- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3493/3493] mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static?
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0189df7df2ef7f7dbbabf7ff8398e45adf306e24 commit: cf98ffbc116bc49dc4506c68e20b02e26519ad35 [3493/3493] mm/dynamic_pool: fill dpool with pagelist config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091544.YzqAeHFm-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091544.YzqAeHFm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091544.YzqAeHFm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/dynamic_pool.c:999:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_pool.c:999:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_pool.c:999:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * >> mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static? vim +/pagelist_dpool_ops +1577 mm/dynamic_pool.c 1576 > 1577 struct dynamic_pool_ops pagelist_dpool_ops = { 1578 .fill_pool = dpool_fill_from_pagelist, 1579 .drain_pool = dpool_drain_to_pagelist, 1580 .restore_pool = dpool_migrate_used_pages, 1581 }; 1582 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net/oenetcls: Prioritize oenetcls hooks over rps
by Yue Haibing 09 Dec '25

09 Dec '25

hulk inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/ICBFCS -------------------------------- Prioritize oenetcls hooks over rps, clean up unnecessary oecls_rps goto statements. Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/core/dev.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index df6c0ac02a5e..372bab73b8bf 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5890,11 +5890,15 @@ static int netif_receive_skb_internal(struct sk_buff *skb) return NET_RX_SUCCESS; rcu_read_lock(); -#ifdef CONFIG_RPS #if IS_ENABLED(CONFIG_OENETCLS) - if (static_branch_unlikely(&oecls_rps_needed)) - goto oecls_rps; + if (static_branch_unlikely(&oecls_rps_needed)) { + if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { + rcu_read_unlock(); + return ret; + } + } #endif +#ifdef CONFIG_RPS if (static_branch_unlikely(&rps_needed)) { struct rps_dev_flow voidflow, *rflow = &voidflow; int cpu = get_rps_cpu(skb->dev, skb, &rflow); @@ -5906,15 +5910,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb) } } #endif - -#if IS_ENABLED(CONFIG_OENETCLS) -oecls_rps: - if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { - rcu_read_unlock(); - return ret; - } -#endif - ret = __netif_receive_skb(skb); rcu_read_unlock(); return ret; @@ -5935,11 +5930,11 @@ static void netif_receive_skb_list_internal(struct list_head *head) list_splice_init(&sublist, head); rcu_read_lock(); -#ifdef CONFIG_RPS #if IS_ENABLED(CONFIG_OENETCLS) if (static_branch_unlikely(&oecls_rps_needed)) - goto oecls_rps_list; + oenetcls_skblist_set_cpu(head, enqueue_to_backlog); #endif +#ifdef CONFIG_RPS if (static_branch_unlikely(&rps_needed)) { list_for_each_entry_safe(skb, next, head, list) { struct rps_dev_flow voidflow, *rflow = &voidflow; @@ -5953,12 +5948,6 @@ static void netif_receive_skb_list_internal(struct list_head *head) } } #endif - -#if IS_ENABLED(CONFIG_OENETCLS) -oecls_rps_list: - oenetcls_skblist_set_cpu(head, enqueue_to_backlog); -#endif - __netif_receive_skb_list(head); rcu_read_unlock(); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-53491
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Bugfix for two issues
by Liu Mingrui 09 Dec '25

09 Dec '25

Bugfix for the following two issues Liu Mingrui (2): zcopy: Fix NULL pointer dereference while attach conflict with free zcopy: Fix softlockup while attach PUD-SIZE page drivers/misc/zcopy/zcopy.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10 0/3] Bugfix for three issues
by Liu Mingrui 09 Dec '25

09 Dec '25

Bugfix for the following issues: Liu Mingrui (3): zcopy: Fix invalid paging request while attach transhugepage to same addr zcopy: Fix softlockup while attach PUD-SIZE page zcopy: Fix NULL pointer dereference while attach conflict with free drivers/misc/zcopy/zcopy.c | 104 +++++++++++++++---------------------- 1 file changed, 42 insertions(+), 62 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] Bluetooth: hci_event: call disconnect callback before deleting conn
by Wang Liang 09 Dec '25

09 Dec '25

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v6.5-rc3 commit 7f7cfcb6f0825652973b780f248603e23f16ee90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIH CVE: CVE-2023-53673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn without hci_conn_get, so disconn_cfm must be called so they can clean up their conn, otherwise use-after-free occurs. ISO: ========================================================== iso_sock_connect:880: sk 00000000eabd6557 iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073 hci_dev_put:1487: hci0 orig refcnt 17 __iso_chan_add:214: conn 00000000b6251073 iso_sock_clear_timer:117: sock 00000000eabd6557 state 3 ... hci_rx_work:4085: hci0 Event packet hci_event_packet:7601: hci0: event 0x0f hci_cmd_status_evt:4346: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3107: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon 000000001696f1fd handle 2560 hci_conn_unlink:1102: hci0: hcon 000000001696f1fd hci_conn_drop:1451: hcon 00000000d8521aaf orig refcnt 2 hci_chan_list_flush:2780: hcon 000000001696f1fd hci_dev_put:1487: hci0 orig refcnt 21 hci_dev_put:1487: hci0 orig refcnt 20 hci_req_cmd_complete:3978: opcode 0x0406 status 0x0c ... <no iso_* activity on sk/conn> ... iso_sock_sendmsg:1098: sock 00000000dea5e2e0, sk 00000000eabd6557 BUG: kernel NULL pointer dereference, address: 0000000000000668 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg (net/bluetooth/iso.c:1112) bluetooth ========================================================== L2CAP: ================================================================== hci_cmd_status_evt:4359: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3085: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon ffff88800c999000 handle 3585 hci_conn_unlink:1102: hci0: hcon ffff88800c999000 hci_chan_list_flush:2780: hcon ffff88800c999000 hci_chan_del:2761: hci0 hcon ffff88800c999000 chan ffff888018ddd280 ... BUG: KASAN: slab-use-after-free in hci_send_acl+0x2d/0x540 [bluetooth] Read of size 8 at addr ffff888018ddd298 by task bluetoothd/1175 CPU: 0 PID: 1175 Comm: bluetoothd Tainted: G E 6.4.0-rc4+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xf8/0x180 ? hci_send_acl+0x2d/0x540 [bluetooth] kasan_report+0xa8/0xe0 ? hci_send_acl+0x2d/0x540 [bluetooth] hci_send_acl+0x2d/0x540 [bluetooth] ? __pfx___lock_acquire+0x10/0x10 l2cap_chan_send+0x1fd/0x1300 [bluetooth] ? l2cap_sock_sendmsg+0xf2/0x170 [bluetooth] ? __pfx_l2cap_chan_send+0x10/0x10 [bluetooth] ? lock_release+0x1d5/0x3c0 ? mark_held_locks+0x1a/0x90 l2cap_sock_sendmsg+0x100/0x170 [bluetooth] sock_write_iter+0x275/0x280 ? __pfx_sock_write_iter+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 do_iter_readv_writev+0x176/0x220 ? __pfx_do_iter_readv_writev+0x10/0x10 ? find_held_lock+0x83/0xa0 ? selinux_file_permission+0x13e/0x210 do_iter_write+0xda/0x340 vfs_writev+0x1b4/0x400 ? __pfx_vfs_writev+0x10/0x10 ? __seccomp_filter+0x112/0x750 ? populate_seccomp_data+0x182/0x220 ? __fget_light+0xdf/0x100 ? do_writev+0x19d/0x210 do_writev+0x19d/0x210 ? __pfx_do_writev+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0x60/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 ? do_syscall_64+0x6c/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7ff45cb23e64 Code: 15 d1 1f 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d 9d a7 0d 00 00 74 13 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff21ae09b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ff45cb23e64 RDX: 0000000000000001 RSI: 00007fff21ae0aa0 RDI: 0000000000000017 RBP: 00007fff21ae0aa0 R08: 000000000095a8a0 R09: 0000607000053f40 R10: 0000000000000001 R11: 0000000000000202 R12: 00007fff21ae0ac0 R13: 00000fffe435c150 R14: 00007fff21ae0a80 R15: 000060f000000040 </TASK> Allocated by task 771: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0xaa/0xb0 hci_chan_create+0x67/0x1b0 [bluetooth] l2cap_conn_add.part.0+0x17/0x590 [bluetooth] l2cap_connect_cfm+0x266/0x6b0 [bluetooth] hci_le_remote_feat_complete_evt+0x167/0x310 [bluetooth] hci_event_packet+0x38d/0x800 [bluetooth] hci_rx_work+0x287/0xb20 [bluetooth] process_one_work+0x4f7/0x970 worker_thread+0x8f/0x620 kthread+0x17f/0x1c0 ret_from_fork+0x2c/0x50 Freed by task 771: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 ____kasan_slab_free+0x169/0x1c0 slab_free_freelist_hook+0x9e/0x1c0 __kmem_cache_free+0xc0/0x310 hci_chan_list_flush+0x46/0x90 [bluetooth] hci_conn_cleanup+0x7d/0x330 [bluetooth] hci_cs_disconnect+0x35d/0x530 [bluetooth] hci_cmd_status_evt+0xef/0x2b0 [bluetooth] hci_event_packet+0x38d/0x800 [bluetooth] hci_rx_work+0x287/0xb20 [bluetooth] process_one_work+0x4f7/0x970 worker_thread+0x8f/0x620 kthread+0x17f/0x1c0 ret_from_fork+0x2c/0x50 ================================================================== Fixes: b8d290525e39 ("Bluetooth: clean up connection in hci_cs_disconnect") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_event.c [conflicts due to not merge 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/hci_event.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 037f923b433b..509ec9fd4865 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2286,6 +2286,9 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) mgmt_disconnect_failed(hdev, &conn->dst, conn->type, conn->dst_type, status); + /* Inform sockets conn is gone before we delete it */ + hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED); + /* If the disconnection failed for any reason, the upper layer * does not retry to disconnect in current implementation. * Hence, we need to do some basic cleanup here and re-enable -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: Fix hci_suspend_sync crash
by Wang Liang 09 Dec '25

09 Dec '25

From: Ying Hsu <yinghsu(a)chromium.org> mainline inclusion from mainline-v6.6-rc1 commit 573ebae162111063eedc6c838a659ba628f66a0f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RG9 CVE: CVE-2023-53520 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier may still be accessing it, it can cause the program to crash. Here's the call trace: <4>[102152.653246] Call Trace: <4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth] <4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth] <4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth] <4>[102152.653268] notifier_call_chain+0x43/0x6b <4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69 <4>[102152.653273] __pm_notifier_call_chain+0x22/0x39 <4>[102152.653276] pm_suspend+0x287/0x57c <4>[102152.653278] state_store+0xae/0xe5 <4>[102152.653281] kernfs_fop_write+0x109/0x173 <4>[102152.653284] __vfs_write+0x16f/0x1a2 <4>[102152.653287] ? selinux_file_permission+0xca/0x16f <4>[102152.653289] ? security_file_permission+0x36/0x109 <4>[102152.653291] vfs_write+0x114/0x21d <4>[102152.653293] __x64_sys_write+0x7b/0xdb <4>[102152.653296] do_syscall_64+0x59/0x194 <4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 This patch holds the reference count of the hci_dev object while processing it in hci_suspend_notifier to avoid potential crash caused by the race condition. Signed-off-by: Ying Hsu <yinghsu(a)chromium.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_core.c [conflicts due to not merge e1b77d68feea ("Bluetooth: Make use of hci_{suspend,resume}_dev on suspend notifier")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/hci_core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 0a517bdf2de6..e3b98fd6e1f3 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3559,6 +3559,9 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, goto done; } + /* To avoid a potential race with hci_unregister_dev. */ + hci_dev_hold(hdev); + /* Suspend notifier should only act on events when powered. */ if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_UNREGISTER)) @@ -3602,6 +3605,7 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d", action, ret); + hci_dev_put(hdev); return NOTIFY_DONE; } -- 2.34.1

2 1

[PATCH OLK-5.10] net/smc: fix UAF on smcsk after smc_listen_out()
by Wang Liang 09 Dec '25

09 Dec '25

From: "D. Wythe" <alibuda(a)linux.alibaba.com> mainline inclusion from mainline-v6.17-rc3 commit d9cef55ed49117bd63695446fb84b4b91815c0b4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWO2I CVE: CVE-2025-38734 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] <TASK > [ 16.456989] ? __die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ? exc_page_fault+0x68/0x20 0 [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0 [ 16.458389] ? smc_listen_work+0xc02/0x159 0 [ 16.458689] ? smc_listen_work+0xc02/0x159 0 [ 16.458987] ? lock_is_held_type+0x8f/0x10 0 [ 16.459284] process_one_work+0x1ea/0x6d 0 [ 16.459570] worker_thread+0x1c3/0x38 0 [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? __pfx_kthread+0x10/0x1 0 [ 16.460640] ret_from_fork+0x31/0x5 0 [ 16.460896] ? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590 The direct cause of this issue is that after smc_listen_out_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows: smc_listen_work | userspace ----------------------------------------------------------------- lock_sock(sk) | smc_listen_out_connected() | | \- smc_listen_out | | | \- release_sock | | |- sk->sk_data_ready() | | fd = accept(); | close(fd); | \- socket->sk = NULL; /* newclcsock->sk is NULL now */ SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk)) Since smc_listen_out_connected() will not fail, simply swapping the order of the code can easily fix this issue. Fixes: 3b2dec2603d5 ("net/smc: restructure client and server code in af_smc") Signed-off-by: D. Wythe <alibuda(a)linux.alibaba.com> Reviewed-by: Guangguan Wang <guangguan.wang(a)linux.alibaba.com> Reviewed-by: Alexandra Winter <wintera(a)linux.ibm.com> Reviewed-by: Dust Li <dust.li(a)linux.alibaba.com> Link: https://patch.msgid.link/20250818054618.41615-1-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/smc/af_smc.c [conflicts due to not merge 194730a9beb5 ("net/smc: Make SMC statistics network namespace aware")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/af_smc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 9cd508208a0d..9d4c58b09505 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -2492,8 +2492,9 @@ static void smc_listen_work(struct work_struct *work) goto out_decl; } - smc_listen_out_connected(new_smc); SMC_STAT_SERV_SUCC_INC(ini); + /* smc_listen_out() will release smcsk */ + smc_listen_out_connected(new_smc); goto out_free; out_unlock: -- 2.34.1

2 1

[PATCH OLK-5.10] i40e: remove read access to debugfs files
by Wang Liang 09 Dec '25

09 Dec '25

From: Jacob Keller <jacob.e.keller(a)intel.com> mainline inclusion from mainline-v6.17-rc5 commit 9fcdb1c3c4ba134434694c001dbff343f1ffa319 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0R34 CVE: CVE-2025-39901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The 'command' and 'netdev_ops' debugfs files are a legacy debugging interface supported by the i40e driver since its early days by commit 02e9c290814c ("i40e: debugfs interface"). Both of these debugfs files provide a read handler which is mostly useless, and which is implemented with questionable logic. They both use a static 256 byte buffer which is initialized to the empty string. In the case of the 'command' file this buffer is literally never used and simply wastes space. In the case of the 'netdev_ops' file, the last command written is saved here. On read, the files contents are presented as the name of the device followed by a colon and then the contents of their respective static buffer. For 'command' this will always be "<device>: ". For 'netdev_ops', this will be "<device>: <last command written>". But note the buffer is shared between all devices operated by this module. At best, it is mostly meaningless information, and at worse it could be accessed simultaneously as there doesn't appear to be any locking mechanism. We have also recently received multiple reports for both read functions about their use of snprintf and potential overflow that could result in reading arbitrary kernel memory. For the 'command' file, this is definitely impossible, since the static buffer is always zero and never written to. For the 'netdev_ops' file, it does appear to be possible, if the user carefully crafts the command input, it will be copied into the buffer, which could be large enough to cause snprintf to truncate, which then causes the copy_to_user to read beyond the length of the buffer allocated by kzalloc. A minimal fix would be to replace snprintf() with scnprintf() which would cap the return to the number of bytes written, preventing an overflow. A more involved fix would be to drop the mostly useless static buffers, saving 512 bytes and modifying the read functions to stop needing those as input. Instead, lets just completely drop the read access to these files. These are debug interfaces exposed as part of debugfs, and I don't believe that dropping read access will break any script, as the provided output is pretty useless. You can find the netdev name through other more standard interfaces, and the 'netdev_ops' interface can easily result in garbage if you issue simultaneous writes to multiple devices at once. In order to properly remove the i40e_dbg_netdev_ops_buf, we need to refactor its write function to avoid using the static buffer. Instead, use the same logic as the i40e_dbg_command_write, with an allocated buffer. Update the code to use this instead of the static buffer, and ensure we free the buffer on exit. This fixes simultaneous writes to 'netdev_ops' on multiple devices, and allows us to remove the now unused static buffer along with removing the read access. Fixes: 02e9c290814c ("i40e: debugfs interface") Reported-by: Kunwu Chan <chentao(a)kylinos.cn> Closes: https://lore.kernel.org/intel-wired-lan/20231208031950.47410-1-chentao@kyli… Reported-by: Wang Haoran <haoranwangsec(a)gmail.com> Closes: https://lore.kernel.org/all/CANZ3JQRRiOdtfQJoP9QM=6LS1Jto8PGBGw6y7-TL=BcnzH… Reported-by: Amir Mohammad Jahangirzad <a.jahangirzad(a)gmail.com> Closes: https://lore.kernel.org/all/20250722115017.206969-1-a.jahangirzad@gmail.com/ Signed-off-by: Jacob Keller <jacob.e.keller(a)intel.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Kunwu Chan <kunwu.chan(a)linux.dev> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/i40e/i40e_debugfs.c [conflicts due to not merge 43f4466ca91d ("i40e: Add helper to access main VSI")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- .../net/ethernet/intel/i40e/i40e_debugfs.c | 121 +++--------------- 1 file changed, 19 insertions(+), 102 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c index 8bcf5902babf..d5c7f07db071 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c @@ -57,47 +57,6 @@ static struct i40e_veb *i40e_dbg_find_veb(struct i40e_pf *pf, int seid) * setup, adding or removing filters, or other things. Many of * these will be useful for some forms of unit testing. **************************************************************/ -static char i40e_dbg_command_buf[256] = ""; - -/** - * i40e_dbg_command_read - read for command datum - * @filp: the opened file - * @buffer: where to write the data for the user to read - * @count: the size of the user's buffer - * @ppos: file position offset - **/ -static ssize_t i40e_dbg_command_read(struct file *filp, char __user *buffer, - size_t count, loff_t *ppos) -{ - struct i40e_pf *pf = filp->private_data; - int bytes_not_copied; - int buf_size = 256; - char *buf; - int len; - - /* don't allow partial reads */ - if (*ppos != 0) - return 0; - if (count < buf_size) - return -ENOSPC; - - buf = kzalloc(buf_size, GFP_KERNEL); - if (!buf) - return -ENOSPC; - - len = snprintf(buf, buf_size, "%s: %s\n", - pf->vsi[pf->lan_vsi]->netdev->name, - i40e_dbg_command_buf); - - bytes_not_copied = copy_to_user(buffer, buf, len); - kfree(buf); - - if (bytes_not_copied) - return -EFAULT; - - *ppos = len; - return len; -} static char *i40e_filter_state_string[] = { "INVALID", @@ -1635,7 +1594,6 @@ static ssize_t i40e_dbg_command_write(struct file *filp, static const struct file_operations i40e_dbg_command_fops = { .owner = THIS_MODULE, .open = simple_open, - .read = i40e_dbg_command_read, .write = i40e_dbg_command_write, }; @@ -1644,47 +1602,6 @@ static const struct file_operations i40e_dbg_command_fops = { * The netdev_ops entry in debugfs is for giving the driver commands * to be executed from the netdev operations. **************************************************************/ -static char i40e_dbg_netdev_ops_buf[256] = ""; - -/** - * i40e_dbg_netdev_ops - read for netdev_ops datum - * @filp: the opened file - * @buffer: where to write the data for the user to read - * @count: the size of the user's buffer - * @ppos: file position offset - **/ -static ssize_t i40e_dbg_netdev_ops_read(struct file *filp, char __user *buffer, - size_t count, loff_t *ppos) -{ - struct i40e_pf *pf = filp->private_data; - int bytes_not_copied; - int buf_size = 256; - char *buf; - int len; - - /* don't allow partal reads */ - if (*ppos != 0) - return 0; - if (count < buf_size) - return -ENOSPC; - - buf = kzalloc(buf_size, GFP_KERNEL); - if (!buf) - return -ENOSPC; - - len = snprintf(buf, buf_size, "%s: %s\n", - pf->vsi[pf->lan_vsi]->netdev->name, - i40e_dbg_netdev_ops_buf); - - bytes_not_copied = copy_to_user(buffer, buf, len); - kfree(buf); - - if (bytes_not_copied) - return -EFAULT; - - *ppos = len; - return len; -} /** * i40e_dbg_netdev_ops_write - write into netdev_ops datum @@ -1698,35 +1615,36 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, size_t count, loff_t *ppos) { struct i40e_pf *pf = filp->private_data; + char *cmd_buf, *buf_tmp; int bytes_not_copied; struct i40e_vsi *vsi; - char *buf_tmp; int vsi_seid; int i, cnt; /* don't allow partial writes */ if (*ppos != 0) return 0; - if (count >= sizeof(i40e_dbg_netdev_ops_buf)) - return -ENOSPC; - memset(i40e_dbg_netdev_ops_buf, 0, sizeof(i40e_dbg_netdev_ops_buf)); - bytes_not_copied = copy_from_user(i40e_dbg_netdev_ops_buf, - buffer, count); - if (bytes_not_copied) + cmd_buf = kzalloc(count + 1, GFP_KERNEL); + if (!cmd_buf) + return count; + bytes_not_copied = copy_from_user(cmd_buf, buffer, count); + if (bytes_not_copied) { + kfree(cmd_buf); return -EFAULT; - i40e_dbg_netdev_ops_buf[count] = '\0'; + } + cmd_buf[count] = '\0'; - buf_tmp = strchr(i40e_dbg_netdev_ops_buf, '\n'); + buf_tmp = strchr(cmd_buf, '\n'); if (buf_tmp) { *buf_tmp = '\0'; - count = buf_tmp - i40e_dbg_netdev_ops_buf + 1; + count = buf_tmp - cmd_buf + 1; } - if (strncmp(i40e_dbg_netdev_ops_buf, "change_mtu", 10) == 0) { + if (strncmp(cmd_buf, "change_mtu", 10) == 0) { int mtu; - cnt = sscanf(&i40e_dbg_netdev_ops_buf[11], "%i %i", + cnt = sscanf(&cmd_buf[11], "%i %i", &vsi_seid, &mtu); if (cnt != 2) { dev_info(&pf->pdev->dev, "change_mtu <vsi_seid> <mtu>\n"); @@ -1748,8 +1666,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, dev_info(&pf->pdev->dev, "Could not acquire RTNL - please try again\n"); } - } else if (strncmp(i40e_dbg_netdev_ops_buf, "set_rx_mode", 11) == 0) { - cnt = sscanf(&i40e_dbg_netdev_ops_buf[11], "%i", &vsi_seid); + } else if (strncmp(cmd_buf, "set_rx_mode", 11) == 0) { + cnt = sscanf(&cmd_buf[11], "%i", &vsi_seid); if (cnt != 1) { dev_info(&pf->pdev->dev, "set_rx_mode <vsi_seid>\n"); goto netdev_ops_write_done; @@ -1769,8 +1687,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, dev_info(&pf->pdev->dev, "Could not acquire RTNL - please try again\n"); } - } else if (strncmp(i40e_dbg_netdev_ops_buf, "napi", 4) == 0) { - cnt = sscanf(&i40e_dbg_netdev_ops_buf[4], "%i", &vsi_seid); + } else if (strncmp(cmd_buf, "napi", 4) == 0) { + cnt = sscanf(&cmd_buf[4], "%i", &vsi_seid); if (cnt != 1) { dev_info(&pf->pdev->dev, "napi <vsi_seid>\n"); goto netdev_ops_write_done; @@ -1788,21 +1706,20 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, dev_info(&pf->pdev->dev, "napi called\n"); } } else { - dev_info(&pf->pdev->dev, "unknown command '%s'\n", - i40e_dbg_netdev_ops_buf); + dev_info(&pf->pdev->dev, "unknown command '%s'\n", cmd_buf); dev_info(&pf->pdev->dev, "available commands\n"); dev_info(&pf->pdev->dev, " change_mtu <vsi_seid> <mtu>\n"); dev_info(&pf->pdev->dev, " set_rx_mode <vsi_seid>\n"); dev_info(&pf->pdev->dev, " napi <vsi_seid>\n"); } netdev_ops_write_done: + kfree(cmd_buf); return count; } static const struct file_operations i40e_dbg_netdev_ops_fops = { .owner = THIS_MODULE, .open = simple_open, - .read = i40e_dbg_netdev_ops_read, .write = i40e_dbg_netdev_ops_write, }; -- 2.34.1

2 1

[PATCH OLK-5.10] ipvs: Defer ip_vs_ftp unregister during netns cleanup
by Wang Liang 09 Dec '25

09 Dec '25

From: Slavin Liu <slavin452(a)gmail.com> stable inclusion from stable-v5.10.246 commit 421b1ae1574dfdda68b835c15ac4921ec0030182 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3FOO CVE: CVE-2025-40018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 134121bfd99a06d44ef5ba15a9beb075297c0821 ] On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately. Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") Suggested-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Slavin Liu <slavin452(a)gmail.com> Signed-off-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c index cf925906f59b..67d0d4f1f0db 100644 --- a/net/netfilter/ipvs/ip_vs_ftp.c +++ b/net/netfilter/ipvs/ip_vs_ftp.c @@ -53,6 +53,7 @@ enum { IP_VS_FTP_EPSV, }; +static bool exiting_module; /* * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper * First port is set to the default port. @@ -607,7 +608,7 @@ static void __ip_vs_ftp_exit(struct net *net) { struct netns_ipvs *ipvs = net_ipvs(net); - if (!ipvs) + if (!ipvs || !exiting_module) return; unregister_ip_vs_app(ipvs, &ip_vs_ftp); @@ -629,6 +630,7 @@ static int __init ip_vs_ftp_init(void) */ static void __exit ip_vs_ftp_exit(void) { + exiting_module = true; unregister_pernet_subsys(&ip_vs_ftp_ops); /* rcu_barrier() is called by netns */ } -- 2.34.1

2 1

[PATCH OLK-5.10] net/packet: fix a race in packet_set_ring() and packet_notifier()
by Wang Liang 09 Dec '25

09 Dec '25

From: Quang Le <quanglex97(a)gmail.com> stable inclusion from stable-v5.10.241 commit 7da733f117533e9b2ebbd530a22ae4028713955c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4S CVE: CVE-2025-38617 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01d3c8417b9c1b884a8a981a3b886da556512f36 upstream. When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Quang Le <quanglex97(a)gmail.com> Signed-off-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250801175423.2970334-1-willemdebruijn.kernel@gma… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index ae57d3e5df32..ba7c192342d9 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4446,10 +4446,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, spin_lock(&po->bind_lock); was_running = po->running; num = po->num; - if (was_running) { - WRITE_ONCE(po->num, 0); + WRITE_ONCE(po->num, 0); + if (was_running) __unregister_prot_hook(sk, false); - } + spin_unlock(&po->bind_lock); synchronize_net(); @@ -4481,10 +4481,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, mutex_unlock(&po->pg_vec_lock); spin_lock(&po->bind_lock); - if (was_running) { - WRITE_ONCE(po->num, num); + WRITE_ONCE(po->num, num); + if (was_running) register_prot_hook(sk); - } + spin_unlock(&po->bind_lock); if (pg_vec && (po->tp_version > TPACKET_V2)) { /* Because we don't support block-based V3 on tx-ring */ -- 2.34.1

2 1

[openeuler:OLK-6.6 3493/3493] mm/dynamic_pool.c:118:55: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0189df7df2ef7f7dbbabf7ff8398e45adf306e24 commit: 8822f3476adadcf84c7cb3db0d1a0a39a6fdc398 [3493/3493] mm/dynamic_pool: introduce per-memcg memory pool config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091456.3c7HGfWF-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091456.3c7HGfWF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091456.3c7HGfWF-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/dynamic_pool.c:118:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_pool.c:118:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_pool.c:118:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * vim +118 mm/dynamic_pool.c 115 116 int dynamic_pool_destroy(struct cgroup *cgrp, bool *clear_css_online) 117 { > 118 struct cgroup_subsys_state *css = cgrp->subsys[memory_cgrp_id]; 119 struct mem_cgroup *memcg = mem_cgroup_from_css(css); 120 struct dynamic_pool *dpool; 121 int ret = 0; 122 123 if (!dpool_enabled || !memcg) 124 return 0; 125 126 mutex_lock(&dpool_mutex); 127 dpool = dpool_get_from_memcg(memcg); 128 if (!dpool) 129 goto unlock; 130 131 if (dpool->memcg != memcg) { 132 memcg->dpool = NULL; 133 goto put; 134 } 135 136 /* A offline dpool is not allowed for allocation */ 137 dpool->online = false; 138 139 memcg->dpool = NULL; 140 141 /* Release the initial reference count */ 142 dpool_put(dpool); 143 144 /* 145 * Since dpool is destroyed and the memcg will be freed then, 146 * clear CSS_ONLINE immediately to prevent race with create. 147 */ 148 if (cgrp->self.flags & CSS_ONLINE) { 149 cgrp->self.flags &= ~CSS_ONLINE; 150 *clear_css_online = true; 151 } 152 153 put: 154 dpool_put(dpool); 155 unlock: 156 mutex_unlock(&dpool_mutex); 157 158 return ret; 159 } 160 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] vsock: Do not allow binding to VMADDR_PORT_ANY
by Wang Liang 09 Dec '25

09 Dec '25

From: Budimir Markovic <markovicbudimir(a)gmail.com> stable inclusion from stable-v5.10.241 commit d1a5b1964cef42727668ac0d8532dae4f8c19386 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4U CVE: CVE-2025-38618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit aba0c94f61ec05315fa7815d21aefa4c87f6a9f4 upstream. It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir(a)gmail.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 3d24457ddf15..5e68c0705d3f 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -612,7 +612,8 @@ static int __vsock_bind_stream(struct vsock_sock *vsk, unsigned int i; for (i = 0; i < MAX_PORT_RETRIES; i++) { - if (port <= LAST_RESERVED_PORT) + if (port == VMADDR_PORT_ANY || + port <= LAST_RESERVED_PORT) port = LAST_RESERVED_PORT + 1; new_addr.svm_port = port++; -- 2.34.1

2 1

[PATCH OLK-5.10] ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
by Wang Liang 09 Dec '25

09 Dec '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v5.10.241 commit 435462f8ab2b9c5340a5414ce02f70117d0cfede category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUCA2 CVE: CVE-2025-38664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 ] Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. Fixes: c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> [ applied the patch to ice_flex_pipe.c instead of ice_ddp.c ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_flex_pipe.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c index a81be917f653..da2906720c63 100644 --- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c +++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c @@ -1449,6 +1449,8 @@ enum ice_status ice_copy_and_init_pkg(struct ice_hw *hw, const u8 *buf, u32 len) return ICE_ERR_PARAM; buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len, GFP_KERNEL); + if (!buf_copy) + return ICE_ERR_NO_MEMORY; status = ice_init_pkg(hw, buf_copy, len); if (status) { -- 2.34.1

2 1

[PATCH OLK-5.10] ipv6: reject malicious packets in ipv6_gso_segment()
by Wang Liang 09 Dec '25

09 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v5.10.241 commit 3f638e0b28bde7c3354a0df938ab3a96739455d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6G7 CVE: CVE-2025-38572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe ] syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support") Reported-by: syzbot+af43e647fd835acc02df(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250730131738.3385939-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/linux/skbuff.h | 23 +++++++++++++++++++++++ net/ipv6/ip6_offload.c | 4 +++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 4a7a2ff7aec3..6e8dfec0a2a9 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2594,6 +2594,29 @@ static inline void skb_reset_transport_header(struct sk_buff *skb) skb->transport_header = skb->data - skb->head; } +/** + * skb_reset_transport_header_careful - conditionally reset transport header + * @skb: buffer to alter + * + * Hardened version of skb_reset_transport_header(). + * + * Returns: true if the operation was a success. + */ +static inline bool __must_check +skb_reset_transport_header_careful(struct sk_buff *skb) +{ + long offset = skb->data - skb->head; + + if (unlikely(offset != (typeof(skb->transport_header))offset)) + return false; + + if (unlikely(offset == (typeof(skb->transport_header))~0U)) + return false; + + skb->transport_header = offset; + return true; +} + static inline void skb_set_transport_header(struct sk_buff *skb, const int offset) { diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c index 15c8eef1ef44..71b5a7c3df09 100644 --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -111,7 +111,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, ops = rcu_dereference(inet6_offloads[proto]); if (likely(ops && ops->callbacks.gso_segment)) { - skb_reset_transport_header(skb); + if (!skb_reset_transport_header_careful(skb)) + goto out; + segs = ops->callbacks.gso_segment(skb, features); if (!segs) skb->network_header = skb_mac_header(skb) + nhoff - skb->head; -- 2.34.1

2 1

[PATCH OLK-5.10] arm64: kdump: Skip kmemleak scan reserved memory for kdump
by Zeng Heng 09 Dec '25

09 Dec '25

From: Chen Wandun <chenwandun(a)huawei.com> mainline inclusion from mainline-v5.15-rc1 commit 85f58eb1889826b9745737718723a80b639e0fbd category: bugfix bugzilla: 188440 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Trying to boot with kdump + kmemleak, command will result in a crash: "echo scan > /sys/kernel/debug/kmemleak" crashkernel reserved: 0x0000000007c00000 - 0x0000000027c00000 (512 MB) Kernel command line: BOOT_IMAGE=(hd1,gpt2)/vmlinuz-5.14.0-rc5-next-20210809+ root=/dev/mapper/ao-root ro rd.lvm.lv=ao/root rd.lvm.lv=ao/swap crashkernel=512M Unable to handle kernel paging request at virtual address ffff000007c00000 Mem abort info: ESR = 0x96000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007 CM = 0, WnR = 0 swapper pgtable: 64k pages, 48-bit VAs, pgdp=00002024f0d80000 [ffff000007c00000] pgd=1800205ffffd0003, p4d=1800205ffffd0003, pud=1800205ffffd0003, pmd=1800205ffffc0003, pte=0068000007c00f06 Internal error: Oops: 96000007 [#1] SMP pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : scan_block+0x98/0x230 lr : scan_block+0x94/0x230 sp : ffff80008d6cfb70 x29: ffff80008d6cfb70 x28: 0000000000000000 x27: 0000000000000000 x26: 00000000000000c0 x25: 0000000000000001 x24: 0000000000000000 x23: ffffa88a6b18b398 x22: ffff000007c00ff9 x21: ffffa88a6ac7fc40 x20: ffffa88a6af6a830 x19: ffff000007c00000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff x14: ffffffff00000000 x13: ffffffffffffffff x12: 0000000000000020 x11: 0000000000000000 x10: 0000000001080000 x9 : ffffa88a6951c77c x8 : ffffa88a6a893988 x7 : ffff203ff6cfb3c0 x6 : ffffa88a6a52b3c0 x5 : ffff203ff6cfb3c0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffff20226cb56a40 x0 : 0000000000000000 Call trace: scan_block+0x98/0x230 scan_gray_list+0x120/0x270 kmemleak_scan+0x3a0/0x648 kmemleak_write+0x3ac/0x4c8 full_proxy_write+0x6c/0xa0 vfs_write+0xc8/0x2b8 ksys_write+0x70/0xf8 __arm64_sys_write+0x24/0x30 invoke_syscall+0x4c/0x110 el0_svc_common+0x9c/0x190 do_el0_svc+0x30/0x98 el0_svc+0x28/0xd8 el0t_64_sync_handler+0x90/0xb8 el0t_64_sync+0x180/0x184 The reserved memory for kdump will be looked up by kmemleak, this area will be set invalid when kdump service is bring up. That will result in crash when kmemleak scan this area. Fixes: a7259df76702 ("memblock: make memblock_find_in_range method private") Signed-off-by: Chen Wandun <chenwandun(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Mike Rapoport <rppt(a)linux.ibm.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20210910064844.3827813-1-chenwandun@huawei.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> conflict: arch/arm64/mm/init.c Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- kernel/crash_core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/crash_core.c b/kernel/crash_core.c index d1402585bf84..368d8d1dd03c 100644 --- a/kernel/crash_core.c +++ b/kernel/crash_core.c @@ -9,6 +9,7 @@ #include <linux/vmalloc.h> #include <linux/memblock.h> #include <linux/swiotlb.h> +#include <linux/kmemleak.h> #ifdef CONFIG_KEXEC_CORE #include <asm/kexec.h> @@ -556,6 +557,14 @@ void __init reserve_crashkernel(void) (unsigned long)(crash_base >> 20), (unsigned long)(total_mem >> 20)); +#ifdef CONFIG_ARM64 + /* + * The crashkernel memory will be removed from the kernel linear + * map. Inform kmemleak so that it won't try to access it. + */ + kmemleak_ignore_phys(crash_base); +#endif + crashk_res.start = crash_base; crashk_res.end = crash_base + crash_size - 1; } -- 2.25.1

2 1

[openeuler:OLK-6.6 3493/3493] mm/memblock.c:1409:20: warning: no previous prototype for function 'memblock_alloc_range_nid_flags'
by kernel test robot 09 Dec '25

09 Dec '25

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d86ef4e1e96aa04c46e92dca30f98d069c1ad15a commit: 64018b291c1f49622c4b23b303364d760306d662 [3493/3493] mm/memblock: Introduce ability to alloc memory from specify memory region config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091204.Q8mSD8MC-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091204.Q8mSD8MC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091204.Q8mSD8MC-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memblock.c:18: In file included from include/linux/memblock.h:12: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> mm/memblock.c:1409:20: warning: no previous prototype for function 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] 1409 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ mm/memblock.c:1409:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1409 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ | static 2 warnings generated. -- >> mm/memblock.c:1579: warning: expecting prototype for memblock_alloc_internal(). Prototype was for __memblock_alloc_internal() instead vim +/memblock_alloc_range_nid_flags +1409 mm/memblock.c 1386 1387 /** 1388 * memblock_alloc_range_nid_flags - allocate boot memory block with specify flag 1389 * @size: size of memory block to be allocated in bytes 1390 * @align: alignment of the region and block's size 1391 * @start: the lower bound of the memory region to allocate (phys address) 1392 * @end: the upper bound of the memory region to allocate (phys address) 1393 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1394 * @exact_nid: control the allocation fall back to other nodes 1395 * @flags: alloc memory from specify memblock flag 1396 * 1397 * The allocation is performed from memory region limited by 1398 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1399 * 1400 * If the specified node can not hold the requested memory and @exact_nid 1401 * is false, the allocation falls back to any node in the system. 1402 * 1403 * In addition, function sets the min_count to 0 using kmemleak_alloc_phys for 1404 * allocated boot memory block, so that it is never reported as leaks. 1405 * 1406 * Return: 1407 * Physical address of allocated memory block on success, %0 on failure. 1408 */ > 1409 phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, 1410 phys_addr_t align, phys_addr_t start, 1411 phys_addr_t end, int nid, 1412 bool exact_nid, 1413 enum memblock_flags flags) 1414 { 1415 phys_addr_t found; 1416 1417 if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) 1418 nid = NUMA_NO_NODE; 1419 1420 if (!align) { 1421 /* Can't use WARNs this early in boot on powerpc */ 1422 dump_stack(); 1423 align = SMP_CACHE_BYTES; 1424 } 1425 1426 again: 1427 found = memblock_find_in_range_node(size, align, start, end, nid, 1428 flags); 1429 if (found && !memblock_reserve(found, size)) 1430 goto done; 1431 1432 if (nid != NUMA_NO_NODE && !exact_nid) { 1433 found = memblock_find_in_range_node(size, align, start, 1434 end, NUMA_NO_NODE, 1435 flags); 1436 if (found && !memblock_reserve(found, size)) 1437 goto done; 1438 } 1439 1440 if (flags & MEMBLOCK_MIRROR) { 1441 flags &= ~MEMBLOCK_MIRROR; 1442 pr_warn_ratelimited("Could not allocate %pap bytes of mirrored memory\n", 1443 &size); 1444 goto again; 1445 } 1446 1447 return 0; 1448 1449 done: 1450 /* 1451 * Skip kmemleak for those places like kasan_init() and 1452 * early_pgtable_alloc() due to high volume. 1453 */ 1454 if (end != MEMBLOCK_ALLOC_NOLEAKTRACE) 1455 /* 1456 * Memblock allocated blocks are never reported as 1457 * leaks. This is because many of these blocks are 1458 * only referred via the physical address which is 1459 * not looked up by kmemleak. 1460 */ 1461 kmemleak_alloc_phys(found, size, 0); 1462 1463 /* 1464 * Some Virtual Machine platforms, such as Intel TDX or AMD SEV-SNP, 1465 * require memory to be accepted before it can be used by the 1466 * guest. 1467 * 1468 * Accept the memory of the allocated buffer. 1469 */ 1470 accept_memory(found, found + size); 1471 1472 return found; 1473 } 1474 1475 /** 1476 * memblock_alloc_range_nid - allocate boot memory block 1477 * @size: size of memory block to be allocated in bytes 1478 * @align: alignment of the region and block's size 1479 * @start: the lower bound of the memory region to allocate (phys address) 1480 * @end: the upper bound of the memory region to allocate (phys address) 1481 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1482 * @exact_nid: control the allocation fall back to other nodes 1483 * 1484 * The allocation is performed from memory region limited by 1485 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1486 * 1487 * If the specified node can not hold the requested memory and @exact_nid 1488 * is false, the allocation falls back to any node in the system. 1489 * 1490 * For systems with memory mirroring, the allocation is attempted first 1491 * from the regions with mirroring enabled and then retried from any 1492 * memory region. 1493 * 1494 * In addition, function using kmemleak_alloc_phys for allocated boot 1495 * memory block, it is never reported as leaks. 1496 * 1497 * Return: 1498 * Physical address of allocated memory block on success, %0 on failure. 1499 */ 1500 phys_addr_t __init memblock_alloc_range_nid(phys_addr_t size, 1501 phys_addr_t align, phys_addr_t start, 1502 phys_addr_t end, int nid, 1503 bool exact_nid) 1504 { 1505 return memblock_alloc_range_nid_flags(size, align, start, end, nid, 1506 exact_nid, 1507 choose_memblock_flags()); 1508 } 1509 1510 /** 1511 * memblock_phys_alloc_range - allocate a memory block inside specified range 1512 * @size: size of memory block to be allocated in bytes 1513 * @align: alignment of the region and block's size 1514 * @start: the lower bound of the memory region to allocate (physical address) 1515 * @end: the upper bound of the memory region to allocate (physical address) 1516 * 1517 * Allocate @size bytes in the between @start and @end. 1518 * 1519 * Return: physical address of the allocated memory block on success, 1520 * %0 on failure. 1521 */ 1522 phys_addr_t __init memblock_phys_alloc_range(phys_addr_t size, 1523 phys_addr_t align, 1524 phys_addr_t start, 1525 phys_addr_t end) 1526 { 1527 memblock_dbg("%s: %llu bytes align=0x%llx from=%pa max_addr=%pa %pS\n", 1528 __func__, (u64)size, (u64)align, &start, &end, 1529 (void *)_RET_IP_); 1530 return memblock_alloc_range_nid(size, align, start, end, NUMA_NO_NODE, 1531 false); 1532 } 1533 1534 /** 1535 * memblock_phys_alloc_try_nid - allocate a memory block from specified NUMA node 1536 * @size: size of memory block to be allocated in bytes 1537 * @align: alignment of the region and block's size 1538 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1539 * 1540 * Allocates memory block from the specified NUMA node. If the node 1541 * has no available memory, attempts to allocated from any node in the 1542 * system. 1543 * 1544 * Return: physical address of the allocated memory block on success, 1545 * %0 on failure. 1546 */ 1547 phys_addr_t __init memblock_phys_alloc_try_nid(phys_addr_t size, phys_addr_t align, int nid) 1548 { 1549 return memblock_alloc_range_nid(size, align, 0, 1550 MEMBLOCK_ALLOC_ACCESSIBLE, nid, false); 1551 } 1552 1553 /** 1554 * memblock_alloc_internal - allocate boot memory block 1555 * @size: size of memory block to be allocated in bytes 1556 * @align: alignment of the region and block's size 1557 * @min_addr: the lower bound of the memory region to allocate (phys address) 1558 * @max_addr: the upper bound of the memory region to allocate (phys address) 1559 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1560 * @exact_nid: control the allocation fall back to other nodes 1561 * @flags: alloc memory from specify memblock flag 1562 * 1563 * Allocates memory block using memblock_alloc_range_nid() and 1564 * converts the returned physical address to virtual. 1565 * 1566 * The @min_addr limit is dropped if it can not be satisfied and the allocation 1567 * will fall back to memory below @min_addr. Other constraints, such 1568 * as node and mirrored memory will be handled again in 1569 * memblock_alloc_range_nid(). 1570 * 1571 * Return: 1572 * Virtual address of allocated memory block on success, NULL on failure. 1573 */ 1574 static void * __init __memblock_alloc_internal( 1575 phys_addr_t size, phys_addr_t align, 1576 phys_addr_t min_addr, phys_addr_t max_addr, 1577 int nid, bool exact_nid, 1578 enum memblock_flags flags) > 1579 { 1580 phys_addr_t alloc; 1581 1582 /* 1583 * Detect any accidental use of these APIs after slab is ready, as at 1584 * this moment memblock may be deinitialized already and its 1585 * internal data may be destroyed (after execution of memblock_free_all) 1586 */ 1587 if (WARN_ON_ONCE(slab_is_available())) 1588 return kzalloc_node(size, GFP_NOWAIT, nid); 1589 1590 if (max_addr > memblock.current_limit) 1591 max_addr = memblock.current_limit; 1592 1593 alloc = memblock_alloc_range_nid_flags(size, align, min_addr, max_addr, nid, 1594 exact_nid, flags); 1595 1596 /* retry allocation without lower limit */ 1597 if (!alloc && min_addr) 1598 alloc = memblock_alloc_range_nid_flags(size, align, 0, max_addr, nid, 1599 exact_nid, flags); 1600 1601 if (!alloc) 1602 return NULL; 1603 1604 return phys_to_virt(alloc); 1605 } 1606 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] fs/proc/task_mmu.c:192:23: warning: variable 'last_vma_start' set but not used
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: 094a76ab06c367065280f8760d2100db0c8a0b6a [3386/3386] mm: proc: use per_vma mmap_lock for vma traversal. config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251209/202512090552.wjNONK6W-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090552.wjNONK6W-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090552.wjNONK6W-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/proc/task_mmu.c: In function 'numa_maps_next': >> fs/proc/task_mmu.c:192:23: warning: variable 'last_vma_start' set but not used [-Wunused-but-set-variable] 192 | unsigned long last_vma_start; | ^~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +/last_vma_start +192 fs/proc/task_mmu.c 184 185 static void *numa_maps_next(struct seq_file *m, void *v, loff_t *ppos) 186 { 187 struct proc_maps_private *priv = m->private; 188 struct vm_area_struct *next = NULL; 189 struct vm_area_struct *vma = v; 190 struct mm_struct *mm = priv->mm; 191 unsigned long last_vma_end; > 192 unsigned long last_vma_start; 193 int ret; 194 195 if (!mm) 196 goto out; 197 198 if (vma == priv->tail_vma) 199 goto out; 200 201 if (vma->vm_next) 202 next = vma->vm_next; 203 else 204 next = priv->tail_vma; 205 206 last_vma_end = vma->vm_end; 207 last_vma_start = vma->vm_start; 208 if (mmap_lock_is_contended(mm)) { 209 mmap_read_unlock(mm); 210 ret = mmap_read_lock_killable(mm); 211 if (ret) { 212 mmput(mm); 213 put_task_struct(priv->task); 214 priv->task = NULL; 215 return ERR_PTR(ret); 216 } 217 218 /* 219 * After dropping the lock, there are four cases to 220 * consider. See the following example for explanation. 221 * 222 * +------+------+-----------+ 223 * | VMA1 | VMA2 | VMA3 | 224 * +------+------+-----------+ 225 * | | | | 226 * 4k 8k 16k 400k 227 * 228 * Suppose we drop the lock after reading VMA2 due to 229 * contention, then we get: 230 * 231 * last_vma_end = 16k 232 * 233 * 1) VMA2 is freed, but VMA3 exists: 234 * 235 * find_vma(mm, 16k - 1) will return VMA3. 236 * In this case, just continue from VMA3. 237 * 238 * 2) VMA2 still exists: 239 * 240 * find_vma(mm, 16k - 1) will return VMA2. 241 * Iterate the loop like the original one. 242 * 243 * 3) No more VMAs can be found: 244 * 245 * find_vma(mm, 16k - 1) will return NULL. 246 * No more things to do, just break. 247 * 248 * 4) (last_vma_end - 1) is the middle of a vma (VMA'): 249 * 250 * find_vma(mm, 16k - 1) will return VMA' whose range 251 * contains last_vma_end. 252 * Iterate VMA' from last_vma_end. 253 */ 254 next = find_vma(mm, last_vma_end - 1); 255 256 /* Case 3 above */ 257 if (!next) 258 goto out; 259 260 /* Case 1 above */ 261 if (next->vm_start >= last_vma_end) 262 goto out; 263 264 /* Case 4 above */ 265 if (next->vm_end > last_vma_end) { 266 *ppos = last_vma_end; 267 return next; 268 } 269 270 /* Case 2 above */ 271 if (next->vm_next) 272 next = next->vm_next; 273 else 274 next = priv->tail_vma; 275 } 276 out: 277 *ppos = next ? next->vm_start : -1UL; 278 return next; 279 } 280 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/mempolicy.c:1115:25: warning: variable 'vma' set but not used
by kernel test robot 09 Dec '25

09 Dec '25

Hi Ze, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d86ef4e1e96aa04c46e92dca30f98d069c1ad15a commit: dba69db9a5fc7c2c9c0cda0f32bb3b5f3d73ef93 [3493/3493] mm/damon/vaddr: Add demotion interface for migrating cold pages to target nodemask config: loongarch-randconfig-r111-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091141.r06Y9a5w-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 6ec8c4351cfc1d0627d1633b02ea787bd29c77d8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091141.r06Y9a5w-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091141.r06Y9a5w-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from <built-in>:3: In file included from include/linux/compiler_types.h:150: include/linux/compiler-clang.h:33:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:372:9: note: previous definition is here 372 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from mm/mempolicy.c:108: In file included from arch/loongarch/include/asm/tlb.h:140: include/asm-generic/tlb.h:632:10: warning: parameter 'ptep' set but not used [-Wunused-but-set-parameter] 632 | pte_t *ptep, unsigned int nr, unsigned long address) | ^ In file included from mm/mempolicy.c:108: arch/loongarch/include/asm/tlb.h:144:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 144 | struct vm_area_struct vma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ >> mm/mempolicy.c:1115:25: warning: variable 'vma' set but not used [-Wunused-but-set-variable] 1115 | struct vm_area_struct *vma; | ^ mm/mempolicy.c:2951:25: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 2951 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ 5 warnings generated. vim +/vma +1115 mm/mempolicy.c 1106 1107 /* 1108 * Migrate area pages from one node to a target node. 1109 * Returns error or the number of pages not migrated. 1110 */ 1111 static int migrate_area_to_node(struct mm_struct *mm, int source, int dest, 1112 unsigned long start, unsigned long end, int flags) 1113 { 1114 nodemask_t nmask; > 1115 struct vm_area_struct *vma; 1116 LIST_HEAD(pagelist); 1117 int err = 0; 1118 struct migration_target_control mtc = { 1119 .nid = dest, 1120 .gfp_mask = GFP_HIGHUSER_MOVABLE | __GFP_THISNODE, 1121 }; 1122 1123 nodes_clear(nmask); 1124 node_set(source, nmask); 1125 1126 /* 1127 * This does not "check" the range but isolates all pages that 1128 * need migration. Between passing in the full user address 1129 * space range and MPOL_MF_DISCONTIG_OK, this call can not fail. 1130 */ 1131 vma = find_vma(mm, 0); 1132 VM_BUG_ON(!(flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))); 1133 queue_pages_range(mm, start, end, &nmask, 1134 flags | MPOL_MF_DISCONTIG_OK, &pagelist, false); 1135 1136 if (!list_empty(&pagelist)) { 1137 err = migrate_pages(&pagelist, alloc_migration_target, NULL, 1138 (unsigned long)&mtc, MIGRATE_SYNC, MR_DAMON_DEMOTION, NULL); 1139 if (err) 1140 putback_movable_pages(&pagelist); 1141 } 1142 1143 return err; 1144 } 1145 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/madvise.c:297:6: warning: no previous prototype for function 'force_swapin_vma'
by kernel test robot 09 Dec '25

09 Dec '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 92a0eb9bde6c03412b39f9f3d20968c091ea3b46 [3493/3493] memcg: introduce per-memcg swapin interface config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091138.u8NXXfZk-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091138.u8NXXfZk-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091138.u8NXXfZk-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/madvise.c:9: In file included from include/linux/mman.h:5: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/madvise.c:21: include/linux/mm_inline.h:46:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 46 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:48:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 48 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ >> mm/madvise.c:297:6: warning: no previous prototype for function 'force_swapin_vma' [-Wmissing-prototypes] 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^ mm/madvise.c:297:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^ | static 4 warnings generated. vim +/force_swapin_vma +297 mm/madvise.c 280 281 #ifdef CONFIG_MEMCG_SWAP_QOS 282 void force_swapin_vma(struct vm_area_struct *vma) 283 { 284 struct file *file = vma->vm_file; 285 286 if (!can_madv_lru_vma(vma)) 287 return; 288 289 if (!file) { 290 walk_page_vma(vma, &swapin_walk_ops, vma); 291 lru_add_drain(); 292 } else if (shmem_mapping(file->f_mapping)) 293 shmem_swapin_range(vma, vma->vm_start, 294 vma->vm_end, file->f_mapping); 295 } 296 #else > 297 void force_swapin_vma(struct vm_area_struct *vma) 298 { 299 } 300 #endif 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3490/3490] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for function 'sxe_hw_event_irq_auto_clear_set'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 451d7461fb9403af592235b03ec6ead64b43e7c8 commit: 0ba0ebb029b99864fa5963024535f48299373354 [3490/3490] !15589 [OLK-6.6] Ethernet: Supports Linkdata ethernet Controllers config: arm64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251209/202512090327.qpSaRPFx-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 4125e73cdc6188cca4c1c72b72e2b2d85c157483) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090327.qpSaRPFx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090327.qpSaRPFx-lkp@intel.com/ All errors (new ones prefixed by >>): 367 | #define __SANITIZE_ADDRESS__ 1 | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:6: error: no previous prototype for function 'sxe_hw_no_snoop_disable' [-Werror,-Wmissing-prototypes] 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for function 'sxe_hw_uc_addr_pool_del' [-Werror,-Wmissing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for function 'sxe_hw_uc_addr_pool_enable' [-Werror,-Wmissing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for function 'sxe_hw_nic_reset' [-Werror,-Wmissing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for function 'sxe_hw_pf_rst_done_set' [-Werror,-Wmissing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for function 'sxe_hw_pending_irq_read_clear' [-Werror,-Wmissing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for function 'sxe_hw_pending_irq_write_clear' [-Werror,-Wmissing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for function 'sxe_hw_irq_cause_get' [-Werror,-Wmissing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for function 'sxe_hw_ring_irq_auto_disable' [-Werror,-Wmissing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for function 'sxe_hw_irq_general_reg_set' [-Werror,-Wmissing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for function 'sxe_hw_irq_general_reg_get' [-Werror,-Wmissing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for function 'sxe_hw_event_irq_map' [-Werror,-Wmissing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for function 'sxe_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for function 'sxe_hw_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for function 'sxe_hw_event_irq_auto_clear_set' [-Werror,-Wmissing-prototypes] 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:6: error: no previous prototype for function 'sxe_hw_specific_irq_disable' [-Werror,-Wmissing-prototypes] 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:6: error: no previous prototype for function 'sxe_hw_specific_irq_enable' [-Werror,-Wmissing-prototypes] 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:6: error: no previous prototype for function 'sxe_hw_all_irq_disable' [-Werror,-Wmissing-prototypes] 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. -- 367 | #define __SANITIZE_ADDRESS__ 1 | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:160:6: error: no previous prototype for function 'sxevf_hw_stop' [-Werror,-Wmissing-prototypes] 160 | void sxevf_hw_stop(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:160:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 160 | void sxevf_hw_stop(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:187:6: error: no previous prototype for function 'sxevf_msg_write' [-Werror,-Wmissing-prototypes] 187 | void sxevf_msg_write(struct sxevf_hw *hw, u8 index, u32 msg) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:187:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 187 | void sxevf_msg_write(struct sxevf_hw *hw, u8 index, u32 msg) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:196:5: error: no previous prototype for function 'sxevf_msg_read' [-Werror,-Wmissing-prototypes] 196 | u32 sxevf_msg_read(struct sxevf_hw *hw, u8 index) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:196:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 196 | u32 sxevf_msg_read(struct sxevf_hw *hw, u8 index) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:206:5: error: no previous prototype for function 'sxevf_mailbox_read' [-Werror,-Wmissing-prototypes] 206 | u32 sxevf_mailbox_read(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:206:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 206 | u32 sxevf_mailbox_read(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:211:6: error: no previous prototype for function 'sxevf_mailbox_write' [-Werror,-Wmissing-prototypes] 211 | void sxevf_mailbox_write(struct sxevf_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:211:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 211 | void sxevf_mailbox_write(struct sxevf_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:216:6: error: no previous prototype for function 'sxevf_pf_req_irq_trigger' [-Werror,-Wmissing-prototypes] 216 | void sxevf_pf_req_irq_trigger(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:216:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 216 | void sxevf_pf_req_irq_trigger(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:221:6: error: no previous prototype for function 'sxevf_pf_ack_irq_trigger' [-Werror,-Wmissing-prototypes] 221 | void sxevf_pf_ack_irq_trigger(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:221:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 221 | void sxevf_pf_ack_irq_trigger(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:226:6: error: no previous prototype for function 'sxevf_event_irq_map' [-Werror,-Wmissing-prototypes] 226 | void sxevf_event_irq_map(struct sxevf_hw *hw, u16 vector) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:226:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 226 | void sxevf_event_irq_map(struct sxevf_hw *hw, u16 vector) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:240:6: error: no previous prototype for function 'sxevf_specific_irq_enable' [-Werror,-Wmissing-prototypes] 240 | void sxevf_specific_irq_enable(struct sxevf_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:240:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 240 | void sxevf_specific_irq_enable(struct sxevf_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:245:6: error: no previous prototype for function 'sxevf_irq_enable' [-Werror,-Wmissing-prototypes] 245 | void sxevf_irq_enable(struct sxevf_hw *hw, u32 mask) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:245:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 245 | void sxevf_irq_enable(struct sxevf_hw *hw, u32 mask) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:251:6: error: no previous prototype for function 'sxevf_irq_disable' [-Werror,-Wmissing-prototypes] 251 | void sxevf_irq_disable(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:251:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 251 | void sxevf_irq_disable(struct sxevf_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:259:6: error: no previous prototype for function 'sxevf_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 259 | void sxevf_hw_ring_irq_map(struct sxevf_hw *hw, bool is_tx, u16 hw_ring_idx, | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:259:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 259 | void sxevf_hw_ring_irq_map(struct sxevf_hw *hw, bool is_tx, u16 hw_ring_idx, | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:276:6: error: no previous prototype for function 'sxevf_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 276 | void sxevf_ring_irq_interval_set(struct sxevf_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:276:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 276 | void sxevf_ring_irq_interval_set(struct sxevf_hw *hw, u16 irq_idx, u32 interval) | ^ | static drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:313:6: error: no previous prototype for function 'sxevf_hw_reset' [-Werror,-Wmissing-prototypes] 313 | void sxevf_hw_reset(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:313:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 313 | void sxevf_hw_reset(struct sxevf_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:324:5: error: no previous prototype for function 'sxevf_link_state_get' [-Werror,-Wmissing-prototypes] 324 | u32 sxevf_link_state_get(struct sxevf_hw *hw) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:324:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 324 | u32 sxevf_link_state_get(struct sxevf_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:539:6: error: no previous prototype for function 'sxevf_tx_ring_switch' [-Werror,-Wmissing-prototypes] 539 | void sxevf_tx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:539:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 539 | void sxevf_tx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^ | static >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:594:6: error: no previous prototype for function 'sxevf_rx_ring_switch' [-Werror,-Wmissing-prototypes] 594 | void sxevf_rx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:594:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 594 | void sxevf_rx_ring_switch(struct sxevf_hw *hw, u8 reg_idx, bool is_on) | ^ | static >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:626:6: error: no previous prototype for function 'sxevf_rx_ring_desc_configure' [-Werror,-Wmissing-prototypes] 626 | void sxevf_rx_ring_desc_configure(struct sxevf_hw *hw, u32 desc_mem_len, | ^ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c:626:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 626 | void sxevf_rx_ring_desc_configure(struct sxevf_hw *hw, u32 desc_mem_len, | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. vim +/sxe_hw_event_irq_auto_clear_set +838 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c dd013ad487534c liujie_answer 2025-04-15 837 dd013ad487534c liujie_answer 2025-04-15 @838 void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) dd013ad487534c liujie_answer 2025-04-15 839 { dd013ad487534c liujie_answer 2025-04-15 840 SXE_REG_WRITE(hw, SXE_EIAC, value); dd013ad487534c liujie_answer 2025-04-15 841 } dd013ad487534c liujie_answer 2025-04-15 842 dd013ad487534c liujie_answer 2025-04-15 @843 void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) dd013ad487534c liujie_answer 2025-04-15 844 { dd013ad487534c liujie_answer 2025-04-15 845 SXE_REG_WRITE(hw, SXE_EIMC, value); dd013ad487534c liujie_answer 2025-04-15 846 } dd013ad487534c liujie_answer 2025-04-15 847 dd013ad487534c liujie_answer 2025-04-15 @848 void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) dd013ad487534c liujie_answer 2025-04-15 849 { dd013ad487534c liujie_answer 2025-04-15 850 SXE_REG_WRITE(hw, SXE_EIMS, value); dd013ad487534c liujie_answer 2025-04-15 851 } dd013ad487534c liujie_answer 2025-04-15 852 dd013ad487534c liujie_answer 2025-04-15 853 static u32 sxe_hw_spp_state_get(struct sxe_hw *hw) dd013ad487534c liujie_answer 2025-04-15 854 { dd013ad487534c liujie_answer 2025-04-15 855 return SXE_REG_READ(hw, SXE_SPP_STATE); dd013ad487534c liujie_answer 2025-04-15 856 } dd013ad487534c liujie_answer 2025-04-15 857 dd013ad487534c liujie_answer 2025-04-15 858 static void sxe_hw_rx_los_disable(struct sxe_hw *hw) dd013ad487534c liujie_answer 2025-04-15 859 { dd013ad487534c liujie_answer 2025-04-15 860 u32 value; dd013ad487534c liujie_answer 2025-04-15 861 dd013ad487534c liujie_answer 2025-04-15 862 value = SXE_REG_READ(hw, SXE_EIMS); dd013ad487534c liujie_answer 2025-04-15 863 value &= ~SXE_EIMS_GPI_SPP1; dd013ad487534c liujie_answer 2025-04-15 864 SXE_REG_WRITE(hw, SXE_EIMS, value); dd013ad487534c liujie_answer 2025-04-15 865 } dd013ad487534c liujie_answer 2025-04-15 866 dd013ad487534c liujie_answer 2025-04-15 867 static void sxe_hw_rx_los_enable(struct sxe_hw *hw) dd013ad487534c liujie_answer 2025-04-15 868 { dd013ad487534c liujie_answer 2025-04-15 869 u32 value; dd013ad487534c liujie_answer 2025-04-15 870 dd013ad487534c liujie_answer 2025-04-15 871 value = SXE_REG_READ(hw, SXE_EIMS); dd013ad487534c liujie_answer 2025-04-15 872 value |= SXE_EIMS_GPI_SPP1; dd013ad487534c liujie_answer 2025-04-15 873 SXE_REG_WRITE(hw, SXE_EIMS, value); dd013ad487534c liujie_answer 2025-04-15 874 } dd013ad487534c liujie_answer 2025-04-15 875 dd013ad487534c liujie_answer 2025-04-15 @876 void sxe_hw_all_irq_disable(struct sxe_hw *hw) dd013ad487534c liujie_answer 2025-04-15 877 { dd013ad487534c liujie_answer 2025-04-15 878 SXE_REG_WRITE(hw, SXE_EIMC, 0xFFFF0000); dd013ad487534c liujie_answer 2025-04-15 879 dd013ad487534c liujie_answer 2025-04-15 880 SXE_REG_WRITE(hw, SXE_EIMC_EX(0), ~0); dd013ad487534c liujie_answer 2025-04-15 881 SXE_REG_WRITE(hw, SXE_EIMC_EX(1), ~0); dd013ad487534c liujie_answer 2025-04-15 882 dd013ad487534c liujie_answer 2025-04-15 883 SXE_WRITE_FLUSH(hw); dd013ad487534c liujie_answer 2025-04-15 884 } dd013ad487534c liujie_answer 2025-04-15 885 :::::: The code at line 838 was first introduced by commit :::::: dd013ad487534c1838afc2f55efdb5daec15aace Ethernet: Linkdata: Supports Linkdata ethernet Controllers :::::: TO: liujie_answer <liujie5(a)linkdatatechnology.com> :::::: CC: liujie_answer <liujie5(a)linkdatatechnology.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] drivers/cpufreq/intel_pstate.c:1473:6: warning: no previous prototype for 'notify_hwp_interrupt'
by kernel test robot 09 Dec '25

09 Dec '25

Hi Srinivas, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: e217d5958ee378eb304fb0b4eb6fcb551e555842 [3386/3386] cpufreq: intel_pstate: Process HWP Guaranteed change notification config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251209/202512090137.yqEfvu43-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090137.yqEfvu43-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090137.yqEfvu43-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/cpufreq/intel_pstate.c:1473:6: warning: no previous prototype for 'notify_hwp_interrupt' [-Wmissing-prototypes] 1473 | void notify_hwp_interrupt(void) | ^~~~~~~~~~~~~~~~~~~~ vim +/notify_hwp_interrupt +1473 drivers/cpufreq/intel_pstate.c 1472 > 1473 void notify_hwp_interrupt(void) 1474 { 1475 unsigned int this_cpu = smp_processor_id(); 1476 struct cpudata *cpudata; 1477 unsigned long flags; 1478 u64 value; 1479 1480 if (!READ_ONCE(hwp_active) || !boot_cpu_has(X86_FEATURE_HWP_NOTIFY)) 1481 return; 1482 1483 rdmsrl_safe(MSR_HWP_STATUS, &value); 1484 if (!(value & 0x01)) 1485 return; 1486 1487 spin_lock_irqsave(&hwp_notify_lock, flags); 1488 1489 if (!cpumask_test_cpu(this_cpu, &hwp_intr_enable_mask)) 1490 goto ack_intr; 1491 1492 /* 1493 * Currently we never free all_cpu_data. And we can't reach here 1494 * without this allocated. But for safety for future changes, added 1495 * check. 1496 */ 1497 if (unlikely(!READ_ONCE(all_cpu_data))) 1498 goto ack_intr; 1499 1500 /* 1501 * The free is done during cleanup, when cpufreq registry is failed. 1502 * We wouldn't be here if it fails on init or switch status. But for 1503 * future changes, added check. 1504 */ 1505 cpudata = READ_ONCE(all_cpu_data[this_cpu]); 1506 if (unlikely(!cpudata)) 1507 goto ack_intr; 1508 1509 schedule_delayed_work(&cpudata->hwp_notify_work, msecs_to_jiffies(10)); 1510 1511 spin_unlock_irqrestore(&hwp_notify_lock, flags); 1512 1513 return; 1514 1515 ack_intr: 1516 wrmsrl_safe(MSR_HWP_STATUS, 0); 1517 spin_unlock_irqrestore(&hwp_notify_lock, flags); 1518 } 1519 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/gmem_phys.c:345:19: warning: no previous prototype for 'gm_evict_page'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 8f4f66a9d851f366942e8ee319292e41ad2baa95 [3493/3493] gmem: support swapping heterogeneous memory config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251209/202512090139.MlPNvch8-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090139.MlPNvch8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090139.MlPNvch8-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/gmem_phys.c:245:19: warning: no previous prototype for 'gm_evict_page_locked' [-Wmissing-prototypes] 245 | enum gm_evict_ret gm_evict_page_locked(struct gm_page *gm_page) | ^~~~~~~~~~~~~~~~~~~~ >> mm/gmem_phys.c:345:19: warning: no previous prototype for 'gm_evict_page' [-Wmissing-prototypes] 345 | enum gm_evict_ret gm_evict_page(struct gm_page *gm_page) | ^~~~~~~~~~~~~ vim +/gm_evict_page +345 mm/gmem_phys.c 344 > 345 enum gm_evict_ret gm_evict_page(struct gm_page *gm_page) 346 { 347 struct mm_struct *mm = gm_page->mm; 348 enum gm_evict_ret ret; 349 350 mmap_read_lock(mm); 351 ret = gm_evict_page_locked(gm_page); 352 mmap_read_unlock(mm); 353 return ret; 354 } 355 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3490/3490] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:6: error: no previous prototype for function 'sxe_debugfs_entries_init'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: dd013ad487534c1838afc2f55efdb5daec15aace [3490/3490] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: arm64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082350.9BPj98cP-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 4125e73cdc6188cca4c1c72b72e2b2d85c157483) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082350.9BPj98cP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082350.9BPj98cP-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <built-in>:3: In file included from ././include/linux/compiler_types.h:150: ./include/linux/compiler-clang.h:33:9: error: '__SANITIZE_ADDRESS__' macro redefined [-Werror,-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:367:9: note: previous definition is here 367 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:11: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.h:15: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from ./include/linux/pci.h:1670: In file included from ./include/linux/dmapool.h:14: In file included from ./include/linux/scatterlist.h:8: In file included from ./include/linux/mm.h:2253: ./include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ ./include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:410:6: error: no previous prototype for function 'sxe_txrx_ring_enable' [-Werror,-Wmissing-prototypes] 410 | void sxe_txrx_ring_enable(struct sxe_adapter *adapter, u32 ring_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_xdp.c:410:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 410 | void sxe_txrx_ring_enable(struct sxe_adapter *adapter, u32 ring_idx) | ^ | static 6 errors generated. -- In file included from <built-in>:3: In file included from ././include/linux/compiler_types.h:150: ./include/linux/compiler-clang.h:33:9: error: '__SANITIZE_ADDRESS__' macro redefined [-Werror,-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:367:9: note: previous definition is here 367 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:14: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from ./include/linux/pci.h:1670: In file included from ./include/linux/dmapool.h:14: In file included from ./include/linux/scatterlist.h:8: In file included from ./include/linux/mm.h:2253: ./include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ ./include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:6: error: no previous prototype for function 'sxe_debugfs_entries_init' [-Werror,-Wmissing-prototypes] 432 | void sxe_debugfs_entries_init(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:432:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 432 | void sxe_debugfs_entries_init(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:459:6: error: no previous prototype for function 'sxe_debugfs_entries_exit' [-Werror,-Wmissing-prototypes] 459 | void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:459:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 459 | void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:465:6: error: no previous prototype for function 'sxe_debugfs_init' [-Werror,-Wmissing-prototypes] 465 | void sxe_debugfs_init(void) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:465:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 465 | void sxe_debugfs_init(void) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:470:6: error: no previous prototype for function 'sxe_debugfs_exit' [-Werror,-Wmissing-prototypes] 470 | void sxe_debugfs_exit(void) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c:470:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 470 | void sxe_debugfs_exit(void) | ^ | static 9 errors generated. -- In file included from <built-in>:3: In file included from ././include/linux/compiler_types.h:150: ./include/linux/compiler-clang.h:33:9: error: '__SANITIZE_ADDRESS__' macro redefined [-Werror,-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:367:9: note: previous definition is here 367 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:11: In file included from ./include/linux/highmem.h:8: In file included from ./include/linux/cacheflush.h:5: In file included from ./arch/arm64/include/asm/cacheflush.h:11: In file included from ./include/linux/kgdb.h:19: In file included from ./include/linux/kprobes.h:28: In file included from ./include/linux/ftrace.h:13: In file included from ./include/linux/kallsyms.h:13: In file included from ./include/linux/mm.h:2253: ./include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ ./include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:20: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_filter.h:16: ./include/net/ip.h:466:14: error: default initialization of an object of type 'typeof (rt->dst.expires)' (aka 'const unsigned long') leaves the object uninitialized [-Werror,-Wdefault-const-init-var-unsafe] 466 | if (mtu && time_before(jiffies, rt->dst.expires)) | ^ ./include/linux/jiffies.h:135:26: note: expanded from macro 'time_before' 135 | #define time_before(a,b) time_after(b,a) | ^ ./include/linux/jiffies.h:125:3: note: expanded from macro 'time_after' 125 | (typecheck(unsigned long, a) && \ | ^ ./include/linux/typecheck.h:11:12: note: expanded from macro 'typecheck' 11 | typeof(x) __dummy2; \ | ^ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:5: error: no previous prototype for function 'sxe_reg_test' [-Werror,-Wmissing-prototypes] 2022 | int sxe_reg_test(struct sxe_adapter *adapter) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2022:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2022 | int sxe_reg_test(struct sxe_adapter *adapter) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2644:5: error: no previous prototype for function 'sxe_phys_id_set' [-Werror,-Wmissing-prototypes] 2644 | int sxe_phys_id_set(struct net_device *netdev, enum ethtool_phys_id_state state) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ethtool.c:2644:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2644 | int sxe_phys_id_set(struct net_device *netdev, enum ethtool_phys_id_state state) | ^ | static 8 errors generated. -- In file included from <built-in>:3: In file included from ././include/linux/compiler_types.h:150: ./include/linux/compiler-clang.h:33:9: error: '__SANITIZE_ADDRESS__' macro redefined [-Werror,-Wmacro-redefined] 33 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:367:9: note: previous definition is here 367 | #define __SANITIZE_ADDRESS__ 1 | ^ In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:15: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe_pci.h:14: In file included from drivers/net/ethernet/linkdata/sxe/sxepf/sxe.h:15: In file included from ./include/linux/pci.h:1670: In file included from ./include/linux/dmapool.h:14: In file included from ./include/linux/scatterlist.h:8: In file included from ./include/linux/mm.h:2253: ./include/linux/vmstat.h:508:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ ./include/linux/vmstat.h:515:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:527:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/vmstat.h:536:43: error: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Werror,-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:6: error: no previous prototype for function 'sxe_hw_no_snoop_disable' [-Werror,-Wmissing-prototypes] 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:230:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 230 | void sxe_hw_no_snoop_disable(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for function 'sxe_hw_uc_addr_pool_del' [-Werror,-Wmissing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for function 'sxe_hw_uc_addr_pool_enable' [-Werror,-Wmissing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for function 'sxe_hw_nic_reset' [-Werror,-Wmissing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for function 'sxe_hw_pf_rst_done_set' [-Werror,-Wmissing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for function 'sxe_hw_pending_irq_read_clear' [-Werror,-Wmissing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for function 'sxe_hw_pending_irq_write_clear' [-Werror,-Wmissing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for function 'sxe_hw_irq_cause_get' [-Werror,-Wmissing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for function 'sxe_hw_ring_irq_auto_disable' [-Werror,-Wmissing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for function 'sxe_hw_irq_general_reg_set' [-Werror,-Wmissing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for function 'sxe_hw_irq_general_reg_get' [-Werror,-Wmissing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for function 'sxe_hw_event_irq_map' [-Werror,-Wmissing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for function 'sxe_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for function 'sxe_hw_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. .. vim +/sxe_debugfs_entries_init +432 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debugfs.c 431 > 432 void sxe_debugfs_entries_init(struct sxe_adapter *adapter) 433 { 434 struct dentry *dir; 435 const char *name = pci_name(adapter->pdev); 436 437 adapter->debugfs_entries = debugfs_create_dir(name, sxe_debugfs_root); 438 dir = debugfs_create_file("reg_ops", 0600, adapter->debugfs_entries, 439 adapter, &sxe_debugfs_reg_ops_fops); 440 if (!dir || dir == ERR_PTR(-ENODEV)) 441 LOG_INFO_BDF("debugfs:reg_ops file create failed\n"); 442 443 dir = debugfs_create_file("netdev_ops", 0600, adapter->debugfs_entries, 444 adapter, &sxe_debugfs_netdev_ops_fops); 445 if (!dir || dir == ERR_PTR(-ENODEV)) 446 LOG_INFO_BDF("debugfs:netdev_ops file create failed\n"); 447 448 dir = debugfs_create_file("hw_stats", 0400, adapter->debugfs_entries, 449 adapter, &sxe_debugfs_hw_stats_fops); 450 if (!dir || dir == ERR_PTR(-ENODEV)) 451 LOG_INFO_BDF("debugfs:hw_stats file create failed\n"); 452 453 dir = debugfs_create_file("sfp_info", 0400, adapter->debugfs_entries, 454 adapter, &sxe_debugfs_sfp_info_fops); 455 if (!dir || dir == ERR_PTR(-ENODEV)) 456 LOG_INFO_BDF("debugfs:sfp_info file create failed\n"); 457 } 458 > 459 void sxe_debugfs_entries_exit(struct sxe_adapter *adapter) 460 { 461 debugfs_remove_recursive(adapter->debugfs_entries); 462 adapter->debugfs_entries = NULL; 463 } 464 > 465 void sxe_debugfs_init(void) 466 { 467 sxe_debugfs_root = debugfs_create_dir(SXE_DRV_NAME, NULL); 468 } 469 > 470 void sxe_debugfs_exit(void) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] ./include/linux/iommu.h:2001:40: warning: 'struct iommu_plb_gather' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: d46a4bd5bdfd7f1d6e2fa159398df4c54345070c [3493/3493] iommu/ummu-core: introduce iommu sva permission operation config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082342.kZY4UVlP-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082342.kZY4UVlP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082342.kZY4UVlP-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/fork.c:101: >> ./include/linux/iommu.h:2001:40: warning: 'struct iommu_plb_gather' declared inside parameter list will not be visible outside of this definition or declaration 2001 | struct iommu_plb_gather *plb_gather) {} | ^~~~~~~~~~~~~~~~ vim +2001 ./include/linux/iommu.h 1993 1994 static inline int iommu_sva_ungrant(struct iommu_sva *sva, void *va, 1995 size_t size, void *cookie) 1996 { 1997 return -EOPNOTSUPP; 1998 } 1999 static inline void iommu_plb_sync_all(struct iommu_domain *domain) {} 2000 static inline void iommu_plb_sync(struct iommu_domain *domain, > 2001 struct iommu_plb_gather *plb_gather) {} -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] drivers/acpi/cppc_acpi.c:1530: warning: Function parameter or member 'auto_act_window' not described in 'cppc_set_auto_act_window'
by kernel test robot 09 Dec '25

09 Dec '25

Hi heppen, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: 6d474065f368e21b77526a5c30f5a1aed017142a [3386/3386] ACPI: CPPC: Add three register ABIs config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082313.2Za1o7Qf-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082313.2Za1o7Qf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082313.2Za1o7Qf-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/acpi/cppc_acpi.c:450: warning: Function parameter or member 'cpc_pptr' not described in '__acpi_get_psd_map' drivers/acpi/cppc_acpi.c:700: warning: Function parameter or member 'pcc_ss_id' not described in 'pcc_data_alloc' >> drivers/acpi/cppc_acpi.c:1530: warning: Function parameter or member 'auto_act_window' not described in 'cppc_set_auto_act_window' >> drivers/acpi/cppc_acpi.c:1530: warning: Excess function parameter 'enable' description in 'cppc_set_auto_act_window' >> drivers/acpi/cppc_acpi.c:1541: warning: Function parameter or member 'cpunum' not described in 'cppc_get_auto_act_window' >> drivers/acpi/cppc_acpi.c:1541: warning: Function parameter or member 'auto_act_window' not described in 'cppc_get_auto_act_window' >> drivers/acpi/cppc_acpi.c:1541: warning: Excess function parameter 'cpu' description in 'cppc_get_auto_act_window' >> drivers/acpi/cppc_acpi.c:1541: warning: Excess function parameter 'enable' description in 'cppc_get_auto_act_window' >> drivers/acpi/cppc_acpi.c:1552: warning: Function parameter or member 'auto_sel' not described in 'cppc_get_auto_sel' >> drivers/acpi/cppc_acpi.c:1552: warning: Excess function parameter 'enable' description in 'cppc_get_auto_sel' >> drivers/acpi/cppc_acpi.c:1575: warning: Function parameter or member 'epp_val' not described in 'cppc_set_epp' >> drivers/acpi/cppc_acpi.c:1575: warning: Excess function parameter 'enable' description in 'cppc_set_epp' drivers/acpi/cppc_acpi.c:1716: warning: Function parameter or member 'cpu_num' not described in 'cppc_get_transition_latency' vim +1530 drivers/acpi/cppc_acpi.c 1523 1524 /** 1525 * cppc_set_auto_act_window - Write autonomous act window register. 1526 * @cpu : CPU to which to write register. 1527 * @enable : the desired value of autonomous act window register to be updated. 1528 */ 1529 int cppc_set_auto_act_window(int cpu, u64 auto_act_window) > 1530 { 1531 return cppc_set_reg(cpu, AUTO_ACT_WINDOW, auto_act_window); 1532 } 1533 EXPORT_SYMBOL_GPL(cppc_set_auto_act_window); 1534 1535 /** 1536 * cppc_get_auto_act_window - Read autonomous act window register. 1537 * @cpu : CPU to which to write register. 1538 * @enable : the desired value of autonomous act window register to be updated. 1539 */ 1540 int cppc_get_auto_act_window(int cpunum, u64 *auto_act_window) > 1541 { 1542 return cppc_get_reg(cpunum, AUTO_ACT_WINDOW, auto_act_window); 1543 } 1544 EXPORT_SYMBOL_GPL(cppc_get_auto_act_window); 1545 1546 /** 1547 * cppc_get_auto_sel - Read autonomous selection register. 1548 * @cpunum : CPU to which to write register. 1549 * @enable : the desired value of autonomous selection resiter to be updated. 1550 */ 1551 int cppc_get_auto_sel(int cpunum, u64 *auto_sel) > 1552 { 1553 return cppc_get_reg(cpunum, AUTO_SEL_ENABLE, auto_sel); 1554 } 1555 EXPORT_SYMBOL_GPL(cppc_get_auto_sel); 1556 1557 1558 /** 1559 * cppc_set_auto_sel - Write autonomous selection register. 1560 * @cpu : CPU to which to write register. 1561 * @enable : the desired value of autonomous selection resiter to be updated. 1562 */ 1563 int cppc_set_auto_sel(int cpu, bool enable) 1564 { 1565 return cppc_set_reg(cpu, AUTO_SEL_ENABLE, enable); 1566 } 1567 EXPORT_SYMBOL_GPL(cppc_set_auto_sel); 1568 1569 /** 1570 * cppc_set_epp - Write energe perf register. 1571 * @cpu : CPU to which to write register. 1572 * @enable : the desired value of energe perf register to be updated. 1573 */ 1574 int cppc_set_epp(int cpu, u64 epp_val) > 1575 { 1576 return cppc_set_reg(cpu, ENERGY_PERF, epp_val); 1577 } 1578 EXPORT_SYMBOL_GPL(cppc_set_epp); 1579 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] arch/x86/kernel/cpu/proc.c:63:5: warning: no previous prototype for 'show_cpuinfo'
by kernel test robot 09 Dec '25

09 Dec '25

Hi GONG, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 9d3b0e8891b8b3450a7cd6d1367946a1c69e4eb9 [3493/3493] bpf: Add cpuinfo_x86 iterator target config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082137.XtPdHfzc-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082137.XtPdHfzc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082137.XtPdHfzc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kernel/cpu/proc.c:63:5: warning: no previous prototype for 'show_cpuinfo' [-Wmissing-prototypes] 63 | int show_cpuinfo(struct seq_file *m, void *v) | ^~~~~~~~~~~~ vim +/show_cpuinfo +63 arch/x86/kernel/cpu/proc.c 62 > 63 int show_cpuinfo(struct seq_file *m, void *v) 64 { 65 struct cpuinfo_x86 *c = v; 66 unsigned int cpu; 67 int i; 68 69 cpu = c->cpu_index; 70 seq_printf(m, "processor\t: %u\n" 71 "vendor_id\t: %s\n" 72 "cpu family\t: %d\n" 73 "model\t\t: %u\n" 74 "model name\t: %s\n", 75 cpu, 76 c->x86_vendor_id[0] ? c->x86_vendor_id : "unknown", 77 c->x86, 78 c->x86_model, 79 c->x86_model_id[0] ? c->x86_model_id : "unknown"); 80 81 if (c->x86_stepping || c->cpuid_level >= 0) 82 seq_printf(m, "stepping\t: %d\n", c->x86_stepping); 83 else 84 seq_puts(m, "stepping\t: unknown\n"); 85 if (c->microcode) 86 seq_printf(m, "microcode\t: 0x%x\n", c->microcode); 87 88 if (cpu_has(c, X86_FEATURE_TSC)) { 89 unsigned int freq = arch_freq_get_on_cpu(cpu); 90 91 seq_printf(m, "cpu MHz\t\t: %u.%03u\n", freq / 1000, (freq % 1000)); 92 } 93 94 /* Cache size */ 95 if (c->x86_cache_size) 96 seq_printf(m, "cache size\t: %u KB\n", c->x86_cache_size); 97 98 show_cpuinfo_core(m, c, cpu); 99 show_cpuinfo_misc(m, c); 100 101 seq_puts(m, "flags\t\t:"); 102 for (i = 0; i < 32*NCAPINTS; i++) 103 if (cpu_has(c, i) && x86_cap_flags[i] != NULL) { 104 if (c->x86_vendor == X86_VENDOR_HYGON) 105 seq_printf(m, " %s", i == X86_FEATURE_SEV ? "csv" : 106 (i == X86_FEATURE_SEV_ES ? "csv2" : 107 x86_cap_flags[i])); 108 else 109 seq_printf(m, " %s", x86_cap_flags[i]); 110 } 111 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] arch/x86/mm/kasan_init_64.c:128:15: warning: variable 'p' set but not used
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: 68ee705da160d123656dcbf9ebd449fb77b54bc0 [3386/3386] scripts: kernel-doc: Fix syntax error due to undeclared args variable config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512082005.aJ6IUacC-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082005.aJ6IUacC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082005.aJ6IUacC-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/mm/kasan_init_64.c: In function 'kasan_populate_pgd': >> arch/x86/mm/kasan_init_64.c:128:15: warning: variable 'p' set but not used [-Wunused-but-set-variable] 128 | void *p; | ^ arch/x86/mm/kasan_init_64.c: In function 'kasan_shallow_populate_pgds': arch/x86/mm/kasan_init_64.c:270:15: warning: variable 'p' set but not used [-Wunused-but-set-variable] 270 | void *p; | ^ -- lib/test_blackhole_dev.c: In function 'test_blackholedev_init': >> lib/test_blackhole_dev.c:32:24: warning: variable 'ethh' set but not used [-Wunused-but-set-variable] 32 | struct ethhdr *ethh; | ^~~~ -- >> drivers/acpi/cppc_acpi.c:450: warning: Function parameter or member 'cpc_pptr' not described in '__acpi_get_psd_map' drivers/acpi/cppc_acpi.c:700: warning: Function parameter or member 'pcc_ss_id' not described in 'pcc_data_alloc' drivers/acpi/cppc_acpi.c:1566: warning: Function parameter or member 'cpu_num' not described in 'cppc_get_transition_latency' -- >> net/netfilter/nf_tables_api.c:9162: warning: Function parameter or member 'preg' not described in 'nft_parse_register' vim +/p +128 arch/x86/mm/kasan_init_64.c 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 124 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 125 static void __init kasan_populate_pgd(pgd_t *pgd, unsigned long addr, 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 126 unsigned long end, int nid) 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 127 { 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 @128 void *p; 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 129 p4d_t *p4d; 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 130 unsigned long next; 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 131 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 132 if (pgd_none(*pgd)) { 0d39e2669d7b0f Andrey Ryabinin 2018-01-10 133 p = early_alloc(PAGE_SIZE, nid, true); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 134 pgd_populate(&init_mm, pgd, p); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 135 } 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 136 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 137 p4d = p4d_offset(pgd, addr); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 138 do { 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 139 next = p4d_addr_end(addr, end); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 140 kasan_populate_p4d(p4d, addr, next, nid); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 141 } while (p4d++, addr = next, addr != end); 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 142 } 2aeb07365bcd48 Andrey Ryabinin 2017-11-15 143 :::::: The code at line 128 was first introduced by commit :::::: 2aeb07365bcd489620f71390a7d2031cd4dfb83e x86/mm/kasan: Don't use vmemmap_populate() to initialize shadow :::::: TO: Andrey Ryabinin <aryabinin(a)virtuozzo.com> :::::: CC: Ingo Molnar <mingo(a)kernel.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] drivers/ata/ahci_zhaoxin_sgpio.c:31:5: warning: no previous prototype for 'ahci_wait_em_reset'
by kernel test robot 09 Dec '25

09 Dec '25

Hi leoliu-oc, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: fb43492008c11fe89e510dd63383a2d37ea3cf8e [3493/3493] ata: ahci: Add support for AHCI SGPIO Enclosure Management config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251208/202512081930.DAECHxia-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081930.DAECHxia-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081930.DAECHxia-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ata/ahci_zhaoxin_sgpio.c:31:5: warning: no previous prototype for 'ahci_wait_em_reset' [-Wmissing-prototypes] 31 | int ahci_wait_em_reset(struct sgpio_zhaoxin *sgpio_zhaoxin, u32 retry) | ^~~~~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:55:6: warning: no previous prototype for 'ahci_zhaoxin_set_em_sgpio' [-Wmissing-prototypes] 55 | void ahci_zhaoxin_set_em_sgpio(struct sgpio_zhaoxin *sgpio_zhaoxin) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:99:6: warning: no previous prototype for 'ahci_zhaoxin_set_em_sgpio_gpmode' [-Wmissing-prototypes] 99 | void ahci_zhaoxin_set_em_sgpio_gpmode(struct sgpio_zhaoxin *sgpio_zhaoxin) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:601:6: warning: no previous prototype for 'set_em_messages' [-Wmissing-prototypes] 601 | void set_em_messages(struct sgpio_zhaoxin *sgpio_zhaoxin) | ^~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:621:5: warning: no previous prototype for 'add_sgpio_zhaoxin' [-Wmissing-prototypes] 621 | int add_sgpio_zhaoxin(void) | ^~~~~~~~~~~~~~~~~ >> drivers/ata/ahci_zhaoxin_sgpio.c:673:6: warning: no previous prototype for 'remove_sgpio_zhaoxin' [-Wmissing-prototypes] 673 | void remove_sgpio_zhaoxin(void) | ^~~~~~~~~~~~~~~~~~~~ vim +/ahci_wait_em_reset +31 drivers/ata/ahci_zhaoxin_sgpio.c 25 26 static unsigned int zhaoxin_em_type __read_mostly = AHCI_EM_MSG_LED_MODE; /*LED protocol*/ 27 module_param(zhaoxin_em_type, int, 0644); 28 MODULE_PARM_DESC(zhaoxin_em_type, 29 "AHCI Enclosure Management Message type control (1 = led on, 2 = sgpio on,3 = sgpio gp on)"); 30 > 31 int ahci_wait_em_reset(struct sgpio_zhaoxin *sgpio_zhaoxin, u32 retry) 32 { 33 void __iomem *mmio = sgpio_zhaoxin->mmio; 34 u32 em_ctl; 35 36 if (!sgpio_zhaoxin || retry == 0) { 37 pr_err("In ahci wait em reset, invalid param\n"); 38 return -EINVAL; 39 } 40 41 while (retry--) { /*EM_CTL needs reset at least 64ms*/ 42 em_ctl = readl(mmio + HOST_EM_CTL); 43 if (em_ctl & EM_CTL_RST) 44 usleep_range(10000, 20000); /*EM_CTL still in reset, usleep 10ms*/ 45 else 46 break; 47 48 if (!retry) 49 pr_err("Wait for EM_CTL reset, time out\n"); 50 } 51 52 return 0; 53 } 54 > 55 void ahci_zhaoxin_set_em_sgpio(struct sgpio_zhaoxin *sgpio_zhaoxin) 56 { 57 void __iomem *mmio = sgpio_zhaoxin->mmio; 58 void __iomem *em_mmio = mmio + SGPIO_OFFSET; 59 60 u32 read; 61 62 sgpio_zhaoxin->sgpio_reg.cfg_0.enable = 1; 63 64 sgpio_zhaoxin->sgpio_reg.cfg_1.blink_gen_a = 0x7; 65 sgpio_zhaoxin->sgpio_reg.cfg_1.blink_gen_b = 0x3; 66 sgpio_zhaoxin->sgpio_reg.cfg_1.blink_gen_c = 0x0; 67 sgpio_zhaoxin->sgpio_reg.cfg_1.stretch_act_on = 0; 68 sgpio_zhaoxin->sgpio_reg.cfg_1.stretch_act_off = 0; 69 sgpio_zhaoxin->sgpio_reg.cfg_1.max_act_on = 2; 70 sgpio_zhaoxin->sgpio_reg.cfg_1.force_act_off = 1; 71 72 sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.sload = 0xf; 73 sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.count = 0x0; 74 75 sgpio_zhaoxin->sgpio_reg.transmit_0.sgpio_tx_0 = 0; 76 sgpio_zhaoxin->sgpio_reg.transmit_1.sgpio_tx_1 = 0; 77 sgpio_zhaoxin->sgpio_reg.gp_transmit_reg.sgpio_tx_gp = 0; 78 79 sgpio_zhaoxin->sgpio_reg.receive_reg.sgpio_rx = 0x07070707; 80 sgpio_zhaoxin->sgpio_reg.gp_receive_reg.sgpio_rx_gp = 0; 81 82 /*Setup SGPIO type*/ 83 read = readl(mmio + sgpio_zhaoxin->em_loc); 84 read = read | SGPIO_MESSAGE_HEAD; /*LED register MSG_HEAD, select SGPIO*/ 85 writel(read, mmio + sgpio_zhaoxin->em_loc); 86 87 /*Setup gp mode*/ 88 writel(sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.sgpio_tx_gp_cfg, em_mmio + 0x38); 89 90 /*Initial SGPIO CFG1*/ 91 writel(sgpio_zhaoxin->sgpio_reg.cfg_1.sgpio_cfg_1, em_mmio + 0x4); 92 93 /*Initial SGPIO CFG0*/ 94 read = readl(em_mmio); 95 read |= sgpio_zhaoxin->sgpio_reg.cfg_0.sgpio_cfg_0; 96 writel(read, em_mmio); 97 } 98 > 99 void ahci_zhaoxin_set_em_sgpio_gpmode(struct sgpio_zhaoxin *sgpio_zhaoxin) 100 { 101 void __iomem *mmio = sgpio_zhaoxin->mmio; 102 void __iomem *em_mmio = mmio + SGPIO_OFFSET; 103 u32 read; 104 105 sgpio_zhaoxin->sgpio_reg.cfg_0.enable = 1; 106 107 sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.sload = 0xf; 108 sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.count = 0xff; 109 110 sgpio_zhaoxin->sgpio_reg.transmit_0.sgpio_tx_0 = 0; 111 sgpio_zhaoxin->sgpio_reg.transmit_1.sgpio_tx_1 = 0; 112 sgpio_zhaoxin->sgpio_reg.gp_transmit_reg.sgpio_tx_gp = 0; 113 114 sgpio_zhaoxin->sgpio_reg.receive_reg.sgpio_rx = 0; 115 sgpio_zhaoxin->sgpio_reg.gp_receive_reg.sgpio_rx_gp = 0xff0f0000; 116 117 /*Setup SGPIO type*/ 118 read = readl(mmio + sgpio_zhaoxin->em_loc); 119 read |= SGPIO_MESSAGE_HEAD; 120 writel(read, mmio + sgpio_zhaoxin->em_loc); 121 122 /*Setup gp mode*/ 123 writel(sgpio_zhaoxin->sgpio_reg.gp_transmit_cfg.sgpio_tx_gp_cfg, em_mmio + 0x38); 124 125 /*Enable SGPIO*/ 126 writel(sgpio_zhaoxin->sgpio_reg.cfg_0.sgpio_cfg_0, em_mmio); 127 } 128 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3485/3485] drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c:281:57: warning: diagnostic behavior may be improved by adding the 'format(printf, 1, 2)' attribute to the declaration of 'kbox_dump_printk_info'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: cd2978286f40089fcd83f74ffdff733bfbe1e52a [3485/3485] Huawei BMA: Adding Huawei BMA driver: host_kbox_drv config: loongarch-allyesconfig (https://download.01.org/0day-ci/archive/20251209/202512090240.NdebMvOZ-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 000e46219ba1ee53fc42d35e00c314c2807e8b14) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090240.NdebMvOZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090240.NdebMvOZ-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c:20: In file included from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h:21: In file included from include/linux/netdevice.h:38: In file included from include/net/net_namespace.h:43: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/loongarch/include/asm/cacheflush.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c:281:57: warning: diagnostic behavior may be improved by adding the 'format(printf, 1, 2)' attribute to the declaration of 'kbox_dump_printk_info' [-Wmissing-format-attribute] 281 | num = vsnprintf(tmp_buf, sizeof(tmp_buf) - 1, fmt, args); | ^ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.h:30:6: note: 'kbox_dump_printk_info' declared here 30 | int kbox_dump_printk_info(const char *fmt, ...); | ^ 6 warnings generated. -- In file included from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.c:20: In file included from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h:21: In file included from include/linux/netdevice.h:38: In file included from include/net/net_namespace.h:43: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/loongarch/include/asm/cacheflush.h:8: In file included from include/linux/mm.h:2204: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.c:85:57: warning: diagnostic behavior may be improved by adding the 'format(printf, 1, 2)' attribute to the declaration of 'kbox_dump_painc_info' [-Wmissing-format-attribute] 85 | num = vsnprintf(tmp_buf, sizeof(tmp_buf) - 1, fmt, args); | ^ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.h:21:5: note: 'kbox_dump_painc_info' declared here 21 | int kbox_dump_painc_info(const char *fmt, ...); | ^ 6 warnings generated. vim +281 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c 270 271 int kbox_dump_printk_info(const char *fmt, ...) 272 { 273 va_list args; 274 int num = 0; 275 char tmp_buf[TMP_BUF_SIZE] = { }; 276 277 if (g_printk_init_ok != KBOX_TRUE) 278 return 0; 279 280 va_start(args, fmt); > 281 num = vsnprintf(tmp_buf, sizeof(tmp_buf) - 1, fmt, args); 282 if (num >= 0) 283 (void)kbox_duplicate_printk_info(tmp_buf, num); 284 285 va_end(args); 286 287 return num; 288 } 289 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3485/3485] lib/../mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 5d638f251ef64f68766caaeaf41fbe159807b392 [3485/3485] mm: shrinker: add infrastructure for dynamically allocating shrinker config: arm64-randconfig-004-20251208 (https://download.01.org/0day-ci/archive/20251209/202512090019.r12ZqVrM-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 000e46219ba1ee53fc42d35e00c314c2807e8b14) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090019.r12ZqVrM-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090019.r12ZqVrM-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from lib/vsprintf.c:50: >> lib/../mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ lib/../mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ 1 warning generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] vim +1522 lib/../mm/internal.h 1513 1514 /* shrinker related functions */ 1515 unsigned long shrink_slab(gfp_t gfp_mask, int nid, struct mem_cgroup *memcg, 1516 int priority); 1517 1518 #ifdef CONFIG_SHRINKER_DEBUG 1519 static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, 1520 const char *fmt, va_list ap) 1521 { > 1522 shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); 1523 1524 return shrinker->name ? 0 : -ENOMEM; 1525 } 1526 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3493/3493] mm/gmem.c:383:13: warning: unused variable 'nid'
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 36141432a37f7dedddde8825e724b07ce3a440fb commit: 18b5064b5892580f89d7eca015f884ce10190bac [3493/3493] gmem: hmemcpy should use dma for phy addr config: x86_64-randconfig-161-20251208 (https://download.01.org/0day-ci/archive/20251209/202512090002.kbElJ2I7-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512090002.kbElJ2I7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512090002.kbElJ2I7-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/gmem.c: In function 'gm_as_attach': >> mm/gmem.c:383:13: warning: unused variable 'nid' [-Wunused-variable] 383 | int nid; | ^~~ vim +/nid +383 mm/gmem.c 380709c322aaa3 Cunshu Ni 2025-11-01 378 380709c322aaa3 Cunshu Ni 2025-11-01 379 int gm_as_attach(struct gm_as *as, struct gm_dev *dev, 380709c322aaa3 Cunshu Ni 2025-11-01 380 bool activate, struct gm_context **out_ctx) 380709c322aaa3 Cunshu Ni 2025-11-01 381 { 380709c322aaa3 Cunshu Ni 2025-11-01 382 struct gm_context *ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 @383 int nid; 380709c322aaa3 Cunshu Ni 2025-11-01 384 380709c322aaa3 Cunshu Ni 2025-11-01 385 ctx = kmem_cache_alloc(gm_ctx_cache, GFP_KERNEL); 380709c322aaa3 Cunshu Ni 2025-11-01 386 if (!ctx) 380709c322aaa3 Cunshu Ni 2025-11-01 387 return -ENOMEM; 380709c322aaa3 Cunshu Ni 2025-11-01 388 380709c322aaa3 Cunshu Ni 2025-11-01 389 ctx->as = as; 380709c322aaa3 Cunshu Ni 2025-11-01 390 ctx->dev = dev; 380709c322aaa3 Cunshu Ni 2025-11-01 391 380709c322aaa3 Cunshu Ni 2025-11-01 392 INIT_LIST_HEAD(&ctx->gm_dev_link); 380709c322aaa3 Cunshu Ni 2025-11-01 393 INIT_LIST_HEAD(&ctx->gm_as_link); 380709c322aaa3 Cunshu Ni 2025-11-01 394 380709c322aaa3 Cunshu Ni 2025-11-01 395 if (!list_empty(&as->gm_ctx_list)) { 380709c322aaa3 Cunshu Ni 2025-11-01 396 struct list_head *old_node; 380709c322aaa3 Cunshu Ni 2025-11-01 397 struct gm_context *old_ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 398 380709c322aaa3 Cunshu Ni 2025-11-01 399 old_node = as->gm_ctx_list.prev; 380709c322aaa3 Cunshu Ni 2025-11-01 400 list_del_init(old_node); 380709c322aaa3 Cunshu Ni 2025-11-01 401 old_ctx = list_entry(old_node, struct gm_context, gm_as_link); 380709c322aaa3 Cunshu Ni 2025-11-01 402 kfree(old_ctx); 380709c322aaa3 Cunshu Ni 2025-11-01 403 } 380709c322aaa3 Cunshu Ni 2025-11-01 404 380709c322aaa3 Cunshu Ni 2025-11-01 405 list_add_tail(&dev->gm_ctx_list, &ctx->gm_dev_link); 380709c322aaa3 Cunshu Ni 2025-11-01 406 list_add_tail(&ctx->gm_as_link, &as->gm_ctx_list); 380709c322aaa3 Cunshu Ni 2025-11-01 407 380709c322aaa3 Cunshu Ni 2025-11-01 408 if (activate) { 380709c322aaa3 Cunshu Ni 2025-11-01 409 /* 380709c322aaa3 Cunshu Ni 2025-11-01 410 * Here we should really have a callback function to perform the context switch 380709c322aaa3 Cunshu Ni 2025-11-01 411 * for the hardware. E.g. in x86 this function is effectively 380709c322aaa3 Cunshu Ni 2025-11-01 412 * flushing the CR3 value. Currently we do not care time-sliced context switch, 380709c322aaa3 Cunshu Ni 2025-11-01 413 * unless someone wants to support it. 380709c322aaa3 Cunshu Ni 2025-11-01 414 */ 380709c322aaa3 Cunshu Ni 2025-11-01 415 dev->current_ctx = ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 416 } 380709c322aaa3 Cunshu Ni 2025-11-01 417 *out_ctx = ctx; 380709c322aaa3 Cunshu Ni 2025-11-01 418 380709c322aaa3 Cunshu Ni 2025-11-01 419 /* 380709c322aaa3 Cunshu Ni 2025-11-01 420 * gm_as_attach will be used to attach device to process address space. 380709c322aaa3 Cunshu Ni 2025-11-01 421 * Handle this case and add hnodes registered by device to process mems_allowed. 380709c322aaa3 Cunshu Ni 2025-11-01 422 */ 18b5064b589258 Ni Cunshu 2025-12-08 423 #ifdef CONFIG_CPUSETS 380709c322aaa3 Cunshu Ni 2025-11-01 424 for_each_node_mask(nid, dev->registered_hnodes) 380709c322aaa3 Cunshu Ni 2025-11-01 425 node_set(nid, current->mems_allowed); 18b5064b589258 Ni Cunshu 2025-12-08 426 #endif 380709c322aaa3 Cunshu Ni 2025-11-01 427 return 0; 380709c322aaa3 Cunshu Ni 2025-11-01 428 } 380709c322aaa3 Cunshu Ni 2025-11-01 429 EXPORT_SYMBOL_GPL(gm_as_attach); 2ce9e864fa288b Cunshu Ni 2025-11-02 430 :::::: The code at line 383 was first introduced by commit :::::: 380709c322aaa306b5ac3c278a0700043f7d33e2 gmem: prepare config, boot parameter, vma flag and basic GMEM related structs :::::: TO: Cunshu Ni <nicunshu(a)huawei.com> :::::: CC: zhangjian <zhangjian496(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3386/3386] include/linux/string.h:290:33: warning: '__builtin_strncpy' specified bound depends on the length of the source argument
by kernel test robot 08 Dec '25

08 Dec '25

Hi Weili, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 69d9543977fd7abe8b555406c7a3e5d64d8292f8 commit: a1666f44c2250f7413e73e2f4c02cb2c01f9e3b0 [3386/3386] crypto: hisilicon/qm - support no-sva feature config: arm64-randconfig-r054-20251208 (https://download.01.org/0day-ci/archive/20251208/202512082302.Kf4xjvAw-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512082302.Kf4xjvAw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512082302.Kf4xjvAw-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/bitmap.h:9, from include/linux/cpumask.h:12, from include/linux/smp.h:13, from include/linux/lockdep.h:14, from include/linux/mutex.h:17, from include/linux/kernfs.h:13, from include/linux/sysfs.h:17, from include/linux/kobject.h:21, from include/linux/of.h:17, from include/linux/irqdomain.h:35, from include/linux/acpi.h:13, from drivers/crypto/hisilicon/qm.c:4: In function 'strncpy', inlined from 'qm_alloc_uacce' at drivers/crypto/hisilicon/qm.c:2755:2: >> include/linux/string.h:290:33: warning: '__builtin_strncpy' specified bound depends on the length of the source argument [-Wstringop-truncation] 290 | #define __underlying_strncpy __builtin_strncpy | ^ include/linux/string.h:300:16: note: in expansion of macro '__underlying_strncpy' 300 | return __underlying_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~ In function 'strlen', inlined from 'qm_alloc_uacce' at drivers/crypto/hisilicon/qm.c:2748:13: include/linux/string.h:288:33: note: length computed here 288 | #define __underlying_strlen __builtin_strlen | ^ include/linux/string.h:321:24: note: in expansion of macro '__underlying_strlen' 321 | return __underlying_strlen(p); | ^~~~~~~~~~~~~~~~~~~ vim +/__builtin_strncpy +290 include/linux/string.h 47227d27e2fcb0 Daniel Axtens 2020-06-03 268 47227d27e2fcb0 Daniel Axtens 2020-06-03 269 #ifdef CONFIG_KASAN 47227d27e2fcb0 Daniel Axtens 2020-06-03 270 extern void *__underlying_memchr(const void *p, int c, __kernel_size_t size) __RENAME(memchr); 47227d27e2fcb0 Daniel Axtens 2020-06-03 271 extern int __underlying_memcmp(const void *p, const void *q, __kernel_size_t size) __RENAME(memcmp); 47227d27e2fcb0 Daniel Axtens 2020-06-03 272 extern void *__underlying_memcpy(void *p, const void *q, __kernel_size_t size) __RENAME(memcpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 273 extern void *__underlying_memmove(void *p, const void *q, __kernel_size_t size) __RENAME(memmove); 47227d27e2fcb0 Daniel Axtens 2020-06-03 274 extern void *__underlying_memset(void *p, int c, __kernel_size_t size) __RENAME(memset); 47227d27e2fcb0 Daniel Axtens 2020-06-03 275 extern char *__underlying_strcat(char *p, const char *q) __RENAME(strcat); 47227d27e2fcb0 Daniel Axtens 2020-06-03 276 extern char *__underlying_strcpy(char *p, const char *q) __RENAME(strcpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 277 extern __kernel_size_t __underlying_strlen(const char *p) __RENAME(strlen); 47227d27e2fcb0 Daniel Axtens 2020-06-03 278 extern char *__underlying_strncat(char *p, const char *q, __kernel_size_t count) __RENAME(strncat); 47227d27e2fcb0 Daniel Axtens 2020-06-03 279 extern char *__underlying_strncpy(char *p, const char *q, __kernel_size_t size) __RENAME(strncpy); 47227d27e2fcb0 Daniel Axtens 2020-06-03 280 #else 47227d27e2fcb0 Daniel Axtens 2020-06-03 281 #define __underlying_memchr __builtin_memchr 47227d27e2fcb0 Daniel Axtens 2020-06-03 282 #define __underlying_memcmp __builtin_memcmp 47227d27e2fcb0 Daniel Axtens 2020-06-03 283 #define __underlying_memcpy __builtin_memcpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 284 #define __underlying_memmove __builtin_memmove 47227d27e2fcb0 Daniel Axtens 2020-06-03 285 #define __underlying_memset __builtin_memset 47227d27e2fcb0 Daniel Axtens 2020-06-03 286 #define __underlying_strcat __builtin_strcat 47227d27e2fcb0 Daniel Axtens 2020-06-03 287 #define __underlying_strcpy __builtin_strcpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 288 #define __underlying_strlen __builtin_strlen 47227d27e2fcb0 Daniel Axtens 2020-06-03 289 #define __underlying_strncat __builtin_strncat 47227d27e2fcb0 Daniel Axtens 2020-06-03 @290 #define __underlying_strncpy __builtin_strncpy 47227d27e2fcb0 Daniel Axtens 2020-06-03 291 #endif 47227d27e2fcb0 Daniel Axtens 2020-06-03 292 :::::: The code at line 290 was first introduced by commit :::::: 47227d27e2fcb01a9e8f5958d8997cf47a820afc string.h: fix incompatibility between FORTIFY_SOURCE and KASAN :::::: TO: Daniel Axtens <dja(a)axtens.net> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 08 Dec '25

08 Dec '25

Zicheng Qu (8): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free include/linux/xsched.h | 27 ++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 7 ++ kernel/xsched/cgroup.c | 219 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 18 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 185 insertions(+), 129 deletions(-) -- 2.34.1

2 9

[PATCH OLK-6.6 0/1] Fix UAF issue for mfs
by Hongbo Li 08 Dec '25

08 Dec '25

Fix one UAF issue for mfs. Hongbo Li (1): mfs: Fix UAF problem on event object when enable tracepoint fs/mfs/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] zcopy: Fix NULL pointer dereference while attach conflict with free
by Liu Mingrui 08 Dec '25

08 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBKGM -------------------------------- Add mm_read_lock to avoid conflict between attach and free. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000020300acd7000 [0000000000000000] pgd=0800203008421403, p4d=0800203008421403, pud=0800203008422403, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] SMP CPU: 107 PID: 151805 Comm: ioctl_zcopy_too Kdump: loaded Not tainted 6.6.0-f3180605d2a8 #1 Hardware name: Huawei Taishan 2280 V2/BC82AMDD, BIOS 6.57 05/17/2023 pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : attach_pte_range+0x190/0x9a0 [zcopy] lr : attach_pte_range+0xd4/0x9a0 [zcopy] sp : ffff8000be8abb20 x29: ffff8000be8abb80 x28: 0000ffff90e00000 x27: ffffa651cb444d08 x26: 0400000000000001 x25: 0000000000000000 x24: ffff203017961000 x23: 0000ffff87400000 x22: 0010000000000001 x21: fffffc80c05e5840 x20: ffff2020259111d0 x19: ffffa651cb443c40 x18: ffff8000be8ab9b0 x17: 0000000000000000 x16: ffffa651e40182b0 x15: ffffffffffffffbc x14: ffffa651e8b17c58 x13: ffff20301695a000 x12: ffffa651cb444a58 x11: 0000000000000154 x10: 0000ffff91000000 x9 : ffffa651cb43e574 x8 : 0000000000000000 x7 : ffff20300758a880 x6 : 0000000000200000 x5 : ffff203008b1b438 x4 : 0000000000000001 x3 : 00000000000001da x2 : fffffc0000000000 x1 : 0000000000000000 x0 : 00000000000001da Call trace: attach_pte_range+0x190/0x9a0 [zcopy] attach_page_range+0x22c/0x618 [zcopy] attach_pages+0x2b8/0x8b8 [zcopy] zcopy_ioctl+0xe8/0x168 [zcopy] vfs_ioctl+0x3c/0xa8 __se_sys_ioctl+0x12c/0x160 __arm64_sys_ioctl+0x40/0x68 invoke_syscall+0x8c/0x1d0 el0_svc_common.constprop.0+0x64/0x1d0 do_el0_svc+0x54/0xe0 el0_slow_syscall+0x44/0x1e8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x188/0x190 Fixes: 8d543a8e74d5 ("zcopy: Introduce the pageattach interface") Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/misc/zcopy/zcopy.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/misc/zcopy/zcopy.c b/drivers/misc/zcopy/zcopy.c index f4c56ce07e66..48c0702b96e5 100644 --- a/drivers/misc/zcopy/zcopy.c +++ b/drivers/misc/zcopy/zcopy.c @@ -709,7 +709,9 @@ static int attach_pages(unsigned long dst_addr, unsigned long src_addr, } trace_attach_page_range_start(dst_mm, src_mm, dst_addr, src_addr, size); + mmap_read_lock(src_mm); ret = attach_page_range(dst_mm, src_mm, dst_addr, src_addr, size); + mmap_read_unlock(src_mm); trace_attach_page_range_end(dst_mm, src_mm, dst_addr, src_addr, ret); unpin_user_pages_dirty_lock(process_pages, pinned_pages, 0); -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] Fix invalid paging request while attach transhugepage to same addr
by Liu Mingrui 08 Dec '25

08 Dec '25

zcopy: Fix invalid paging request while attach transhugepage to same addr Liu Mingrui (1): zcopy: Fix invalid paging request while attach transhugepage to same addr drivers/misc/zcopy/zcopy.c | 96 ++++++++++++++------------------------ 1 file changed, 34 insertions(+), 62 deletions(-) -- 2.25.1

2 2

[PATCH OLK-6.6] KVM: arm64: Check the untrusted offset in FF-A memory share
by Luo Gengkun 08 Dec '25

08 Dec '25

From: Sebastian Ene <sebastianene(a)google.com> stable inclusion from stable-v6.6.118 commit fc3139d9f4c1fe1c7d5f25f99676bd8e9c6a1041 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDATPN CVE: CVE-2025-40266 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 103e17aac09cdd358133f9e00998b75d6c1f1518 upstream. Verify the offset to prevent OOB access in the hypervisor FF-A buffer in case an untrusted large enough value [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX] is set from the host kernel. Signed-off-by: Sebastian Ene <sebastianene(a)google.com> Acked-by: Will Deacon <will(a)kernel.org> Link: https://patch.msgid.link/20251017075710.2605118-1-sebastianene@google.com Signed-off-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/arm64/kvm/hyp/nvhe/ffa.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/hyp/nvhe/ffa.c b/arch/arm64/kvm/hyp/nvhe/ffa.c index 8d21ab904f1a..eacf4ba1d88e 100644 --- a/arch/arm64/kvm/hyp/nvhe/ffa.c +++ b/arch/arm64/kvm/hyp/nvhe/ffa.c @@ -425,7 +425,7 @@ static void __do_ffa_mem_xfer(const u64 func_id, DECLARE_REG(u32, npages_mbz, ctxt, 4); struct ffa_composite_mem_region *reg; struct ffa_mem_region *buf; - u32 offset, nr_ranges; + u32 offset, nr_ranges, checked_offset; int ret = 0; if (addr_mbz || npages_mbz || fraglen > len || @@ -460,7 +460,12 @@ static void __do_ffa_mem_xfer(const u64 func_id, goto out_unlock; } - if (fraglen < offset + sizeof(struct ffa_composite_mem_region)) { + if (check_add_overflow(offset, sizeof(struct ffa_composite_mem_region), &checked_offset)) { + ret = FFA_RET_INVALID_PARAMETERS; + goto out_unlock; + } + + if (fraglen < checked_offset) { ret = FFA_RET_INVALID_PARAMETERS; goto out_unlock; } -- 2.34.1

2 1

[PATCH OLK-6.6] NFSD: free copynotify stateid in nfs4_free_ol_stateid()
by Li Lingfeng 08 Dec '25

08 Dec '25

From: Olga Kornievskaia <okorniev(a)redhat.com> stable inclusion from stable-v6.6.117 commit 29fbb3ad4018ca2b0988fbac76f4c694cc6d7e66 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6RK CVE: CVE-2025-40273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream. Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs Reported-by: rtm(a)csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@orac… Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable(a)vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index a813c1123b37..e7c3997a9f5e 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1496,7 +1496,8 @@ static void nfs4_free_ol_stateid(struct nfs4_stid *stid) release_all_access(stp); if (stp->st_stateowner) nfs4_put_stateowner(stp->st_stateowner); - WARN_ON(!list_empty(&stid->sc_cp_list)); + if (!list_empty(&stid->sc_cp_list)) + nfs4_free_cpntf_statelist(stid->sc_client->net, stid); kmem_cache_free(stateid_slab, stid); } -- 2.46.1

2 1

[PATCH OLK-5.10] NFSD: free copynotify stateid in nfs4_free_ol_stateid()
by Li Lingfeng 08 Dec '25

08 Dec '25

From: Olga Kornievskaia <okorniev(a)redhat.com> stable inclusion from stable-v5.10.247 commit 935a2dc8928670bb2c37e21025331e61ec48ccf4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6RK CVE: CVE-2025-40273 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream. Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowner-> nfs4_free_ol_stateid() and it finds that it still has copynotify stateid associated with it. We currently print a warning and is triggerred WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd] This patch, instead, frees the associated copynotify stateid here. If the parent stateid is freed (without freeing the copynotify stateids associated with it), it leads to the list corruption when laundromat ends up freeing the copynotify state later. [ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink [ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary) [ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN [ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024 [ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd] [ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200 [ 1626.861182] sp : ffff8000881d7a40 [ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200 [ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20 [ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8 [ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000 [ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065 [ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3 [ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000 [ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001 [ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000 [ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d [ 1626.868167] Call trace: [ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P) [ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd] [ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd] [ 1626.869813] laundromat_main+0x24/0x60 [nfsd] [ 1626.870231] process_one_work+0x584/0x1050 [ 1626.870595] worker_thread+0x4c4/0xc60 [ 1626.870893] kthread+0x2f8/0x398 [ 1626.871146] ret_from_fork+0x10/0x20 [ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000) [ 1626.871892] SMP: stopping secondary CPUs Reported-by: rtm(a)csail.mit.edu Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@orac… Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable(a)vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 6c0c5de24cf4..302bbad5cdc6 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1370,7 +1370,8 @@ static void nfs4_free_ol_stateid(struct nfs4_stid *stid) release_all_access(stp); if (stp->st_stateowner) nfs4_put_stateowner(stp->st_stateowner); - WARN_ON(!list_empty(&stid->sc_cp_list)); + if (!list_empty(&stid->sc_cp_list)) + nfs4_free_cpntf_statelist(stid->sc_client->net, stid); kmem_cache_free(stateid_slab, stid); } -- 2.46.1

2 1

[PATCH OLK-6.6 0/6] xsched: XCU Partition
by Zicheng Qu 08 Dec '25

08 Dec '25

Zicheng Qu (6): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation include/linux/xsched.h | 27 ++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 7 ++ kernel/xsched/cgroup.c | 219 +++++++++++++++++++++----------------- 4 files changed, 179 insertions(+), 105 deletions(-) -- 2.34.1

2 7

[openeuler:OLK-6.6 3485/3485] mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc'
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b3214ddbe58a44bd3829617668a8d301c8f1994e commit: 5d638f251ef64f68766caaeaf41fbe159807b392 [3485/3485] mm: shrinker: add infrastructure for dynamically allocating shrinker config: arm64-randconfig-004-20251208 (https://download.01.org/0day-ci/archive/20251208/202512081644.0Feaab8s-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 000e46219ba1ee53fc42d35e00c314c2807e8b14) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081644.0Feaab8s-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081644.0Feaab8s-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/secretmem.c:26: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ 1 warning generated. -- In file included from mm/page_alloc.c:59: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/page_alloc.c:7210:20: warning: unused function 'has_unaccepted_memory' [-Wunused-function] 7210 | static inline bool has_unaccepted_memory(void) | ^~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. -- In file included from mm/shrinker.c:7: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ >> mm/shrinker.c:565:53: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 3)' attribute to the declaration of 'shrinker_alloc' [-Wmissing-format-attribute] 565 | err = shrinker_debugfs_name_alloc(shrinker, fmt, ap); | ^ include/linux/shrinker.h:111:18: note: 'shrinker_alloc' declared here 111 | struct shrinker *shrinker_alloc(unsigned int flags, const char *fmt, ...); | ^ 2 warnings generated. -- In file included from mm/list_lru.c:16: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/list_lru.c:98:20: warning: unused function 'list_lru_memcg_aware' [-Wunused-function] 98 | static inline bool list_lru_memcg_aware(struct list_lru *lru) | ^~~~~~~~~~~~~~~~~~~~ 2 warnings generated. -- In file included from mm/madvise.c:37: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/madvise.c:285:6: warning: no previous prototype for function 'force_swapin_vma' [-Wmissing-prototypes] 285 | void force_swapin_vma(struct vm_area_struct *vma) | ^ mm/madvise.c:285:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 285 | void force_swapin_vma(struct vm_area_struct *vma) | ^ | static 2 warnings generated. -- In file included from mm/memblock.c:23: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/memblock.c:1444:20: warning: no previous prototype for function 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] 1444 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ mm/memblock.c:1444:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1444 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ | static 2 warnings generated. -- In file included from mm/mempolicy.c:111: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/mempolicy.c:1123:25: warning: variable 'vma' set but not used [-Wunused-but-set-variable] 1123 | struct vm_area_struct *vma; | ^ mm/mempolicy.c:2959:25: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 2959 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ 3 warnings generated. -- In file included from mm/memory.c:93: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/memory.c:5512:17: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 5512 | int flags = 0, nr_pages; | ^ 2 warnings generated. -- In file included from mm/shmem.c:43: mm/swap.h:66:19: error: call to undeclared function 'swp_offset'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 66 | pgoff_t offset = swp_offset(entry); | ^ In file included from mm/shmem.c:58: include/linux/mman.h:158:9: warning: division by zero is undefined [-Wdivision-by-zero] 158 | _calc_vm_trans(flags, MAP_SYNC, VM_SYNC ) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/mman.h:136:21: note: expanded from macro '_calc_vm_trans' 136 | : ((x) & (bit1)) / ((bit1) / (bit2)))) | ^ ~~~~~~~~~~~~~~~~~ include/linux/mman.h:159:9: warning: division by zero is undefined [-Wdivision-by-zero] 159 | _calc_vm_trans(flags, MAP_STACK, VM_NOHUGEPAGE) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/mman.h:136:21: note: expanded from macro '_calc_vm_trans' 136 | : ((x) & (bit1)) / ((bit1) / (bit2)))) | ^ ~~~~~~~~~~~~~~~~~ In file included from mm/shmem.c:68: include/linux/swapops.h:107:23: error: static declaration of 'swp_offset' follows non-static declaration 107 | static inline pgoff_t swp_offset(swp_entry_t entry) | ^ mm/swap.h:66:19: note: previous implicit declaration is here 66 | pgoff_t offset = swp_offset(entry); | ^ In file included from mm/shmem.c:86: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/shmem.c:1747:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 1747 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ mm/shmem.c:1877:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 1877 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ 5 warnings and 2 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] vim +1522 mm/internal.h 1513 1514 /* shrinker related functions */ 1515 unsigned long shrink_slab(gfp_t gfp_mask, int nid, struct mem_cgroup *memcg, 1516 int priority); 1517 1518 #ifdef CONFIG_SHRINKER_DEBUG 1519 static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, 1520 const char *fmt, va_list ap) 1521 { > 1522 shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); 1523 1524 return shrinker->name ? 0 : -ENOMEM; 1525 } 1526 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] vfs: Don't leak disconnected dentries on umount
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.246 commit 20863bb7fbb016379f8227122edfabc5c799bc79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID4A7Q CVE: CVE-2025-40105 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56094ad3eaa21e6621396cc33811d8f72847a834 ] When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path(). It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are "leaked". Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous "Busy inodes after unmount" bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well. Reported-by: syzbot+1d79ebe5383fc016cf07(a)syzkaller.appspotmail.com Fixes: f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> [ relocated DCACHE_DISCONNECTED propagation from d_alloc_parallel() to d_alloc() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/dcache.c [6a8c6793785d ("fs/dcache.c: avoid panic while lockref of dentry overflow") introduces conflicts, which does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dcache.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/dcache.c b/fs/dcache.c index d36bb8fc2c41..a316a1b2e144 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1884,6 +1884,8 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) __dget_dlock(parent); dentry->d_parent = parent; list_add(&dentry->d_child, &parent->d_subdirs); + if (parent->d_flags & DCACHE_DISCONNECTED) + dentry->d_flags |= DCACHE_DISCONNECTED; spin_unlock(&parent->d_lock); out: return dentry; -- 2.39.2

2 1

[PATCH OLK-5.10] fs/proc: fix uaf in proc_readdir_de()
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Wei Yang <albinwyang(a)tencent.com> stable inclusion from stable-v5.10.247 commit c81d0385500446efe48c305bbb83d47f2ae23a50 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6QZ CVE: CVE-2025-40271 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 895b4c0c79b092d732544011c3cecaf7322c36a1 upstream. Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com Signed-off-by: Wei Yang <albinwyang(a)tencent.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: wangzijie <wangzijie1(a)honor.com> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/proc/generic.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 7b6d9c77b425..643e7d4dc59d 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -693,6 +693,12 @@ void pde_put(struct proc_dir_entry *pde) } } +static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent) +{ + rb_erase(&pde->subdir_node, &parent->subdir); + RB_CLEAR_NODE(&pde->subdir_node); +} + /* * Remove a /proc entry and free it if it's not currently in use. */ @@ -715,7 +721,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) WARN(1, "removing permanent /proc entry '%s'", de->name); de = NULL; } else { - rb_erase(&de->subdir_node, &parent->subdir); + pde_erase(de, parent); if (S_ISDIR(de->mode)) parent->nlink--; } @@ -759,7 +765,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) root->parent->name, root->name); return -EINVAL; } - rb_erase(&root->subdir_node, &parent->subdir); + pde_erase(root, parent); de = root; while (1) { @@ -771,7 +777,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) next->parent->name, next->name); return -EINVAL; } - rb_erase(&next->subdir_node, &de->subdir); + pde_erase(next, de); de = next; continue; } -- 2.39.2

2 1

[PATCH OLK-5.10] fs: Prevent file descriptor table allocations exceeding INT_MAX
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Sasha Levin <sashal(a)kernel.org> stable inclusion from stable-v5.10.241 commit f95638a8f22eba307dceddf5aef9ae2326bbcf98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICXMCD CVE: CVE-2025-39756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 04a2c4b4511d186b0fce685da21085a5d4acd370 upstream. When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include <unistd.h> #include <sys/resource.h> int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request. Fixes: 9cfe015aa424 ("get rid of NR_OPEN and introduce a sysctl_nr_open") Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Link: https://lore.kernel.org/20250629074021.1038845-1-sashal@kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/file.c b/fs/file.c index 0558890fe20c..246ee67dd10e 100644 --- a/fs/file.c +++ b/fs/file.c @@ -126,6 +126,21 @@ static struct fdtable * alloc_fdtable(unsigned int nr) if (unlikely(nr > sysctl_nr_open)) nr = ((sysctl_nr_open - 1) | (BITS_PER_LONG - 1)) + 1; + /* + * Check if the allocation size would exceed INT_MAX. kvmalloc_array() + * and kvmalloc() will warn if the allocation size is greater than + * INT_MAX, as filp_cachep objects are not __GFP_NOWARN. + * + * This can happen when sysctl_nr_open is set to a very high value and + * a process tries to use a file descriptor near that limit. For example, + * if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what + * systemd typically sets it to - then trying to use a file descriptor + * close to that value will require allocating a file descriptor table + * that exceeds 8GB in size. + */ + if (unlikely(nr > INT_MAX / sizeof(struct file *))) + return ERR_PTR(-EMFILE); + fdt = kmalloc(sizeof(struct fdtable), GFP_KERNEL_ACCOUNT); if (!fdt) goto out; -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2025-40190
by Zizhi Wo 08 Dec '25

08 Dec '25

Fix CVE-2025-40190 Ahmet Eray Karadag (1): ext4: guard against EA inode refcount underflow in xattr update Wojciech Gładysz (1): ext4: nested locking for xattr inode fs/ext4/xattr.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] fs/proc: fix uaf in proc_readdir_de()
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Wei Yang <albinwyang(a)tencent.com> stable inclusion from stable-v5.4.302 commit 1d1596d68a6f11d28f677eedf6cf5b17dbfeb491 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6QZ CVE: CVE-2025-40271 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 895b4c0c79b092d732544011c3cecaf7322c36a1 ] Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com Signed-off-by: Wei Yang <albinwyang(a)tencent.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: wangzijie <wangzijie1(a)honor.com> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/proc/generic.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index d8b3c6a7173f..c6495decf1ed 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -670,6 +670,12 @@ void pde_put(struct proc_dir_entry *pde) } } +static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent) +{ + rb_erase(&pde->subdir_node, &parent->subdir); + RB_CLEAR_NODE(&pde->subdir_node); +} + /* * Remove a /proc entry and free it if it's not currently in use. */ @@ -688,7 +694,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) de = pde_subdir_find(parent, fn, len); if (de) { - rb_erase(&de->subdir_node, &parent->subdir); + pde_erase(de, parent); if (S_ISDIR(de->mode)) { parent->nlink--; } @@ -726,13 +732,13 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) write_unlock(&proc_subdir_lock); return -ENOENT; } - rb_erase(&root->subdir_node, &parent->subdir); + pde_erase(root, parent); de = root; while (1) { next = pde_subdir_first(de); if (next) { - rb_erase(&next->subdir_node, &de->subdir); + pde_erase(next, de); de = next; continue; } -- 2.39.2

2 1

[PATCH OLK-5.10 0/1] zcopy: Fix invalid paging request while attach transhugepage to same addr
by Liu Mingrui 08 Dec '25

08 Dec '25

Fix invalid paging request while attach transhugepage to same addr Liu Mingrui (1): zcopy: Fix invalid paging request while attach transhugepage to same addr drivers/misc/zcopy/zcopy.c | 68 +++++++++++++++++++------------------- 1 file changed, 34 insertions(+), 34 deletions(-) -- 2.25.1

2 2

[PATCH OLK-6.6 0/3] arm64/mpam: Reset mbwu_state while creating new monitor group
by Zeng Heng 08 Dec '25

08 Dec '25

Zeng Heng (3): arm64/mpam: Reset mbwu_state while creating new monitor group arm64/mpam: Remove the redundant prev_val member variable arm64/mpam: Need to reset MPAM component when umounting resctrl drivers/platform/mpam/mpam_devices.c | 9 +-------- drivers/platform/mpam/mpam_internal.h | 3 --- drivers/platform/mpam/mpam_resctrl.c | 3 ++- 3 files changed, 3 insertions(+), 12 deletions(-) -- 2.25.1

2 4

[openeuler:OLK-6.6 3485/3485] drivers/media/v4l2-core/v4l2-subdev.c:2253:17: error: implicit declaration of function 'v4l2_subdev_get_locked_active_state'
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 79aa4f2e99baed837a6933aa6b1a852197d30b91 commit: c1be6d998806425f28600e867a8e9a2dd9bac741 [3485/3485] media: subdev: Add v4l2_subdev_is_streaming() config: x86_64-randconfig-003-20251208 (https://download.01.org/0day-ci/archive/20251208/202512081445.4S7Y9xWG-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081445.4S7Y9xWG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081445.4S7Y9xWG-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/media/v4l2-core/v4l2-subdev.c: In function 'v4l2_subdev_is_streaming': >> drivers/media/v4l2-core/v4l2-subdev.c:2253:17: error: implicit declaration of function 'v4l2_subdev_get_locked_active_state' [-Wimplicit-function-declaration] 2253 | state = v4l2_subdev_get_locked_active_state(sd); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/media/v4l2-core/v4l2-subdev.c:2253:15: error: assignment to 'struct v4l2_subdev_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 2253 | state = v4l2_subdev_get_locked_active_state(sd); | ^ vim +/v4l2_subdev_get_locked_active_state +2253 drivers/media/v4l2-core/v4l2-subdev.c 2242 2243 bool v4l2_subdev_is_streaming(struct v4l2_subdev *sd) 2244 { 2245 struct v4l2_subdev_state *state; 2246 2247 if (!v4l2_subdev_has_op(sd, pad, enable_streams)) 2248 return sd->s_stream_enabled; 2249 2250 if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS)) 2251 return !!sd->enabled_pads; 2252 > 2253 state = v4l2_subdev_get_locked_active_state(sd); 2254 2255 for (unsigned int i = 0; i < state->stream_configs.num_configs; ++i) { 2256 const struct v4l2_subdev_stream_config *cfg; 2257 2258 cfg = &state->stream_configs.configs[i]; 2259 2260 if (cfg->enabled) 2261 return true; 2262 } 2263 2264 return false; 2265 } 2266 EXPORT_SYMBOL_GPL(v4l2_subdev_is_streaming); 2267 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0