_css(of); | ^~~~~~ kernel/xsched/cgroup.c:490:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] kernel/xsched/cgroup.c:508:29: error: invalid use of undefined type 'struct cgroup_subsys_state' 508 | if (!list_empty(&css->children)) | ^~ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:520:65: warning: 'struct cftype' declared inside parameter list will not be visible outside of this definition or declaration 520 | static s64 xcu_read_s64(struct cgroup_subsys_state *css, struct cftype *cft) | ^~~~~~ kernel/xsched/cgroup.c: In function 'xcu_read_s64': kernel/xsched/cgroup.c:525:20: error: invalid use of undefined type 'struct cftype' 525 | switch (cft->private) { | ^~ In file included from include/linux/kernel.h:31: kernel/xsched/cgroup.c:530:63: error: invalid use of undefined type 'struct cftype' 530 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~ include/linux/printk.h:427:33: note: in definition of macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ include/linux/printk.h:498:9: note: in expansion of macro 'printk' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~ include/linux/xsched.h:20:9: note: in expansion of macro 'pr_err' 20 | pr_err(pr_fmt(XSCHED_ERR_PREFIX fmt), ##__VA_ARGS__) | ^~~~~~ kernel/xsched/cgroup.c:530:17: note: in expansion of macro 'XSCHED_ERR' 530 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~~~~~~~~~ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:581:66: warning: 'struct cftype' declared inside parameter list will not be visible outside of this definition or declaration 581 | static int xcu_write_s64(struct cgroup_subsys_state *css, struct cftype *cft, | ^~~~~~ kernel/xsched/cgroup.c: In function 'xcu_write_s64': kernel/xsched/cgroup.c:587:20: error: invalid use of undefined type 'struct cftype' 587 | switch (cft->private) { | ^~ kernel/xsched/cgroup.c:597:63: error: invalid use of undefined type 'struct cftype' 597 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~ include/linux/printk.h:427:33: note: in definition of macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ include/linux/printk.h:498:9: note: in expansion of macro 'printk' 498 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~ include/linux/xsched.h:20:9: note: in expansion of macro 'pr_err' 20 | pr_err(pr_fmt(XSCHED_ERR_PREFIX fmt), ##__VA_ARGS__) | ^~~~~~ kernel/xsched/cgroup.c:597:17: note: in expansion of macro 'XSCHED_ERR' 597 | XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); | ^~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_stat': kernel/xsched/cgroup.c:607:43: error: initialization of 'struct cgroup_subsys_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 607 | struct cgroup_subsys_state *css = seq_css(sf); | ^~~~~~~ kernel/xsched/cgroup.c: At top level: kernel/xsched/cgroup.c:630:22: error: array type has incomplete element type 'struct cftype' 630 | static struct cftype xcu_cg_files[] = { | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:633:26: error: 'CFTYPE_NOT_ON_ROOT' undeclared here (not in a function) 633 | .flags = CFTYPE_NOT_ON_ROOT, | ^~~~~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:651:8: error: variable 'xcu_cgrp_subsys' has initializer but incomplete type 651 | struct cgroup_subsys xcu_cgrp_subsys = { | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:652:10: error: 'struct cgroup_subsys' has no member named 'css_alloc' 652 | .css_alloc = xcu_css_alloc, | ^~~~~~~~~ >> kernel/xsched/cgroup.c:652:22: warning: excess elements in struct initializer 652 | .css_alloc = xcu_css_alloc, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:652:22: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:653:10: error: 'struct cgroup_subsys' has no member named 'css_online' 653 | .css_online = xcu_css_online, | ^~~~~~~~~~ kernel/xsched/cgroup.c:653:23: warning: excess elements in struct initializer 653 | .css_online = xcu_css_online, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:653:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:654:10: error: 'struct cgroup_subsys' has no member named 'css_offline' 654 | .css_offline = xcu_css_offline, | ^~~~~~~~~~~ kernel/xsched/cgroup.c:654:24: warning: excess elements in struct initializer 654 | .css_offline = xcu_css_offline, | ^~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:654:24: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:655:10: error: 'struct cgroup_subsys' has no member named 'css_free' 655 | .css_free = xcu_css_free, | ^~~~~~~~ kernel/xsched/cgroup.c:655:21: warning: excess elements in struct initializer 655 | .css_free = xcu_css_free, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:655:21: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:656:10: error: 'struct cgroup_subsys' has no member named 'can_attach' 656 | .can_attach = xcu_can_attach, | ^~~~~~~~~~ kernel/xsched/cgroup.c:656:23: warning: excess elements in struct initializer 656 | .can_attach = xcu_can_attach, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:656:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:657:10: error: 'struct cgroup_subsys' has no member named 'cancel_attach' 657 | .cancel_attach = xcu_cancel_attach, | ^~~~~~~~~~~~~ kernel/xsched/cgroup.c:657:26: warning: excess elements in struct initializer 657 | .cancel_attach = xcu_cancel_attach, | ^~~~~~~~~~~~~~~~~ kernel/xsched/cgroup.c:657:26: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:658:10: error: 'struct cgroup_subsys' has no member named 'attach' 658 | .attach = xcu_attach, | ^~~~~~ kernel/xsched/cgroup.c:658:19: warning: excess elements in struct initializer 658 | .attach = xcu_attach, | ^~~~~~~~~~ kernel/xsched/cgroup.c:658:19: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:659:10: error: 'struct cgroup_subsys' has no member named 'dfl_cftypes' 659 | .dfl_cftypes = xcu_cg_files, | ^~~~~~~~~~~ kernel/xsched/cgroup.c:659:24: warning: excess elements in struct initializer 659 | .dfl_cftypes = xcu_cg_files, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:659:24: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:660:10: error: 'struct cgroup_subsys' has no member named 'legacy_cftypes' 660 | .legacy_cftypes = xcu_cg_files, | ^~~~~~~~~~~~~~ kernel/xsched/cgroup.c:660:27: warning: excess elements in struct initializer 660 | .legacy_cftypes = xcu_cg_files, | ^~~~~~~~~~~~ kernel/xsched/cgroup.c:660:27: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:661:10: error: 'struct cgroup_subsys' has no member named 'early_init' 661 | .early_init = false, | ^~~~~~~~~~ kernel/xsched/cgroup.c:661:23: warning: excess elements in struct initializer 661 | .early_init = false, | ^~~~~ kernel/xsched/cgroup.c:661:23: note: (near initialization for 'xcu_cgrp_subsys') kernel/xsched/cgroup.c:651:22: error: storage size of 'xcu_cgrp_subsys' isn't known 651 | struct cgroup_subsys xcu_cgrp_subsys = { | ^~~~~~~~~~~~~~~ kernel/xsched/cgroup.c: In function 'xcu_cg_from_css': >> kernel/xsched/cgroup.c:185:1: warning: control reaches end of non-void function [-Wreturn-type] 185 | } | ^ kernel/xsched/cgroup.c: At top level: >> kernel/xsched/cgroup.c:630:22: warning: 'xcu_cg_files' defined but not used [-Wunused-variable] 630 | static struct cftype xcu_cg_files[] = { | ^~~~~~~~~~~~ >> kernel/xsched/cgroup.c:309:12: warning: 'xcu_task_can_attach' defined but not used [-Wunused-function] 309 | static int xcu_task_can_attach(struct task_struct *task, | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_PRELOAD Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n] Selected by [y]: - PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y] vim +327 kernel/xsched/cgroup.c 181 182 inline struct xsched_group *xcu_cg_from_css(struct cgroup_subsys_state *css) 183 { 184 return css ? container_of(css, struct xsched_group, css) : NULL; > 185 } 186 187 /* 188 * Determine whether the given css corresponds to root_xsched_group.css. 189 * 190 * Parameter only_css_self: 191 * - true : Only check whether the css pointer itself is NULL 192 * (i.e., the subsystem root). Do not dereference xg->parent. 193 * Used in the allocation path (css_alloc). 194 * - false : Further check whether the associated xsched_group 195 * has no parent (i.e., a normal root check). 196 */ 197 static inline bool xsched_group_css_is_root(struct cgroup_subsys_state *css, bool only_css_self) 198 { 199 struct xsched_group *xg; 200 201 /* NULL indicates the subsystem root */ 202 if (!css) 203 return true; 204 205 /* 206 * During the allocation phase, 207 * cannot find its parent xsched_group via xg->parent, 208 * so can only determine on the css itself. 209 */ 210 if (only_css_self) 211 return false; 212 213 xg = xcu_cg_from_css(css); 214 215 return xg && !xg->parent; 216 } 217 218 /** 219 * xcu_css_alloc() - Allocate and init xcu cgroup. 220 * @parent_css: css of parent xcu cgroup 221 * 222 * Called from kernel/cgroup.c with cgroup_lock() held. 223 * First called in subsys initialization to create root xcu cgroup, when 224 * XCUs haven't been initialized yet. Func used on every new cgroup creation, 225 * on second call to set root xsched_group runqueue. 226 * 227 * Return: pointer of new xcu cgroup css on success, -ENOMEM otherwise. 228 */ 229 static struct cgroup_subsys_state * 230 xcu_css_alloc(struct cgroup_subsys_state *parent_css) 231 { 232 struct xsched_group *xg; 233 234 if (xsched_group_css_is_root(parent_css, true)) 235 return &root_xsched_group.css; 236 237 xg = kmem_cache_alloc(xsched_group_cache, GFP_KERNEL | __GFP_ZERO); 238 if (!xg) 239 return ERR_PTR(-ENOMEM); 240 241 return &xg->css; 242 } 243 244 static void xcu_css_free(struct cgroup_subsys_state *css) 245 { 246 struct xsched_group *xcg = xcu_cg_from_css(css); 247 248 kmem_cache_free(xsched_group_cache, xcg); 249 } 250 251 static int xcu_css_online(struct cgroup_subsys_state *css) 252 { 253 struct xsched_group *xg = xcu_cg_from_css(css); 254 struct cgroup_subsys_state *parent_css = css->parent; 255 struct xsched_group *parent_xg; 256 int err; 257 258 if (!parent_css) 259 return 0; 260 261 parent_xg = xcu_cg_from_css(parent_css); 262 err = xcu_cg_init(xg, parent_xg); 263 if (err) { 264 kmem_cache_free(xsched_group_cache, xg); 265 XSCHED_ERR("Failed to initialize new xsched_group @ %s.\n", __func__); 266 return err; 267 } 268 269 return 0; 270 } 271 272 static void xcu_css_offline(struct cgroup_subsys_state *css) 273 { 274 struct xsched_group *xcg; 275 276 xcg = xcu_cg_from_css(css); 277 if (!xsched_group_css_is_root(css, false)) { 278 switch (xcg->sched_class) { 279 case XSCHED_TYPE_CFS: 280 xcu_cfs_cg_deinit(xcg); 281 break; 282 default: 283 XSCHED_INFO("xcu_cgroup: deinit RT group css=0x%lx\n", 284 (uintptr_t)&xcg->css); 285 break; 286 } 287 } 288 list_del(&xcg->group_node); 289 } 290 291 static void xsched_group_xse_attach(struct xsched_group *xg, 292 struct xsched_entity *xse) 293 { 294 spin_lock(&xg->lock); 295 list_add_tail(&xse->group_node, &xg->members); 296 spin_unlock(&xg->lock); 297 xse->parent_grp = xg; 298 } 299 300 void xsched_group_xse_detach(struct xsched_entity *xse) 301 { 302 struct xsched_group *xcg = xse->parent_grp; 303 304 spin_lock(&xcg->lock); 305 list_del(&xse->group_node); 306 spin_unlock(&xcg->lock); 307 } 308 > 309 static int xcu_task_can_attach(struct task_struct *task, 310 struct xsched_group *old) 311 { 312 struct xsched_entity *xse; 313 bool has_xse = false; 314 315 spin_lock(&old->lock); 316 list_for_each_entry(xse, &old->members, group_node) { 317 if (xse->owner_pid == task_pid_nr(task)) { 318 has_xse = true; 319 break; 320 } 321 } 322 spin_unlock(&old->lock); 323 324 return has_xse ? -EINVAL : 0; 325 } 326 > 327 static int xcu_can_attach(struct cgroup_taskset *tset) 328 { 329 struct task_struct *task; > 330 struct cgroup_subsys_state *dst_css, *old_css; > 331 struct xsched_group *old_xcg, *dst_xcg; > 332 struct xcg_attach_entry *entry; > 333 int ret = 0; 334 335 cgroup_taskset_for_each(task, dst_css, tset) { 336 rcu_read_lock(); 337 old_css = task_css(task, xcu_cgrp_id); 338 rcu_read_unlock(); 339 dst_xcg = xcu_cg_from_css(dst_css); 340 old_xcg = xcu_cg_from_css(old_css); 341 342 ret = xcu_task_can_attach(task, old_xcg); 343 if (ret) 344 break; 345 346 /* record entry for this task */ 347 entry = kmem_cache_alloc(xcg_attach_entry_cache, GFP_KERNEL | __GFP_ZERO); 348 entry->task = task; 349 entry->old_xcg = old_xcg; 350 entry->new_xcg = dst_xcg; 351 list_add_tail(&entry->node, &xcg_attach_list); 352 } 353 354 return ret; > 355 } 356 357 static void xcu_cancel_attach(struct cgroup_taskset *tset) 358 { 359 struct xcg_attach_entry *entry, *tmp; 360 361 /* error: clear all entries */ 362 list_for_each_entry_safe(entry, tmp, &xcg_attach_list, node) { 363 list_del(&entry->node); 364 kmem_cache_free(xcg_attach_entry_cache, entry); 365 } 366 } 367 368 void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, 369 struct xsched_group *new_xcg) 370 { 371 struct xsched_entity *xse, *tmp; 372 struct xsched_cu *xcu; 373 374 spin_lock(&old_xcg->lock); 375 list_for_each_entry_safe(xse, tmp, &old_xcg->members, group_node) { 376 if (xse->owner_pid != task_pid_nr(task)) 377 continue; 378 379 xcu = xse->xcu; 380 381 if (old_xcg != xse->parent_grp) { 382 WARN_ON(old_xcg != xse->parent_grp); 383 return; 384 } 385 386 /* delete from the old_xcg */ 387 list_del(&xse->group_node); 388 389 mutex_lock(&xcu->xcu_lock); 390 /* dequeue from the current runqueue */ 391 dequeue_ctx(xse, xcu); 392 /* attach to the new_xcg */ 393 xsched_group_xse_attach(new_xcg, xse); 394 /* enqueue to the runqueue in new_xcg */ 395 enqueue_ctx(xse, xcu); 396 mutex_unlock(&xcu->xcu_lock); 397 } 398 spin_unlock(&old_xcg->lock); 399 } 400 401 static void xcu_attach(struct cgroup_taskset *tset) 402 { 403 struct xcg_attach_entry *entry, *tmp; 404 405 list_for_each_entry(entry, &xcg_attach_list, node) { 406 xcu_move_task(entry->task, entry->old_xcg, entry->new_xcg); 407 } 408 409 /* cleanup */ 410 list_for_each_entry_safe(entry, tmp, &xcg_attach_list, node) { 411 list_del(&entry->node); 412 kmem_cache_free(xcg_attach_entry_cache, entry); 413 } 414 } 415 416 /** 417 * xsched_group_inherit() - Attach new entity to task's xsched_group. 418 * @task: task_struct 419 * @xse: xsched entity 420 * 421 * Called in xsched context initialization to attach xse to task's group 422 * and inherit its xse scheduling class and bandwidth control policy. 423 * 424 * Return: Zero on success. 425 */ 426 void xsched_group_inherit(struct task_struct *task, struct xsched_entity *xse) 427 { 428 struct cgroup_subsys_state *css; 429 struct xsched_group *xg; 430 431 xse->owner_pid = task_pid_nr(task); 432 css = task_get_css(task, xcu_cgrp_id); 433 xg = xcu_cg_from_css(css); 434 xsched_group_xse_attach(xg, xse); 435 css_put(css); 436 } 437 438 static int xcu_sched_class_show(struct seq_file *sf, void *v) 439 { 440 struct cgroup_subsys_state *css = seq_css(sf); 441 struct xsched_group *xg = xcu_cg_from_css(css); 442 443 seq_printf(sf, "%s\n", xcu_sched_name[xg->sched_class]); 444 return 0; 445 } 446 447 /** 448 * xcu_cg_set_sched_class() - Set scheduling type for group. 449 * @xg: xsched group 450 * @type: scheduler type 451 * 452 * Scheduler type can be changed if task is child of root group 453 * and haven't got scheduling entities. 454 * 455 * Return: Zero on success or -EINVAL 456 */ 457 static int xcu_cg_set_sched_class(struct xsched_group *xg, int type) 458 { 459 if (type == xg->sched_class) 460 return 0; 461 462 /* can't change scheduler when there are running members */ 463 if (!list_empty(&xg->members)) 464 return -EBUSY; 465 466 /* deinit old type if necessary */ 467 switch (xg->sched_class) { 468 case XSCHED_TYPE_CFS: 469 xcu_cfs_cg_deinit(xg); 470 break; 471 default: 472 break; 473 } 474 475 /* update type */ 476 xg->sched_class = type; 477 478 /* init new type if necessary */ 479 switch (type) { 480 case XSCHED_TYPE_CFS: 481 return xcu_cfs_cg_init(xg, xg->parent); 482 default: 483 return 0; 484 } 485 } 486 487 static ssize_t xcu_sched_class_write(struct kernfs_open_file *of, char *buf, 488 size_t nbytes, loff_t off) 489 { 490 struct cgroup_subsys_state *css = of_css(of); 491 struct xsched_group *xg = xcu_cg_from_css(css); 492 char type_name[4]; 493 int type = -1; 494 495 ssize_t ret = sscanf(buf, "%3s", type_name); 496 497 if (ret < 1) 498 return -EINVAL; 499 500 for (type = 0; type < XSCHED_TYPE_NUM; type++) { 501 if (!strcmp(type_name, xcu_sched_name[type])) 502 break; 503 } 504 505 if (type == XSCHED_TYPE_NUM) 506 return -EINVAL; 507 508 if (!list_empty(&css->children)) 509 return -EBUSY; 510 511 /* only root child can switch scheduler type */ 512 if (!xg->parent || !xsched_group_css_is_root(&xg->parent->css, false)) 513 return -EINVAL; 514 515 ret = xcu_cg_set_sched_class(xg, type); 516 517 return (ret) ? ret : nbytes; 518 } 519 > 520 static s64 xcu_read_s64(struct cgroup_subsys_state *css, struct cftype *cft) 521 { 522 s64 ret = 0; 523 struct xsched_group *xcucg = xcu_cg_from_css(css); 524 525 switch (cft->private) { 526 case XCU_FILE_SHARES: 527 ret = xcucg->shares_cfg; 528 break; 529 default: 530 XSCHED_ERR("invalid operation %lu @ %s\n", cft->private, __func__); 531 break; 532 } 533 534 return ret; 535 } 536 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3316/3316] block/blk-io-hierarchy/iodump.c:188:22: error: 'struct bio' has no member named 'bi_blkg'
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 041fb9446ce5643d6c19a4b5bcbb3068054a42fd commit: 1bf8f90fb90c600d9f372e6be4ef251cc8905f04 [3316/3316] block-io-hierarchy: core hierarchy stats and iodump implementation config: x86_64-buildonly-randconfig-001-20251125 (https://download.01.org/0day-ci/archive/20251125/202511250327.zVFjEAbx-lkp@…) compiler: gcc-12 (Debian 12.4.0-5) 12.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250327.zVFjEAbx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250327.zVFjEAbx-lkp@intel.com/ All errors (new ones prefixed by >>): block/blk-io-hierarchy/iodump.c: In function '__hierarchy_show_bio': >> block/blk-io-hierarchy/iodump.c:188:22: error: 'struct bio' has no member named 'bi_blkg' 188 | blkg_path(bio->bi_blkg, path, PATH_LEN); | ^~ >> block/blk-io-hierarchy/iodump.c:188:9: error: too many arguments to function 'blkg_path' 188 | blkg_path(bio->bi_blkg, path, PATH_LEN); | ^~~~~~~~~ In file included from block/blk-io-hierarchy/iodump.c:21: block/blk-io-hierarchy/../blk-cgroup.h:535:21: note: declared here 535 | static inline char *blkg_path(struct blkcg_gq *blkg) { return NULL; } | ^~~~~~~~~ vim +188 block/blk-io-hierarchy/iodump.c 179 180 static void __hierarchy_show_bio(struct seq_file *m, struct bio *bio, 181 enum stage_group stage, u64 duration) 182 { 183 char rwbs[RWB_LEN]; 184 char path[PATH_LEN] = {0}; 185 struct task_struct *task = get_pid_task(bio->pid, PIDTYPE_PID); 186 187 blk_fill_rwbs(rwbs, bio->bi_opf); > 188 blkg_path(bio->bi_blkg, path, PATH_LEN); 189 190 seq_printf(m, "%s-%d %s stage %s bio %s %llu + %u cgroup %s started %llu ns ago\n", 191 task ? task->comm : "null", task ? task->pid : 0, 192 bio->bi_bdev->bd_disk->disk_name, 193 hierarchy_stage_name(stage), rwbs, bio->bi_iter.bi_sector, 194 bio_sectors(bio), path, duration); 195 196 if (task) 197 put_task_struct(task); 198 } 199 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3309/3309] drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'formats' is used uninitialized whenever switch case is taken
by kernel test robot 25 Nov '25

25 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 16b8586be5cdac465d2c81e7cdaffcc80384bfb7 commit: 80764bc784413eb604c7d472db55b1ca72d4bbc5 [3309/3309] drm/loongson: add kernel modesetting driver support for ls7a1000/ls7a2000 config: x86_64-buildonly-randconfig-001-20251124 (https://download.01.org/0day-ci/archive/20251125/202511250117.AjD77new-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9e9fe08b16ea2c4d9867fb4974edf2a3776d6ece) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251125/202511250117.AjD77new-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511250117.AjD77new-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'lo32_addr_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:114:33: note: uninitialized use occurs here 114 | writel(paddr, ldev->reg_base + lo32_addr_reg); | ^~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:77:19: note: initialize the variable 'lo32_addr_reg' to silence this warning 77 | u32 lo32_addr_reg; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'hi32_addr_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:115:48: note: uninitialized use occurs here 115 | writel((paddr >> 32) & 0xFF, ldev->reg_base + hi32_addr_reg); | ^~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:78:19: note: initialize the variable 'hi32_addr_reg' to silence this warning 78 | u32 hi32_addr_reg; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'val' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:120:9: note: uninitialized use occurs here 120 | writel(val | CFG_PAGE_FLIP_BIT, ldev->reg_base + cfg_reg); | ^~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:80:9: note: initialize the variable 'val' to silence this warning 80 | u32 val; | ^ | = 0 drivers/gpu/drm/loongson/lsdc_plane.c:98:13: warning: variable 'cfg_reg' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 98 | } else if (index == 1) { | ^~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:120:51: note: uninitialized use occurs here 120 | writel(val | CFG_PAGE_FLIP_BIT, ldev->reg_base + cfg_reg); | ^~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:98:9: note: remove the 'if' if its condition is always true 98 | } else if (index == 1) { | ^~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:79:13: note: initialize the variable 'cfg_reg' to silence this warning 79 | u32 cfg_reg; | ^ | = 0 >> drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'formats' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:451:12: note: uninitialized use occurs here 451 | formats, format_count, | ^~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:429:20: note: initialize the variable 'formats' to silence this warning 429 | const u32 *formats; | ^ | = NULL drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'format_count' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:451:21: note: uninitialized use occurs here 451 | formats, format_count, | ^~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:428:27: note: initialize the variable 'format_count' to silence this warning 428 | unsigned int format_count; | ^ | = 0 >> drivers/gpu/drm/loongson/lsdc_plane.c:444:7: warning: variable 'name' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized] 444 | case DRM_PLANE_TYPE_OVERLAY: | ^~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/loongson/lsdc_plane.c:453:18: note: uninitialized use occurs here 453 | type, name, index); | ^~~~ drivers/gpu/drm/loongson/lsdc_plane.c:430:18: note: initialize the variable 'name' to silence this warning 430 | const char *name; | ^ | = NULL 7 warnings generated. vim +/formats +444 drivers/gpu/drm/loongson/lsdc_plane.c 420 421 int lsdc_plane_init(struct lsdc_device *ldev, 422 struct drm_plane *plane, 423 enum drm_plane_type type, 424 unsigned int index) 425 { 426 struct drm_device *ddev = ldev->ddev; 427 int zpos = lsdc_plane_get_default_zpos(type); 428 unsigned int format_count; 429 const u32 *formats; 430 const char *name; 431 int ret; 432 433 switch (type) { 434 case DRM_PLANE_TYPE_PRIMARY: 435 formats = lsdc_primary_formats; 436 format_count = ARRAY_SIZE(lsdc_primary_formats); 437 name = "primary-%u"; 438 break; 439 case DRM_PLANE_TYPE_CURSOR: 440 formats = lsdc_cursor_formats; 441 format_count = ARRAY_SIZE(lsdc_cursor_formats); 442 name = "cursor-%u"; 443 break; > 444 case DRM_PLANE_TYPE_OVERLAY: -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] init/Kconfig: Move ARCH_SUPPORTS_SCHED_SOFT_QUOTA to drop CGROUPS dependency
by Chen Jinghuang 24 Nov '25

24 Nov '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CIH ---------------------------------------- ARCH_SUPPORTS_SCHED_SOFT_QUOTA was previously in a CGROUPS-dependent block, causing build warning when ARCH_SUPPORTS_SCHED_SOFT_QUOTA=y and CGROUPS=n. Move it to a generic, CGROUPS-independent section in init/Kconfig to fix the errors, while preserving its original role as an arch capability flag. Fixes: a91091aed1fa ("sched: More flexible use of CPU quota when CPU is idle") Signed-off-by: Chen Jinghuang<chenjinghuang2(a)huawei.com> --- init/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/init/Kconfig b/init/Kconfig index 485583e8ecbe..874daa00304c 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -950,6 +950,9 @@ config NUMA_BALANCING_DEFAULT_ENABLED If set, automatic NUMA balancing will be enabled if running on a NUMA machine. +config ARCH_SUPPORTS_SCHED_SOFT_QUOTA + bool + menuconfig CGROUPS bool "Control Group support" select KERNFS @@ -1178,9 +1181,6 @@ config SCHED_SOFT_DOMAIN # # For architectures that want to enable the support for SCHED_SOFT_QUOTA # -config ARCH_SUPPORTS_SCHED_SOFT_QUOTA - bool - config SCHED_SOFT_QUOTA bool "More flexible use of CPU quota" depends on ARCH_SUPPORTS_SCHED_SOFT_QUOTA -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Avoid RCU context warning when unpinning htab with internal structs
by Luo Gengkun 24 Nov '25

24 Nov '25

From: KaFai Wan <kafai.wan(a)linux.dev> stable inclusion from stable-v6.6.113 commit b6e9645be9eb93f7aff3ca887f8edb6f1d63358f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID8BLB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit 4f375ade6aa9f37fd72d7a78682f639772089eed ] When unpinning a BPF hash table (htab or htab_lru) that contains internal structures (timer, workqueue, or task_work) in its values, a BUG warning is triggered: BUG: sleeping function called from invalid context at kernel/bpf/hashtab.c:244 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 14, name: ksoftirqd/0 ... The issue arises from the interaction between BPF object unpinning and RCU callback mechanisms: 1. BPF object unpinning uses ->free_inode() which schedules cleanup via call_rcu(), deferring the actual freeing to an RCU callback that executes within the RCU_SOFTIRQ context. 2. During cleanup of hash tables containing internal structures, htab_map_free_internal_structs() is invoked, which includes cond_resched() or cond_resched_rcu() calls to yield the CPU during potentially long operations. However, cond_resched() or cond_resched_rcu() cannot be safely called from atomic RCU softirq context, leading to the BUG warning when attempting to reschedule. Fix this by changing from ->free_inode() to ->destroy_inode() and rename bpf_free_inode() to bpf_destroy_inode() for BPF objects (prog, map, link). This allows direct inode freeing without RCU callback scheduling, avoiding the invalid context warning. Reported-by: Le Chen <tom2cat(a)sjtu.edu.cn> Closes: https://lore.kernel.org/all/1444123482.1827743.1750996347470.JavaMail.zimbr… Fixes: 68134668c17f ("bpf: Add map side support for bpf timers.") Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: KaFai Wan <kafai.wan(a)linux.dev> Acked-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20251008102628.808045-2-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/bpf/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c index 99d0625b6c82..9a9630adcba4 100644 --- a/kernel/bpf/inode.c +++ b/kernel/bpf/inode.c @@ -607,7 +607,7 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root) return 0; } -static void bpf_free_inode(struct inode *inode) +static void bpf_destroy_inode(struct inode *inode) { enum bpf_type type; @@ -622,7 +622,7 @@ static const struct super_operations bpf_super_ops = { .statfs = simple_statfs, .drop_inode = generic_delete_inode, .show_options = bpf_show_options, - .free_inode = bpf_free_inode, + .destroy_inode = bpf_destroy_inode, }; enum { -- 2.34.1

2 1

[PATCH OLK-6.6] sunrpc: fix null pointer dereference on zero-length checksum
by Wang Liang 24 Nov '25

24 Nov '25

From: Lei Lu <llfamsec(a)gmail.com> stable inclusion from stable-v6.6.112 commit 81cec07d303186d0d8c623ef8b5ecd3b81e94cf6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B5E CVE: CVE-2025-40129 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6df164e29bd4e6505c5a2e0e5f1e1f6957a16a42 upstream. In xdr_stream_decode_opaque_auth(), zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gss_krb5_verify_mic_v2(). This patch ensures that the value of checksum.len is not less than XDR_UNIT. Fixes: 0653028e8f1c ("SUNRPC: Convert gss_verify_header() to use xdr_stream") Cc: stable(a)kernel.org Signed-off-by: Lei Lu <llfamsec(a)gmail.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index cf30bd649e27..d063b63516f8 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -724,7 +724,7 @@ svcauth_gss_verify_header(struct svc_rqst *rqstp, struct rsc *rsci, rqstp->rq_auth_stat = rpc_autherr_badverf; return SVC_DENIED; } - if (flavor != RPC_AUTH_GSS) { + if (flavor != RPC_AUTH_GSS || checksum.len < XDR_UNIT) { rqstp->rq_auth_stat = rpc_autherr_badverf; return SVC_DENIED; } -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
by Wang Liang 24 Nov '25

24 Nov '25

From: Daniel Borkmann <daniel(a)iogearbox.net> stable inclusion from stable-v5.10.246 commit 3fba965a9aac0fa3cbd8138436a37af9ab466d79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVH CVE: CVE-2025-40183 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first. Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") Reported-by: Yusuke Suzuki <yusuke.suzuki(a)isovalent.com> Reported-by: Julian Wiedmann <jwi(a)isovalent.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Martin KaFai Lau <martin.lau(a)kernel.org> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Jordan Rife <jrife(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Jordan Rife <jrife(a)google.com> Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Reviewed-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index d3e64273b3c4..adacca9ee505 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2256,6 +2256,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, if (IS_ERR(dst)) goto out_drop; + skb_dst_drop(skb); skb_dst_set(skb, dst); } else if (nh->nh_family != AF_INET6) { goto out_drop; @@ -2371,6 +2372,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, goto out_drop; } + skb_dst_drop(skb); skb_dst_set(skb, &rt->dst); } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}
by Wang Liang 24 Nov '25

24 Nov '25

From: Daniel Borkmann <daniel(a)iogearbox.net> stable inclusion from stable-v6.6.113 commit b6bfe44b6dbb14a31d86c475cdc9c7689534fb09 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVH CVE: CVE-2025-40183 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23f3770e1a53e6c7a553135011f547209e141e72 ] Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside the cluster. The traffic is directed to the gateway via vxlan tunnel in collect md mode. A recent BPF change utilized the bpf_redirect_neigh() helper to forward packets after the arrival and decap on vxlan, which turned out over time that the kmalloc-256 slab usage in kernel was ever-increasing. The issue was that vxlan allocates the metadata_dst object and attaches it through a fake dst entry to the skb. The latter was never released though given bpf_redirect_neigh() was merely setting the new dst entry via skb_dst_set() without dropping an existing one first. Fixes: b4ab31414970 ("bpf: Add redirect_neigh helper as redirect drop-in") Reported-by: Yusuke Suzuki <yusuke.suzuki(a)isovalent.com> Reported-by: Julian Wiedmann <jwi(a)isovalent.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Martin KaFai Lau <martin.lau(a)kernel.org> Cc: Jakub Kicinski <kuba(a)kernel.org> Cc: Jordan Rife <jrife(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Jordan Rife <jrife(a)google.com> Reviewed-by: Jakub Kicinski <kuba(a)kernel.org> Reviewed-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20251003073418.291171-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/core/filter.c b/net/core/filter.c index 8e5803fbf16e..eee64a67df40 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2272,6 +2272,7 @@ static int __bpf_redirect_neigh_v6(struct sk_buff *skb, struct net_device *dev, if (IS_ERR(dst)) goto out_drop; + skb_dst_drop(skb); skb_dst_set(skb, dst); } else if (nh->nh_family != AF_INET6) { goto out_drop; @@ -2381,6 +2382,7 @@ static int __bpf_redirect_neigh_v4(struct sk_buff *skb, struct net_device *dev, goto out_drop; } + skb_dst_drop(skb); skb_dst_set(skb, &rt->dst); } -- 2.34.1

2 1

[PATCH OLK-6.6] net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
by Wang Liang 24 Nov '25

24 Nov '25

From: Alexandr Sapozhnikov <alsp705(a)gmail.com> stable inclusion from stable-v6.6.113 commit c21f45cfa4a9526b34d76b397c9ef080668b6e73 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVQ CVE: CVE-2025-40187 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2f3119686ef50319490ccaec81a575973da98815 ] If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then the variable ai_ev remains zero and the zero will be dereferenced in the sctp_ulpevent_free() function. Signed-off-by: Alexandr Sapozhnikov <alsp705(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Fixes: 30f6ebf65bc4 ("sctp: add SCTP_AUTH_NO_AUTH type for AUTHENTICATION_EVENT") Link: https://patch.msgid.link/20251002091448.11-1-alsp705@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/sm_statefuns.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 808863e047e0..2d88654e8d8e 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -884,7 +884,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, return SCTP_DISPOSITION_CONSUME; nomem_authev: - sctp_ulpevent_free(ai_ev); + if (ai_ev) + sctp_ulpevent_free(ai_ev); nomem_aiev: sctp_ulpevent_free(ev); nomem_ev: -- 2.34.1

2 1

[PATCH OLK-6.6] sctp: Fix MAC comparison to be constant-time
by Wang Liang 24 Nov '25

24 Nov '25

From: Eric Biggers <ebiggers(a)kernel.org> stable inclusion from stable-v6.6.113 commit ed3044b9c810c5c24eb2830053fbfe5fd134c5d4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BW6 CVE: CVE-2025-40204 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dd91c79e4f58fbe2898dac84858033700e0e99fb upstream. To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Link: https://patch.msgid.link/20250818205426.30222-3-ebiggers@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/sm_make_chunk.c | 3 ++- net/sctp/sm_statefuns.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 08527d882e56..eb2ed7db3fe1 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -31,6 +31,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <crypto/hash.h> +#include <crypto/utils.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h> @@ -1796,7 +1797,7 @@ struct sctp_association *sctp_unpack_cookie( } } - if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { + if (crypto_memneq(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { *error = -SCTP_IERROR_BAD_SIG; goto fail; } diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 808863e047e0..34b257d88b65 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -30,6 +30,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +#include <crypto/utils.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h> @@ -4415,7 +4416,7 @@ static enum sctp_ierror sctp_sf_authenticate( sh_key, GFP_ATOMIC); /* Discard the packet if the digests do not match */ - if (memcmp(save_digest, digest, sig_len)) { + if (crypto_memneq(save_digest, digest, sig_len)) { kfree(save_digest); return SCTP_IERROR_BAD_SIG; } -- 2.34.1

2 1

[PATCH OLK-5.10] NFSv4: Fix deadlock during the running of state manager
by Li Lingfeng 24 Nov '25

24 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBAFF1 -------------------------------- Unlinking file may cause the following deadlock in state manager: [root@localhost test]# cat /proc/2943/stack [<0>] rpc_wait_bit_killable+0x1a/0x90 [<0>] _nfs4_proc_delegreturn+0x60f/0x760 [<0>] nfs4_proc_delegreturn+0x13d/0x2a0 [<0>] nfs_do_return_delegation+0xba/0x110 [<0>] nfs_end_delegation_return+0x32c/0x620 [<0>] nfs_complete_unlink+0xc7/0x290 [<0>] nfs_dentry_iput+0x36/0x50 [<0>] __dentry_kill+0xaa/0x250 [<0>] dput.part.0+0x26c/0x4d0 [<0>] __put_nfs_open_context+0x1d9/0x260 [<0>] nfs4_open_reclaim+0x77/0xa0 [<0>] nfs4_do_reclaim+0x385/0xf40 [<0>] nfs4_state_manager+0x762/0x14e0 [<0>] nfs4_run_state_manager+0x181/0x330 [<0>] kthread+0x1a7/0x1f0 [<0>] ret_from_fork+0x34/0x60 [<0>] ret_from_fork_asm+0x1a/0x30 [root@localhost test]# It can be reproduced by following steps: 1) client: open file 2) client: unlink file 3) server: service restart(trigger state manager in client) 4) client: close file(in nfs4_open_reclaim, between nfs4_do_open_reclaim and put_nfs_open_context) Since the file has been open, unlinking will just set DCACHE_NFSFS_RENAMED for the dentry like this: nfs_unlink nfs_sillyrename nfs_async_unlink // set DCACHE_NFSFS_RENAMED Restarting service will trigger state manager in client. (1) NFS4_SLOT_TBL_DRAINING will be set to nfs4_slot_table since session has been reset. (2) DCACHE_NFSFS_RENAMED is detected in nfs_dentry_iput. Therefore, nfs_complete_unlink is called to trigger delegation return. (3) Due to the slot table being in draining state and sa_privileged being 0, the delegation return will be queued and wait. nfs4_state_manager nfs4_reset_session nfs4_begin_drain_session nfs4_drain_slot_tbl // set NFS4_SLOT_TBL_DRAINING (1) nfs4_do_reclaim nfs4_open_reclaim __put_nfs_open_context __dentry_kill nfs_dentry_iput // check DCACHE_NFSFS_RENAMED (2) nfs_complete_unlink nfs_end_delegation_return nfs_do_return_delegation nfs4_proc_delegreturn _nfs4_proc_delegreturn rpc_run_task ... nfs4_delegreturn_prepare nfs4_setup_sequence nfs4_slot_tbl_draining // check NFS4_SLOT_TBL_DRAINING // and sa_privileged is 0 (3) rpc_sleep_on // set queued and add to slot_tbl_waitq // rpc_task is async and wait in __rpc_execute rpc_wait_for_completion_task __rpc_wait_for_completion_task out_of_line_wait_on_bit rpc_wait_bit_killable // wait for rpc_task to complete <-------- can not get here to wake up rpc_task --------> nfs4_end_drain_session nfs4_end_drain_slot_table nfs41_wake_slot_table On the one hand, the state manager is blocked by the unfinished delegation return. As a result, nfs4_end_drain_session cannot be invoked to clear NFS4_SLOT_TBL_DRAINING and wake up waiting tasks. On the other hand, since NFS4_SLOT_TBL_DRAINING is not cleared, delegation return can only wait in the queue, resulting in a deadlock. Fix it by turning the delegation return into a privileged operation for the case where the nfs_client is in NFS4CLNT_RECLAIM_REBOOT state. Fixes: 977fcc2b0b41 ("NFS: Add a delegation return into nfs4_proc_unlink_setup()") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 349994e18fd6..35c15d20a84e 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6571,7 +6571,7 @@ static int _nfs4_proc_delegreturn(struct inode *inode, const struct cred *cred, } } - if (!data->inode) + if (!data->inode || test_bit(NFS4CLNT_RECLAIM_REBOOT, &server->nfs_client->cl_state)) nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, 1); else -- 2.46.1

2 1

[PATCH OLK-6.6] NFSv4: Fix deadlock during the running of state manager
by Li Lingfeng 24 Nov '25

24 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBAFF1 -------------------------------- Unlinking file may cause the following deadlock in state manager: [root@localhost test]# cat /proc/2943/stack [<0>] rpc_wait_bit_killable+0x1a/0x90 [<0>] _nfs4_proc_delegreturn+0x60f/0x760 [<0>] nfs4_proc_delegreturn+0x13d/0x2a0 [<0>] nfs_do_return_delegation+0xba/0x110 [<0>] nfs_end_delegation_return+0x32c/0x620 [<0>] nfs_complete_unlink+0xc7/0x290 [<0>] nfs_dentry_iput+0x36/0x50 [<0>] __dentry_kill+0xaa/0x250 [<0>] dput.part.0+0x26c/0x4d0 [<0>] __put_nfs_open_context+0x1d9/0x260 [<0>] nfs4_open_reclaim+0x77/0xa0 [<0>] nfs4_do_reclaim+0x385/0xf40 [<0>] nfs4_state_manager+0x762/0x14e0 [<0>] nfs4_run_state_manager+0x181/0x330 [<0>] kthread+0x1a7/0x1f0 [<0>] ret_from_fork+0x34/0x60 [<0>] ret_from_fork_asm+0x1a/0x30 [root@localhost test]# It can be reproduced by following steps: 1) client: open file 2) client: unlink file 3) server: service restart(trigger state manager in client) 4) client: close file(in nfs4_open_reclaim, between nfs4_do_open_reclaim and put_nfs_open_context) Since the file has been open, unlinking will just set DCACHE_NFSFS_RENAMED for the dentry like this: nfs_unlink nfs_sillyrename nfs_async_unlink // set DCACHE_NFSFS_RENAMED Restarting service will trigger state manager in client. (1) NFS4_SLOT_TBL_DRAINING will be set to nfs4_slot_table since session has been reset. (2) DCACHE_NFSFS_RENAMED is detected in nfs_dentry_iput. Therefore, nfs_complete_unlink is called to trigger delegation return. (3) Due to the slot table being in draining state and sa_privileged being 0, the delegation return will be queued and wait. nfs4_state_manager nfs4_reset_session nfs4_begin_drain_session nfs4_drain_slot_tbl // set NFS4_SLOT_TBL_DRAINING (1) nfs4_do_reclaim nfs4_open_reclaim __put_nfs_open_context __dentry_kill nfs_dentry_iput // check DCACHE_NFSFS_RENAMED (2) nfs_complete_unlink nfs_end_delegation_return nfs_do_return_delegation nfs4_proc_delegreturn _nfs4_proc_delegreturn rpc_run_task ... nfs4_delegreturn_prepare nfs4_setup_sequence nfs4_slot_tbl_draining // check NFS4_SLOT_TBL_DRAINING // and sa_privileged is 0 (3) rpc_sleep_on // set queued and add to slot_tbl_waitq // rpc_task is async and wait in __rpc_execute rpc_wait_for_completion_task __rpc_wait_for_completion_task out_of_line_wait_on_bit rpc_wait_bit_killable // wait for rpc_task to complete <-------- can not get here to wake up rpc_task --------> nfs4_end_drain_session nfs4_end_drain_slot_table nfs41_wake_slot_table On the one hand, the state manager is blocked by the unfinished delegation return. As a result, nfs4_end_drain_session cannot be invoked to clear NFS4_SLOT_TBL_DRAINING and wake up waiting tasks. On the other hand, since NFS4_SLOT_TBL_DRAINING is not cleared, delegation return can only wait in the queue, resulting in a deadlock. Fix it by turning the delegation return into a privileged operation for the case where the nfs_client is in NFS4CLNT_RECLAIM_REBOOT state. Fixes: 977fcc2b0b41 ("NFS: Add a delegation return into nfs4_proc_unlink_setup()") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index c140427e322c..e197bea6c6a9 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6725,7 +6725,7 @@ static int _nfs4_proc_delegreturn(struct inode *inode, const struct cred *cred, } } - if (!data->inode) + if (!data->inode || test_bit(NFS4CLNT_RECLAIM_REBOOT, &server->nfs_client->cl_state)) nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, 1); else -- 2.46.1

2 1

[openeuler:OLK-6.6 3313/3313] block/genhd.c:100:6: warning: no previous prototype for function 'part_stat_read_all'
by kernel test robot 24 Nov '25

24 Nov '25

Hi GONG, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f75af043f61c1e2311edf9edd2c5e0987e5ab3c9 commit: 89fa7dcff5e533bd14396601f40c388cfb6c1e59 [3313/3313] bpf-rvi: block: Add diskstats iterator target config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20251124/202511241700.GqFsj3QM-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9e9fe08b16ea2c4d9867fb4974edf2a3776d6ece) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251124/202511241700.GqFsj3QM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511241700.GqFsj3QM-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/genhd.c:100:6: warning: no previous prototype for function 'part_stat_read_all' [-Wmissing-prototypes] 100 | void part_stat_read_all(struct block_device *part, struct disk_stats *stat) | ^ block/genhd.c:100:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 100 | void part_stat_read_all(struct block_device *part, struct disk_stats *stat) | ^ | static 1 warning generated. vim +/part_stat_read_all +100 block/genhd.c 99 > 100 void part_stat_read_all(struct block_device *part, struct disk_stats *stat) 101 { 102 int cpu; 103 104 memset(stat, 0, sizeof(struct disk_stats)); 105 for_each_possible_cpu(cpu) { 106 struct disk_stats *ptr = per_cpu_ptr(part->bd_stats, cpu); 107 int group; 108 109 for (group = 0; group < NR_STAT_GROUPS; group++) { 110 stat->nsecs[group] += ptr->nsecs[group]; 111 stat->sectors[group] += ptr->sectors[group]; 112 stat->ios[group] += ptr->ios[group]; 113 stat->merges[group] += ptr->merges[group]; 114 } 115 116 stat->io_ticks += ptr->io_ticks; 117 } 118 } 119 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] sbitmap: fix infinite loop caused by negative wait_cnt
by Li Lingfeng 24 Nov '25

24 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID5F52 -------------------------------- A race condition in sbitmap_queue_wake_up() can cause an infinite loop when multiple CPUs concurrently decrement the same wait_cnt, resulting in a negative value that still satisfies the original condition check. The race scenario: CPU20 (in ioctl context): - Calls __sbq_wake_up() and selects ws based on wake_index CPU3 (in softirq): - Concurrently selects the same ws (wake_index unchanged) - Decrements wait_cnt from 1 to 0 CPU20 (interrupted by softirq): - Selects the same ws again (wake_index still unchanged) - Decrements wait_cnt from 0 to -1 - Returns true because (wait_cnt < 0) - Enters infinite loop in while(__sbq_wake_up(sbq)) The root cause is that sbq_wake_ptr() returns the wait_state when atomic_read(&ws->wait_cnt) is non-zero, which includes negative values. Since wake_index is never updated when the same ws is repeatedly selected, multiple CPUs can race on the same wait_state, driving wait_cnt increasingly negative and triggering the infinite loop condition. Fix this by explicitly checking that wait_cnt is positive (> 0) in sbq_wake_ptr(), preventing selection of wait_states with negative counts and breaking the infinite loop condition. Fixes: 084cd94d0b2a ("sbitmap: fix possible io hung due to lost wakeup") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- lib/sbitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/sbitmap.c b/lib/sbitmap.c index 9fe2aebc13da..dbe4e3bc6b33 100644 --- a/lib/sbitmap.c +++ b/lib/sbitmap.c @@ -554,7 +554,7 @@ static struct sbq_wait_state *sbq_wake_ptr(struct sbitmap_queue *sbq) for (i = 0; i < SBQ_WAIT_QUEUES; i++) { struct sbq_wait_state *ws = &sbq->ws[wake_index]; - if (waitqueue_active(&ws->wait) && atomic_read(&ws->wait_cnt)) { + if (waitqueue_active(&ws->wait) && (atomic_read(&ws->wait_cnt) > 0)) { if (wake_index != atomic_read(&sbq->wake_index)) atomic_set(&sbq->wake_index, wake_index); return ws; -- 2.46.1

2 1

[PATCH OLK-6.6] net: usb: asix: hold PM usage ref to avoid PM/MDIO + RTNL deadlock
by Yao Kai 24 Nov '25

24 Nov '25

From: Oleksij Rempel <o.rempel(a)pengutronix.de> stable inclusion from stable-v6.6.112 commit 724a9db84188f80ef60b1f21cc7b4e9c84e0cb64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB4 CVE: CVE-2025-40120 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3d3c4cd5c62f24bb3cb4511b7a95df707635e00a upstream. Prevent USB runtime PM (autosuspend) for AX88772* in bind. usbnet enables runtime PM (autosuspend) by default, so disabling it via the usb_driver flag is ineffective. On AX88772B, autosuspend shows no measurable power saving with current driver (no link partner, admin up/down). The ~0.453 W -> ~0.248 W drop on v6.1 comes from phylib powering the PHY off on admin-down, not from USB autosuspend. The real hazard is that with runtime PM enabled, ndo_open() (under RTNL) may synchronously trigger autoresume (usb_autopm_get_interface()) into asix_resume() while the USB PM lock is held. Resume paths then invoke phylink/phylib and MDIO, which also expect RTNL, leading to possible deadlocks or PM lock vs MDIO wake issues. To avoid this, keep the device runtime-PM active by taking a usage reference in ax88772_bind() and dropping it in unbind(). A non-zero PM usage count blocks runtime suspend regardless of userspace policy (.../power/control - pm_runtime_allow/forbid), making this approach robust against sysfs overrides. Holding a runtime-PM usage ref does not affect system-wide suspend; system sleep/resume callbacks continue to run as before. Fixes: 4a2c7217cd5a ("net: usb: asix: ax88772: manage PHY PM from MAC") Reported-by: Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> Closes: https://lore.kernel.org/all/DCGHG5UJT9G3.2K1GHFZ3H87T0@gmail.com Tested-by: Hubert Wiśniewski <hubert.wisniewski.25632(a)gmail.com> Reported-by: Marek Szyprowski <m.szyprowski(a)samsung.com> Closes: https://lore.kernel.org/all/b5ea8296-f981-445d-a09a-2f389d7f6fdd@samsung.com Cc: stable(a)vger.kernel.org Signed-off-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://patch.msgid.link/20251005081203.3067982-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/net/usb/asix_devices.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c index 6d77083e6e10..9ced9441066c 100644 --- a/drivers/net/usb/asix_devices.c +++ b/drivers/net/usb/asix_devices.c @@ -625,6 +625,21 @@ static void ax88772_suspend(struct usbnet *dev) asix_read_medium_status(dev, 1)); } +/* Notes on PM callbacks and locking context: + * + * - asix_suspend()/asix_resume() are invoked for both runtime PM and + * system-wide suspend/resume. For struct usb_driver the ->resume() + * callback does not receive pm_message_t, so the resume type cannot + * be distinguished here. + * + * - The MAC driver must hold RTNL when calling phylink interfaces such as + * phylink_suspend()/resume(). Those calls will also perform MDIO I/O. + * + * - Taking RTNL and doing MDIO from a runtime-PM resume callback (while + * the USB PM lock is held) is fragile. Since autosuspend brings no + * measurable power saving here, we block it by holding a PM usage + * reference in ax88772_bind(). + */ static int asix_suspend(struct usb_interface *intf, pm_message_t message) { struct usbnet *dev = usb_get_intfdata(intf); @@ -921,6 +936,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) if (ret) goto initphy_err; + /* Keep this interface runtime-PM active by taking a usage ref. + * Prevents runtime suspend while bound and avoids resume paths + * that could deadlock (autoresume under RTNL while USB PM lock + * is held, phylink/MDIO wants RTNL). + */ + pm_runtime_get_noresume(&intf->dev); + return 0; initphy_err: @@ -950,6 +972,8 @@ static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf) phylink_destroy(priv->phylink); ax88772_mdio_unregister(priv); asix_rx_fixup_common_free(dev->driver_priv); + /* Drop the PM usage ref taken in bind() */ + pm_runtime_put(&intf->dev); } static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf) @@ -1609,6 +1633,11 @@ static struct usb_driver asix_driver = { .resume = asix_resume, .reset_resume = asix_resume, .disconnect = usbnet_disconnect, + /* usbnet enables autosuspend by default (supports_autosuspend=1). + * We keep runtime-PM active for AX88772* by taking a PM usage + * reference in ax88772_bind() (pm_runtime_get_noresume()) and + * dropping it in unbind(), which effectively blocks autosuspend. + */ .supports_autosuspend = 1, .disable_hub_initiated_lpm = 1, }; -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-39964
by Gu Bowen 24 Nov '25

24 Nov '25

CVE-2025-39964 Eric Biggers (1): crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Herbert Xu (1): crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg crypto/af_alg.c | 7 +++++++ include/crypto/if_alg.h | 10 ++++++---- 2 files changed, 13 insertions(+), 4 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/4] CVE-2025-40179
by Yongjian Sun 24 Nov '25

24 Nov '25

Baokun Li (1): ext4: align max orphan file size with e2fsprogs limit Jan Kara (2): ext4: verify orphan file size is not too big ext4: free orphan info with kvfree Liao Yuanhong (1): ext4: use kmalloc_array() for array space allocation fs/ext4/orphan.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) -- 2.39.2

2 5

[PATCH OLK-6.6] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
by Bowen You 24 Nov '25

24 Nov '25

From: Yuhao Jiang <danisjiang(a)gmail.com> mainline inclusion from mainline-v6.18-rc4 commit 8f067aa59430266386b83c18b983ca583faa6a11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID7X34 CVE: CVE-2025-40211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Yuhao Jiang <danisjiang(a)gmail.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> [ rjw: Changelog edit ] Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c index a971770e24ff..841db33e9475 100644 --- a/drivers/acpi/acpi_video.c +++ b/drivers/acpi/acpi_video.c @@ -1952,8 +1952,10 @@ static void acpi_video_bus_remove_notify_handler(struct acpi_video_bus *video) struct acpi_video_device *dev; mutex_lock(&video->device_list_lock); - list_for_each_entry(dev, &video->video_device_list, entry) + list_for_each_entry(dev, &video->video_device_list, entry) { acpi_video_dev_remove_notify_handler(dev); + cancel_delayed_work_sync(&dev->switch_brightness_work); + } mutex_unlock(&video->device_list_lock); acpi_video_bus_stop_devices(video); -- 2.34.1

2 1

[PATCH OLK-5.10] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
by Bowen You 24 Nov '25

24 Nov '25

From: Yuhao Jiang <danisjiang(a)gmail.com> mainline inclusion from mainline-v6.18-rc4 commit 8f067aa59430266386b83c18b983ca583faa6a11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID7X34 CVE: CVE-2025-40211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Yuhao Jiang <danisjiang(a)gmail.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> [ rjw: Changelog edit ] Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c index b2364ac455f3..f67871e8f383 100644 --- a/drivers/acpi/acpi_video.c +++ b/drivers/acpi/acpi_video.c @@ -2028,8 +2028,10 @@ static void acpi_video_bus_remove_notify_handler(struct acpi_video_bus *video) struct acpi_video_device *dev; mutex_lock(&video->device_list_lock); - list_for_each_entry(dev, &video->video_device_list, entry) + list_for_each_entry(dev, &video->video_device_list, entry) { acpi_video_dev_remove_notify_handler(dev); + cancel_delayed_work_sync(&dev->switch_brightness_work); + } mutex_unlock(&video->device_list_lock); acpi_video_bus_stop_devices(video); -- 2.34.1

2 1

[PATCH OLK-6.6] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
by Cai Xinchen 24 Nov '25

24 Nov '25

From: Zhen Ni <zhen.ni(a)easystack.cn> stable inclusion from stable-v6.6.112 commit fd8a23ecbc602d00e47b27f20b07350867d0ebe5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WHX CVE: CVE-2025-40035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream. Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields. Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput") Cc: stable(a)vger.kernel.org Signed-off-by: Zhen Ni <zhen.ni(a)easystack.cn> Link: https://lore.kernel.org/r/20250928063737.74590-1-zhen.ni@easystack.cn Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/input/misc/uinput.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 2c973f15cab7..edb62a284548 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -775,6 +775,7 @@ static int uinput_ff_upload_to_user(char __user *buffer, if (in_compat_syscall()) { struct uinput_ff_upload_compat ff_up_compat; + memset(&ff_up_compat, 0, sizeof(ff_up_compat)); ff_up_compat.request_id = ff_up->request_id; ff_up_compat.retval = ff_up->retval; /* -- 2.34.1

2 1

[openeuler:OLK-5.10 3304/3304] include/linux/sunrpc/xdr.h:606:10: warning: result of comparison of constant 4611686018427387903 with expression of type '__u32' (aka 'unsigned int') is always false
by kernel test robot 24 Nov '25

24 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4a93a68b1fa420e5791d9f16414d427f8dd90fb4 commit: fd2b905e3179865f7a512dfcfe14f10b6067236d [3304/3304] NFSD: prevent integer overflow on 32 bit systems config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20251124/202511241524.zGjjHi86-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9e9fe08b16ea2c4d9867fb4974edf2a3776d6ece) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251124/202511241524.zGjjHi86-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511241524.zGjjHi86-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from init/do_mounts.c:23: In file included from include/linux/nfs_fs.h:31: In file included from include/linux/sunrpc/auth.h:13: In file included from include/linux/sunrpc/sched.h:19: >> include/linux/sunrpc/xdr.h:606:10: warning: result of comparison of constant 4611686018427387903 with expression of type '__u32' (aka 'unsigned int') is always false [-Wtautological-constant-out-of-range-compare] 606 | if (len > SIZE_MAX / sizeof(*p)) | ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +606 include/linux/sunrpc/xdr.h 584 585 /** 586 * xdr_stream_decode_uint32_array - Decode variable length array of integers 587 * @xdr: pointer to xdr_stream 588 * @array: location to store the integer array or NULL 589 * @array_size: number of elements to store 590 * 591 * Return values: 592 * On success, returns number of elements stored in @array 593 * %-EBADMSG on XDR buffer overflow 594 * %-EMSGSIZE if the size of the array exceeds @array_size 595 */ 596 static inline ssize_t 597 xdr_stream_decode_uint32_array(struct xdr_stream *xdr, 598 __u32 *array, size_t array_size) 599 { 600 __be32 *p; 601 __u32 len; 602 ssize_t retval; 603 604 if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) 605 return -EBADMSG; > 606 if (len > SIZE_MAX / sizeof(*p)) 607 return -EBADMSG; 608 p = xdr_inline_decode(xdr, len * sizeof(*p)); 609 if (unlikely(!p)) 610 return -EBADMSG; 611 if (array == NULL) 612 return len; 613 if (len <= array_size) { 614 if (len < array_size) 615 memset(array+len, 0, (array_size-len)*sizeof(*array)); 616 array_size = len; 617 retval = len; 618 } else 619 retval = -EMSGSIZE; 620 for (; array_size > 0; p++, array++, array_size--) 621 *array = be32_to_cpup(p); 622 return retval; 623 } 624 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
by Ziming Du 24 Nov '25

24 Nov '25

From: I Viswanath <viswanathiyyappan(a)gmail.com> stable inclusion from stable-v6.6.112 commit 6394bade9daab8e318c165fe43bba012bf13cd8e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B6J CVE: CVE-2025-40140 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks. Reported-and-tested-by: syzbot+78cae3f37c62ad092caa(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Michal Pecio <michal.pecio(a)gmail.com> Signed-off-by: I Viswanath <viswanathiyyappan(a)gmail.com> Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/usb/rtl8150.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index ddff6f19ff98e..92add3daadbb1 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rtl8150_t *dev = netdev_priv(netdev); u16 rx_creg = 0x9e; - netif_stop_queue(netdev); if (netdev->flags & IFF_PROMISC) { rx_creg |= 0x0001; dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); @@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rx_creg &= 0x00fc; } async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); - netif_wake_queue(netdev); } static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, -- 2.43.0

2 1

[PATCH OLK-6.6] net: dlink: handle copy_thresh allocation failure
by Ziming Du 24 Nov '25

24 Nov '25

From: Yeounsu Moon <yyyynoom(a)gmail.com> stable inclusion from stable-v6.6.112 commit ea87151df398d407a632c7bf63013290f01c5009 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WGB CVE: CVE-2025-40053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon <yyyynoom(a)gmail.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c index db6615aa921b1..8fa9f7bf20abc 100644 --- a/drivers/net/ethernet/dlink/dl2k.c +++ b/drivers/net/ethernet/dlink/dl2k.c @@ -947,15 +947,18 @@ receive_packet (struct net_device *dev) } else { struct sk_buff *skb; + skb = NULL; /* Small skbuffs for short packets */ - if (pkt_len > copy_thresh) { + if (pkt_len <= copy_thresh) + skb = netdev_alloc_skb_ip_align(dev, pkt_len); + if (!skb) { dma_unmap_single(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, DMA_FROM_DEVICE); skb_put (skb = np->rx_skbuff[entry], pkt_len); np->rx_skbuff[entry] = NULL; - } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { + } else { dma_sync_single_for_cpu(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-40202
by Yi Yang 24 Nov '25

24 Nov '25

CVE fix patch: ipmi: Rework user message limit handling new bugfix: ipmi: Fix handling of messages with provided receive message pointer Corey Minyard (1): ipmi: Rework user message limit handling Guenter Roeck (1): ipmi: Fix handling of messages with provided receive message pointer drivers/char/ipmi/ipmi_msghandler.c | 416 +++++++++++++--------------- 1 file changed, 200 insertions(+), 216 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/5] CVE-2022-49722
by Xiaomeng Zhang 24 Nov '25

24 Nov '25

Jacob Keller (2): ice: convert ice_reset_vf to standard error codes ice: convert ice_reset_vf to take flags Michal Jaron (1): ice: Fix call trace with null VSI during VF reset Norbert Zulinski (1): ice: Fix spurious interrupt during removal of trusted VF Przemyslaw Patynowski (1): ice: Fix memory corruption in VF driver drivers/net/ethernet/intel/ice/ice_base.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 28 ++++++++++ drivers/net/ethernet/intel/ice/ice_lib.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 52 ++++++++++++++----- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 17 ++++-- 6 files changed, 86 insertions(+), 18 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
by Zhang Yuwei 24 Nov '25

24 Nov '25

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.18-rc1 commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------- When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Message-ID: <20250902171826.27329-4-tiwai(a)suse.de> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index a8289f74463e..f5bcf68841c3 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) @@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); static void log_quirks(struct device *dev) { - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) + int map; + + map = BYT_RT5651_MAP(byt_rt5651_quirk); + switch (map) { + case BYT_RT5651_DMIC_MAP: dev_info(dev, "quirk DMIC_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) + break; + case BYT_RT5651_IN1_MAP: dev_info(dev, "quirk IN1_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) + break; + case BYT_RT5651_IN2_MAP: dev_info(dev, "quirk IN2_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) + break; + case BYT_RT5651_IN1_IN2_MAP: dev_info(dev, "quirk IN1_IN2_MAP enabled"); + break; + default: + dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; + byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; + break; + } + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { dev_info(dev, "quirk realtek,jack-detect-source %ld\n", BYT_RT5651_JDSRC(byt_rt5651_quirk)); -- 2.43.0

2 1

[PATCH OLK-6.6] uburma: add tp_type in urma ioctl operation.
by Bowen You 24 Nov '25

24 Nov '25

From: Yongqiang Guo <guoyongqiang12(a)huawei.com> urma inclusion category: feature bugzilla: https://gitee.com/openeuler/release-management/issues/ID3WJX ---------------------------------------------- This patch resolves the issue of the tp_type field being lost in ioctl call during the connection establishment between urma_import_jetty and urma_bind_jetty, which causes consistent RC connection establishment failures. Signed-off-by: Yongqiang Guo <guoyongqiang12(a)huawei.com> --- drivers/ub/urma/uburma/uburma_cmd.c | 4 ++++ drivers/ub/urma/uburma/uburma_cmd.h | 4 ++++ drivers/ub/urma/uburma/uburma_cmd_tlv.c | 4 ++++ drivers/ub/urma/uburma/uburma_cmd_tlv.h | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/drivers/ub/urma/uburma/uburma_cmd.c b/drivers/ub/urma/uburma/uburma_cmd.c index 2c32cf62bddc..79cbb7a999dd 100644 --- a/drivers/ub/urma/uburma/uburma_cmd.c +++ b/drivers/ub/urma/uburma/uburma_cmd.c @@ -1668,6 +1668,7 @@ static int uburma_cmd_import_jfr(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.token_value.token = arg.in.token; cfg.trans_mode = arg.in.trans_mode; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; fill_udata(&udata, file->ucontext, &arg.udata); @@ -1724,6 +1725,7 @@ static int uburma_cmd_import_jfr_ex(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.token_value.token = arg.in.token; cfg.trans_mode = arg.in.trans_mode; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; active_tp_cfg.tp_handle.value = arg.in.tp_handle; @@ -1812,6 +1814,7 @@ static int uburma_cmd_import_jetty(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.policy = (enum ubcore_jetty_grp_policy)arg.in.policy; cfg.type = (enum ubcore_target_type)arg.in.type; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; fill_udata(&udata, file->ucontext, &arg.udata); @@ -3045,6 +3048,7 @@ static int uburma_cmd_import_jetty_ex(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.policy = (enum ubcore_jetty_grp_policy)arg.in.policy; cfg.type = (enum ubcore_target_type)arg.in.type; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; active_tp_cfg.tp_handle.value = arg.in.tp_handle; diff --git a/drivers/ub/urma/uburma/uburma_cmd.h b/drivers/ub/urma/uburma/uburma_cmd.h index 547eb5a27266..ef5dc2db5e52 100644 --- a/drivers/ub/urma/uburma/uburma_cmd.h +++ b/drivers/ub/urma/uburma/uburma_cmd.h @@ -390,6 +390,7 @@ struct uburma_cmd_import_jfr { /* correspond to urma_token_t */ uint32_t token; uint32_t trans_mode; + uint32_t tp_type; } in; struct { uint32_t tpn; @@ -407,6 +408,7 @@ struct uburma_cmd_import_jfr_ex { /* correspond to ubcore_token */ uint32_t token; uint32_t trans_mode; + uint32_t tp_type; /* correspond to struct ubcore_active_tp_cfg */ uint64_t tp_handle; uint64_t peer_tp_handle; @@ -546,6 +548,7 @@ struct uburma_cmd_import_jetty { uint32_t trans_mode; uint32_t policy; uint32_t type; + uint32_t tp_type; } in; struct { uint32_t tpn; @@ -565,6 +568,7 @@ struct uburma_cmd_import_jetty_ex { uint32_t trans_mode; uint32_t policy; uint32_t type; + uint32_t tp_type; /* correspond to struct ubcore_active_tp_cfg */ uint64_t tp_handle; uint64_t peer_tp_handle; diff --git a/drivers/ub/urma/uburma/uburma_cmd_tlv.c b/drivers/ub/urma/uburma/uburma_cmd_tlv.c index 41df179f0654..028be3acc6a7 100644 --- a/drivers/ub/urma/uburma/uburma_cmd_tlv.c +++ b/drivers/ub/urma/uburma/uburma_cmd_tlv.c @@ -588,6 +588,7 @@ uburma_import_jfr_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JFR_IN_FLAG, arg->in.flag); SPEC(s++, IMPORT_JFR_IN_TOKEN, arg->in.token); SPEC(s++, IMPORT_JFR_IN_TRANS_MODE, arg->in.trans_mode); + SPEC(s++, IMPORT_JFR_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JFR_IN_UDATA, arg->udata); } @@ -805,6 +806,7 @@ uburma_import_jetty_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JETTY_IN_TRANS_MODE, arg->in.trans_mode); SPEC(s++, IMPORT_JETTY_IN_POLICY, arg->in.policy); SPEC(s++, IMPORT_JETTY_IN_TYPE, arg->in.type); + SPEC(s++, IMPORT_JETTY_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JETTY_IN_UDATA, arg->udata); } @@ -1287,6 +1289,7 @@ uburma_import_jetty_ex_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JETTY_EX_IN_TRANS_MODE, arg->in.trans_mode); SPEC(s++, IMPORT_JETTY_EX_IN_POLICY, arg->in.policy); SPEC(s++, IMPORT_JETTY_EX_IN_TYPE, arg->in.type); + SPEC(s++, IMPORT_JETTY_EX_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JETTY_EX_IN_TP_HANDLE, arg->in.tp_handle); SPEC(s++, IMPORT_JETTY_EX_IN_PEER_TP_HANDLE, arg->in.peer_tp_handle); @@ -1320,6 +1323,7 @@ uburma_import_jfr_ex_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JFR_EX_IN_FLAG, arg->in.flag); SPEC(s++, IMPORT_JFR_EX_IN_TOKEN, arg->in.token); SPEC(s++, IMPORT_JFR_EX_IN_TRANS_MODE, arg->in.trans_mode); + SPEC(s++, IMPORT_JFR_EX_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JFR_EX_IN_TP_HANDLE, arg->in.tp_handle); SPEC(s++, IMPORT_JFR_EX_IN_PEER_TP_HANDLE, arg->in.peer_tp_handle); diff --git a/drivers/ub/urma/uburma/uburma_cmd_tlv.h b/drivers/ub/urma/uburma/uburma_cmd_tlv.h index c79cfc489e85..7dc179c70ded 100644 --- a/drivers/ub/urma/uburma/uburma_cmd_tlv.h +++ b/drivers/ub/urma/uburma/uburma_cmd_tlv.h @@ -382,6 +382,7 @@ enum uburma_cmd_import_jfr_type { IMPORT_JFR_IN_FLAG, IMPORT_JFR_IN_TOKEN, IMPORT_JFR_IN_TRANS_MODE, + IMPORT_JFR_IN_TP_TYPE, IMPORT_JFR_IN_UDATA, /* Consider udata as an ordinary member of in specs */ IMPORT_JFR_IN_NUM, /* Only for calculating number of types */ /* Out type */ @@ -399,6 +400,7 @@ enum uburma_cmd_import_jfr_ex_type { IMPORT_JFR_EX_IN_FLAG, IMPORT_JFR_EX_IN_TOKEN, IMPORT_JFR_EX_IN_TRANS_MODE, + IMPORT_JFR_EX_IN_TP_TYPE, IMPORT_JFR_EX_IN_TP_HANDLE, IMPORT_JFR_EX_IN_PEER_TP_HANDLE, IMPORT_JFR_EX_IN_TAG, @@ -539,6 +541,7 @@ enum uburma_cmd_import_jetty_type { IMPORT_JETTY_IN_TRANS_MODE, IMPORT_JETTY_IN_POLICY, IMPORT_JETTY_IN_TYPE, + IMPORT_JETTY_IN_TP_TYPE, IMPORT_JETTY_IN_UDATA, /* Consider udata as an in/out attr */ IMPORT_JETTY_IN_NUM, /* Only for calculating number of types */ /* Out type */ @@ -558,6 +561,7 @@ enum uburma_cmd_import_jetty_ex_type { IMPORT_JETTY_EX_IN_TRANS_MODE, IMPORT_JETTY_EX_IN_POLICY, IMPORT_JETTY_EX_IN_TYPE, + IMPORT_JETTY_EX_IN_TP_TYPE, IMPORT_JETTY_EX_IN_TP_HANDLE, IMPORT_JETTY_EX_IN_PEER_TP_HANDLE, IMPORT_JETTY_EX_IN_TAG, -- 2.34.1

2 1

[PATCH OLK-6.6] iommu/vt-d: debugfs: Fix legacy mode page table dump logic
by Zhang Yuwei 24 Nov '25

24 Nov '25

From: "Vineeth Pillai (Google)" <vineeth(a)bitbyteword.org> mainline inclusion from mainline-v6.18-rc1 commit fbe6070c73badca726e4ff7877320e6c62339917 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B92 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") Signed-off-by: Vineeth Pillai (Google) <vineeth(a)bitbyteword.org> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> --- drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c index 86b506af7daa..7223adfabd7d 100644 --- a/drivers/iommu/intel/debugfs.c +++ b/drivers/iommu/intel/debugfs.c @@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, } pgd &= VTD_PAGE_MASK; } else { /* legacy mode */ - pgd = context->lo & VTD_PAGE_MASK; - agaw = context->hi & 7; + u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; + + /* + * According to Translation Type(TT), + * get the page table pointer(SSPTPTR). + */ + switch (tt) { + case CONTEXT_TT_MULTI_LEVEL: + case CONTEXT_TT_DEV_IOTLB: + pgd = context->lo & VTD_PAGE_MASK; + agaw = context->hi & 7; + break; + default: + goto iommu_unlock; + } } seq_printf(m, "Device %04x:%02x:%02x.%x ", -- 2.43.0

2 1

[PATCH OLK-6.6] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
by Zhang Yuwei 24 Nov '25

24 Nov '25

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.18-rc1 commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------- When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Message-ID: <20250902171826.27329-4-tiwai(a)suse.de> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index 805afaf47b29..2abe47303ecd 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) @@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); static void log_quirks(struct device *dev) { - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) + int map; + + map = BYT_RT5651_MAP(byt_rt5651_quirk); + switch (map) { + case BYT_RT5651_DMIC_MAP: dev_info(dev, "quirk DMIC_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) + break; + case BYT_RT5651_IN1_MAP: dev_info(dev, "quirk IN1_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) + break; + case BYT_RT5651_IN2_MAP: dev_info(dev, "quirk IN2_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) + break; + case BYT_RT5651_IN1_IN2_MAP: dev_info(dev, "quirk IN1_IN2_MAP enabled"); + break; + default: + dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; + byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; + break; + } + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { dev_info(dev, "quirk realtek,jack-detect-source %ld\n", BYT_RT5651_JDSRC(byt_rt5651_quirk)); -- 2.43.0

2 1

[PATCH OLK-6.6] crypto: af_alg - Set merge to zero early in af_alg_sendmsg
by Gu Bowen 24 Nov '25

24 Nov '25

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v6.6.108 commit 2374c11189ef704a3e4863646369f1b8e6a27d71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0U94 CVE: CVE-2025-39931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f ] If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into af_alg_sendmsg when it attempts to do a merge that can't be done. Fix this by setting ctx->merge to zero near the start of the loop. Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") Reported-by: Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> Reported-by: Bing-Jhong Billy Jheng <billy(a)starlabs.sg> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/af_alg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/crypto/af_alg.c b/crypto/af_alg.c index 68cc9290cabe..80e95d0d0c45 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -1018,6 +1018,8 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, continue; } + ctx->merge = 0; + if (!af_alg_writable(sk)) { err = af_alg_wait_for_wmem(sk, msg->msg_flags); if (err) @@ -1057,7 +1059,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, ctx->used += plen; copied += plen; size -= plen; - ctx->merge = 0; } else { do { struct page *pg; -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-40200
by Long Li 24 Nov '25

24 Nov '25

Fix CVE-2025-40200. Phillip Lougher (2): Squashfs: add additional inode sanity checking Squashfs: reject negative file sizes in squashfs_read_inode() fs/squashfs/inode.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 0/3] cve-2025-40300-r
by Bowen You 24 Nov '25

24 Nov '25

fix cve 2025 40300 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 8 ++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 86 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + include/linux/cpu.h | 1 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] Revert "ipmi: fix msg stack when IPMI is disconnected"
by Yi Yang 24 Nov '25

24 Nov '25

From: Corey Minyard <corey(a)minyard.net> stable inclusion from stable-v6.6.113 commit f4aab940ae9eb3ba32e5332b35703673f00d7f37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVU CVE: CVE-2025-40192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5d09ee1bec870263f4ace439402ea840503b503b upstream. This reverts commit c608966f3f9c2dca596967501d00753282b395fc. This patch has a subtle bug that can cause the IPMI driver to go into an infinite loop if the BMC misbehaves in a certain way. Apparently certain BMCs do misbehave this way because several reports have come in recently about this. Signed-off-by: Corey Minyard <corey(a)minyard.net> Tested-by: Eric Hagberg <ehagberg(a)janestreet.com> Cc: <stable(a)vger.kernel.org> # 6.2 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/ipmi/ipmi_kcs_sm.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/char/ipmi/ipmi_kcs_sm.c b/drivers/char/ipmi/ipmi_kcs_sm.c index ecfcb50302f6..efda90dcf5b3 100644 --- a/drivers/char/ipmi/ipmi_kcs_sm.c +++ b/drivers/char/ipmi/ipmi_kcs_sm.c @@ -122,10 +122,10 @@ struct si_sm_data { unsigned long error0_timeout; }; -static unsigned int init_kcs_data_with_state(struct si_sm_data *kcs, - struct si_sm_io *io, enum kcs_states state) +static unsigned int init_kcs_data(struct si_sm_data *kcs, + struct si_sm_io *io) { - kcs->state = state; + kcs->state = KCS_IDLE; kcs->io = io; kcs->write_pos = 0; kcs->write_count = 0; @@ -140,12 +140,6 @@ static unsigned int init_kcs_data_with_state(struct si_sm_data *kcs, return 2; } -static unsigned int init_kcs_data(struct si_sm_data *kcs, - struct si_sm_io *io) -{ - return init_kcs_data_with_state(kcs, io, KCS_IDLE); -} - static inline unsigned char read_status(struct si_sm_data *kcs) { return kcs->io->inputb(kcs->io, 1); @@ -276,7 +270,7 @@ static int start_kcs_transaction(struct si_sm_data *kcs, unsigned char *data, if (size > MAX_KCS_WRITE_SIZE) return IPMI_REQ_LEN_EXCEEDED_ERR; - if (kcs->state != KCS_IDLE) { + if ((kcs->state != KCS_IDLE) && (kcs->state != KCS_HOSED)) { dev_warn(kcs->io->dev, "KCS in invalid state %d\n", kcs->state); return IPMI_NOT_IN_MY_STATE_ERR; } @@ -501,7 +495,7 @@ static enum si_sm_result kcs_event(struct si_sm_data *kcs, long time) } if (kcs->state == KCS_HOSED) { - init_kcs_data_with_state(kcs, kcs->io, KCS_ERROR0); + init_kcs_data(kcs, kcs->io); return SI_SM_HOSED; } -- 2.25.1

2 1

[PATCH OLK-6.6] KVM: arm64: ipiv: change declaration argument
by Jinqian Yang 24 Nov '25

24 Nov '25

virt inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID7MBH ------------------------------------------------------------------------ Add the missed changes. When CONFIG_KVM_HISI_VIRT is not set, a compilation error will occur. Fixes: cbd165f529bd ("KVM: arm64: ipiv: Change parameter from vcpu to kvm") Signed-off-by: Jinqian Yang <yangjinqian1(a)huawei.com> Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202511221815.EIAnEfb9-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511221643.H3LgffBo-lkp@intel.com/ --- arch/arm64/kvm/hisilicon/hisi_virt.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/hisilicon/hisi_virt.h b/arch/arm64/kvm/hisilicon/hisi_virt.h index fcf65cec942e..180618e42cbc 100644 --- a/arch/arm64/kvm/hisilicon/hisi_virt.h +++ b/arch/arm64/kvm/hisilicon/hisi_virt.h @@ -124,11 +124,11 @@ static inline bool hisi_ipiv_supported(void) { return false; } -static inline bool hisi_ipiv_supported_per_vm(struct kvm_vcpu *vcpu) +static inline bool hisi_ipiv_supported_per_vm(struct kvm *kvm) { return false; } -static inline void hisi_ipiv_enable_per_vm(struct kvm_vcpu *vcpu) {} +static inline void hisi_ipiv_enable_per_vm(struct kvm *kvm) {} static inline void ipiv_gicd_init(void) {} #endif /* CONFIG_ARM64_HISI_IPIV */ static inline void kvm_get_pg_cfg(void) {} -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
by z00845436 24 Nov '25

24 Nov '25

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.18-rc1 commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------- When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Message-ID: <20250902171826.27329-4-tiwai(a)suse.de> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index c6c8d20be1d2..c6e1bf32f600 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -68,7 +68,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) @@ -101,14 +102,29 @@ static unsigned long byt_rt5651_quirk = BYT_RT5651_DEFAULT_QUIRKS | static void log_quirks(struct device *dev) { - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) + int map; + + map = BYT_RT5651_MAP(byt_rt5651_quirk); + switch (map) { + case BYT_RT5651_DMIC_MAP: dev_info(dev, "quirk DMIC_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) + break; + case BYT_RT5651_IN1_MAP: dev_info(dev, "quirk IN1_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) + break; + case BYT_RT5651_IN2_MAP: dev_info(dev, "quirk IN2_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) + break; + case BYT_RT5651_IN1_IN2_MAP: dev_info(dev, "quirk IN1_IN2_MAP enabled"); + break; + default: + dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; + byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; + break; + } + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { dev_info(dev, "quirk realtek,jack-detect-source %ld\n", BYT_RT5651_JDSRC(byt_rt5651_quirk)); -- 2.43.0

2 1

[PATCH OLK-5.10] Squashfs: fix uninit-value in squashfs_get_parent
by Long Li 24 Nov '25

24 Nov '25

From: Phillip Lougher <phillip(a)squashfs.org.uk> mainline inclusion from mainline-v6.17-rc4 commit 74058c0a9fc8b2b4d5f4a0ef7ee2cfa66a9e49cf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WGW CVE: CVE-2025-40049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle containing an invalid parent inode number. In particular the inode number is that of a symbolic link, rather than a directory. Squashfs_get_parent() gets called with that symbolic link inode, and accesses the parent member field. unsigned int parent_ino = squashfs_i(inode)->parent; Because non-directory inodes in Squashfs do not have a parent value, this is uninitialised, and this causes an uninitialised value access. The fix is to initialise parent with the invalid inode 0, which will cause an EINVAL error to be returned. Regular inodes used to share the parent field with the block_list_start field. This is removed in this commit to enable the parent field to contain the invalid inode number 0. Link: https://lkml.kernel.org/r/20250918233308.293861-1-phillip@squashfs.org.uk Fixes: 122601408d20 ("Squashfs: export operations") Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Reported-by: syzbot+157bdef5cf596ad0da2c(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68cc2431.050a0220.139b6.0001.GAE@google.com/ Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/squashfs/inode.c | 7 +++++++ fs/squashfs/squashfs_fs_i.h | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c index 95a9ff9e2399..c381d08c30c2 100644 --- a/fs/squashfs/inode.c +++ b/fs/squashfs/inode.c @@ -165,6 +165,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) squashfs_i(inode)->start = le32_to_cpu(sqsh_ino->start_block); squashfs_i(inode)->block_list_start = block; squashfs_i(inode)->offset = offset; + squashfs_i(inode)->parent = 0; inode->i_data.a_ops = &squashfs_aops; TRACE("File inode %x:%x, start_block %llx, block_list_start " @@ -212,6 +213,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) squashfs_i(inode)->start = le64_to_cpu(sqsh_ino->start_block); squashfs_i(inode)->block_list_start = block; squashfs_i(inode)->offset = offset; + squashfs_i(inode)->parent = 0; inode->i_data.a_ops = &squashfs_aops; TRACE("File inode %x:%x, start_block %llx, block_list_start " @@ -292,6 +294,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) inode->i_mode |= S_IFLNK; squashfs_i(inode)->start = block; squashfs_i(inode)->offset = offset; + squashfs_i(inode)->parent = 0; if (type == SQUASHFS_LSYMLINK_TYPE) { __le32 xattr; @@ -329,6 +332,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); rdev = le32_to_cpu(sqsh_ino->rdev); init_special_inode(inode, inode->i_mode, new_decode_dev(rdev)); + squashfs_i(inode)->parent = 0; TRACE("Device inode %x:%x, rdev %x\n", SQUASHFS_INODE_BLK(ino), offset, rdev); @@ -353,6 +357,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); rdev = le32_to_cpu(sqsh_ino->rdev); init_special_inode(inode, inode->i_mode, new_decode_dev(rdev)); + squashfs_i(inode)->parent = 0; TRACE("Device inode %x:%x, rdev %x\n", SQUASHFS_INODE_BLK(ino), offset, rdev); @@ -373,6 +378,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) inode->i_mode |= S_IFSOCK; set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); init_special_inode(inode, inode->i_mode, 0); + squashfs_i(inode)->parent = 0; break; } case SQUASHFS_LFIFO_TYPE: @@ -392,6 +398,7 @@ int squashfs_read_inode(struct inode *inode, long long ino) inode->i_op = &squashfs_inode_ops; set_nlink(inode, le32_to_cpu(sqsh_ino->nlink)); init_special_inode(inode, inode->i_mode, 0); + squashfs_i(inode)->parent = 0; break; } default: diff --git a/fs/squashfs/squashfs_fs_i.h b/fs/squashfs/squashfs_fs_i.h index 2c82d6f2a456..8e497ac07b9a 100644 --- a/fs/squashfs/squashfs_fs_i.h +++ b/fs/squashfs/squashfs_fs_i.h @@ -16,6 +16,7 @@ struct squashfs_inode_info { u64 xattr; unsigned int xattr_size; int xattr_count; + int parent; union { struct { u64 fragment_block; @@ -27,7 +28,6 @@ struct squashfs_inode_info { u64 dir_idx_start; int dir_idx_offset; int dir_idx_cnt; - int parent; }; }; struct inode vfs_inode; -- 2.39.2

2 3